The Allianz Life data breach just took a huge turn for the worse
Claimed by the ShinyHunters threat group, the Allianz Life data breach has exposed personal data on over a million customers
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
The true scale of the Allianz Life data breach has been laid bare, with leaked credential notification site Have I Been Pwned putting the number of affected accounts at 1.1 million.
The numbers represent the vast majority of the company's 1.4 million customers in the North America region, along with the data of financial professionals and some Allianz Life employees contained in Salesforce Accounts and Contacts databases.
Data exposed in the incident is believed to include dates of birth, email addresses, genders, names, phone numbers, and physical addresses. According to Allianz, Social Security numbers were also taken.
More than seven-in-ten of the exposed email addresses had already been affected by previously-disclosed data breaches.
When the breach was first confirmed, Allianz Life said that 'most' of its North American customers had been affected, but that its core network and policy administration systems didn't appear to have been accessed.
The insurer said it would provide a full consumer notice once it has finished identifying and contacting affected individuals.
Jon Abbott, CEO of ThreatAware, described the scale of the breach as “significant”, noting that the data leaked represents a treasure trove of information to target victims.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"The sensitive and valuable information held in CRM tools is exactly why it’s targeted by attackers,” he said. “The data can be used by other cyber criminals for identity theft and phishing campaigns."
What happened with the Allianz Life data breach?
The breach, which took place on July 16 and was discovered a day later, is believed to have involved a social engineering attack that involved impersonating IT support staff.
This saw hackers ask employees to accept a connection to a Salesforce Data Loader, which was then used to exfiltrate data from the CRM system.
The attackers used malicious OAuth applications to infiltrate Salesforce instances, before downloading the company databases.
The attack has since been claimed by the notorious ShinyHunters threat group, which is believed to overlap with the Scattered Spider and Lapsus groups. They are now believed to be preparing a data leak site to pressure Allianz and other victims into making a ransom payment.
The group, which first emerged in 2020, is also believed to be responsible for attacks on Salesforce systems at several retailers, as well as at Google, Cisco, Qantas, Santander, Ticketmaster, Tokopedia, AT&T and most recently Workday.
Workday confirmed it had fallen victim to an attack last week, warning customers that exposed information could then be used in follow-up social engineering attacks - a common tactic for threat actors.
"Groups such as ShinyHunters rely on fast moving social engineering tactics – this typically involves calling and emailing employees of the victim organization and attempting to extort them. If this does not work, they then launch a leak site with the aim of pressuring victims into payment," said Abbott.
"This pattern in their attacks is why the security fundamentals are so important. Accurate asset inventories, tamper-proof identity verification and hardened service desk processes are all essential.”
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Employee phishing training is working – but don’t get complacent
- Phishing tactics: The top attack trends
- Cheap cyber crime kits can be bought on the dark web for less than $25
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Low-budget devices are the biggest casualty of the RAM crisisNews Say goodbye to budget devices; vendors are doubling down on high-end options to absorb costs
-
Sectigo taps Clint Maddox to lead global field operationsReviews The appointment follows a year of strong momentum for the security vendor as it expands its global channel footprint
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in lifeNews With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Salesforce issues customer alert as ShinyHunters group claims Experience Cloud breachNews Threat actors are using a modified version of the AuraInspector tool, according to Salesforce
-
Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secretsNews The groups are increasingly using face-changing or voice-changing software to make their fake identities more plausible
-
Cloudflare warns state-backed hackers are ‘weaponizing legitimate enterprise ecosystems’ as ‘living off the land’ attacks surgeNews Chinese, North Korean, and Russian-backed threat groups now favor longer-term compromises over brute force attacks
-
DIY hackers are turning to ‘flat-pack’ malware components to speed up attacks and cut costsNews While these malware campaigns are very basic, researchers noted “they still work”
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
