INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Allianz Life data breach compromised by sophisticated cyber attack tools

| 2025-08-20 10:40 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
The Allianz Life data breach, which occurred on July 16 and was discovered a day later, involved a social engineering attack that impersonated IT support staff. The attackers used malicious OAuth applications to infiltrate Salesforce instances before downloading the company's databases, resulting in the exposure of sensitive information including dates of birth, email addresses, genders, names, phone numbers, physical addresses, Social Security numbers, and data from 1.4 million customers in the North America region, as well as financial professionals and some Allianz Life employees. The leaked credential notification site Have I Been Pwned reported that over 1.1 million accounts were affected, with more than seven-in-ten of the exposed email addresses having already been targeted by previously-disclosed data breaches.
Technical Mitigations AI-generated
• Patch Salesforce instances using malicious OAuth applications to prevent data exfiltration. • Implement accurate asset inventories and hardened service desk processes to detect social engineering tactics. • Use tamper-proof identity verification techniques to block or hunt for attackers impersonating IT support staff.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered Spider
Target & Sectors
Global Scope
Incident Timeline
‎2025/08/20
Threat actors, believed to be affiliated with the ShinyHunters group and possibly overlapping with Scattered Spider and Lapsus groups, used social engineering tactics involving impersonated IT support staff to target Allianz Life.
victims 1.4 customers
The numbers represent the vast majority of the company's 1.4 million customers in the North America region, along with the data of financial professionals and some Allianz Life employees contained in Salesforce Accounts and Contacts databases.
threat_actor Scattered Spider
The attack has since been claimed by the notorious ShinyHunters threat group , which is believed to overlap with the Scattered Spider and Lapsus groups.
Tactical Metrics
Metrics
victims
1,400,000
Customers
The numbers represent the vast majority of the company's 1.4 million customers in the North America region, along with the data of financial professionals and some Allianz Life employees contained in Salesforce Accounts and Contacts databases.
Intelligence Sources
IT Pro 2025-08-20