Did you hear that ~7 million customers’ information, including their SSN numbers, was stolen from AssuranceAmerica, an auto insurance company in the USA? Moreover, this data breach is not an exception but a pattern across the insurance industry. This means that if you are American and a customer of an insurance company, your personal information, from your name, phone number, and address to SSN numbers and driver’s license numbers, is likely being traded by cyber criminals.
Why Insurance Industry ?
Here are several notable data breaches from the past few years in insurance-sector:
| Company | Year | Estimated affected | Notable data exposed | Attack vector |
|---|---|---|---|---|
| AssuranceAmerica | 2026 | ~7.0 million | Names, driver’s licenses, insurance policies, vehicle and claims data, SSNs (some) | Compromised employee account (PKWARE®) |
| Allianz Life Insurance Company of North America | 2025 | Majority of 1.4 million customers | Personally identifiable information of customers, financial professionals, and employees | Social engineering against third-party cloud platform (AP News) |
| Aflac | 2025 | Investigation indicated millions could be affected | Social Security numbers, health information, claims-related data | Sophisticated cyber intrusion into U.S. network (Reuters) |
| Farmers Insurance | 2025 | ~1.1 million | Customer personal information | Compromise of a third-party Salesforce environment (Tech.co) |
| Medibank | 2022 | ~9.7 million | Personal details, medical claims, health records | Stolen credentials leading to ransomware/data theft (arXiv) |
This list shows that insurers are increasingly being targeted. The reasons are:
- Insurance companies store highly valuable customer information, including ID, financial data, and health information.
- Insurance employees (or even bosses) usually have little to no knowledge and experience in cybersecurity, which makes them easy targets for hackers.
- Many Insurance companies use the same CRM, ERP systems which make them share the same vulnerabilities if someone find out.
- Not every IT teams know to protect their system. Insurance IT team can not insure that as well.
- Not every defensing plans/equipments are approved due to companies’s “financial priority”.
How did that hack happen ?
According to various sources of news, no sophisticated exploiting technique was used; it seems to have simply been a phishing attack. AssuranceAmerica stated that one of their employees was targeted for months and somehow let login credentials fall into the hands of the hackers. The company did not mention which specific phishing tactics were applied that could have tricked their employee, but here we can guess:
- I guess that hackers cloned AssuranceAmerica’s homepage,
- Then hackers send a link to the targeted employee,
- he/she (the employee) then trusted that cloned website then enter the login username & password.
- Then hackers got the login credentials.
More interestingly, for unknown reasons, these employee credentials can give hackers access to ~7 million customer records. (Well, I guess this is the most powerful “employee” in history).
After confirming the data breach, AssuranceAmerica has notified that they have now enhanced monitoring and threat detection, as well as provided additional cybersecurity awareness training to employees. Sounds good, but it seems too late.
What can cyber criminals do with your information ?
With these data, cyber criminals can make their scamming campaigns more convincing since they can mention correct IDs and personal info. With your personal information, someone can impersonate you, open fraudulent accounts, or attempt to bypass identity verification processes. Information such as your name, address, date of birth, driver’s license number, or government-issued identification can be used to commit identity theft or apply for financial services in your name.
Insurance records and vehicle information are particularly valuable. Criminals can exploit policy details to conduct insurance fraud, file false claims, impersonate policyholders, or convince victims that they are communicating with their legitimate insurance provider.
Stolen personal information is also frequently traded on underground marketplaces. Even if one attacker has no immediate use for your data, it may be sold repeatedly to other criminals, enabling future scams, spam campaigns, identity theft, or account takeover attempts.
What can we learn from this ?
Here again, we can see that the most critical damages do not always come from high-tech hacking but can arise from a simple phishing email (or SMS). The weakest points in a system are humans. No matter how skillful the IT team is, weaknesses in employees represent a system’s weakness. Therefore, learning about cybersecurity is necessary for everyone, not just IT. Relying solely on the IT team for protection is not enough.
This also highlights the “Least Privilege” principle, as we can see that an employee account has the ability to read a massive amount of data. This level of access is excessive for an employee.
We can also notice how a simple authentication mechanism is being used on a system storing highly valuable personal data. There is no two-step authentication, no warning for suspicious login sessions, and no IP-based login for internal users. If two-step authentication were implemented here, the theft would not have occurred so easily.
Do not let a real cyber incident teach you how vulnerable your system is. Prevention is always less costly than recovering from a breach.
Build – Secure – Evolve with the-tech-lead.com