Did you hear that ~7 millions customer’s information including their SSN numbers were stolen from AssuranceAmerica – an auto insurance company in USA ? Moreover, this data breach is not an exception but is a pattern across insurance industry. It means that if you are American and are a customer of an insurance company, your personal information – from name, phone, addresses to SSN numbers and driver’s license number, is likely being trade by cyber criminals.
Why Insurance Industry ?
Here are several notable data breaches from the past few years in insurance-sector:
| Company | Year | Estimated affected | Notable data exposed | Attack vector |
|---|---|---|---|---|
| AssuranceAmerica | 2026 | ~7.0 million | Names, driver’s licenses, insurance policies, vehicle and claims data, SSNs (some) | Compromised employee account (PKWARE®) |
| Allianz Life Insurance Company of North America | 2025 | Majority of 1.4 million customers | Personally identifiable information of customers, financial professionals, and employees | Social engineering against third-party cloud platform (AP News) |
| Aflac | 2025 | Investigation indicated millions could be affected | Social Security numbers, health information, claims-related data | Sophisticated cyber intrusion into U.S. network (Reuters) |
| Farmers Insurance | 2025 | ~1.1 million | Customer personal information | Compromise of a third-party Salesforce environment (Tech.co) |
| Medibank | 2022 | ~9.7 million | Personal details, medical claims, health records | Stolen credentials leading to ransomware/data theft (arXiv) |
This list shows that insurers are increasingly targeted. The reason is:
- Insurance companies store highly valuable customer information, including ID, financial data, and health information.
- Insurance employees (or even bosses), usually have no or very little knowledge and experience on cybersecurity, which makes them easy targets for hackers.
- Many Insurance companies use the same CRM, ERP systems which make them share the same vulnerabilities if someone find out.
- Not every IT teams know to protect their system. Insurance IT team can not insure that as well.
- Not every defensing plans/equipments are approved due to companies’s “financial priority”.
How did that hack happen ?
According to various source of news, there was no sophisticated exploiting technique was used. It seems simply a phishing attack. AssuranceAmerica stated that one of their employees was targeted for months and somehow let login credentials to hackers’s hand. The company did not mention which exactly phishing tactics was applied that can tricked their employee, but here we can guess:
- I guess that hackers cloned AssuranceAmerica’s homepage,
- then hackers send a link to targeted employee,
- he/she (the employee) then trusted that cloned website then enter the login username & password.
- Then hackers got the login credentials.
More interesting, for unknown reasons, this employee credentials can give hackers an access to ~7 millions customer data. (well, I guess this is the most powerful “employee” in history).
After confirming the data breach, AssuranceAmerica has notified that they now enhanced monitoring and threat detection as well as provided additional cybersecurity awareness training to employees. Sounds good, but it seems too late.
What can cyber criminals do with your information ?
With these data, cyber criminals can make their scamming campaigns more convincing since they can mention correct IDs and personal info. With your personal information, someone can impersonate you, open fraudulent accounts, or attempt to bypass identity verification processes. Information such as your name, address, date of birth, driver’s license number, or government-issued identification can be used to commit identity theft or apply for financial services in your name.
Insurance records and vehicle information are particularly valuable. Criminals can exploit policy details to conduct insurance fraud, file false claims, impersonate policyholders, or convince victims that they are communicating with their legitimate insurance provider.
Stolen personal information is also frequently traded on underground marketplaces. Even if one attacker has no immediate use for your data, it may be sold repeatedly to other criminals, enabling future scams, spam campaigns, identity theft, or account takeover attempts.
What can we learn from this ?
Here again, we can see that the most critical damages do not always come from high-tech hacking, but can from a simple phishing email (or SMS). The weakest points in a system are humans. No matter how skillful the IT team is, weaknesses in an employee is system’s weakness. So learning about cybersecurity is necessary for everyone, not just IT. Resort on IT team for protection is not enough.
This also again highlights the “Least Privilege” principle when we can see an employee account here can read a massive amount of data. This is just too much privilege for an employee.
We also can notice that how simple authentication mechanism is being used on a system storing highly valuable personal data. There is no 2-step-authentication, no suspicious login session warning, no IP-based login for internal users. If there is a 2-step-authentication here, the steal would not happen that easy.
Do not let a real cyber incident teach you how vulnerable your system is. Prevention is always less costly than recovering from a breach.
Learn coding helps you build system, read The-Tech-Lead.com helps you protect it