Allianz Life breach affects 1.1 million people via third-party CRM

A data breach at Allianz Life exposed the personal information of about 1.1 million people in July, according to a breach-tracking service that aggregates incident data. Allianz Life said the breach affected the majority of its 1.4 million US customers, as well as select financial professionals and employees, and it has begun notifying affected individuals while the investigation continues. The company has offered two years of identity monitoring services to those impacted and said there is no evidence that its internal networks or core systems were compromised.

The incident centers on access to a third-party cloud-based customer relationship management system that Allianz Life uses to manage client data. Attackers gained entry by exploiting the CRM provider via social engineering, a method that has been linked in broader industry activity to well-known extortion-focused groups. Once inside, the perpetrators were able to retrieve personally identifiable information from the system, including names, addresses, dates of birth, phone numbers and email addresses. Some records also included more sensitive data such as Social Security numbers, and in certain states the breach...