Overview

• Farmers began sending notification letters on August 22, with state filings confirming 1,111,386 people affected and about 40,000 tied to Farmers New World Life.
• The company says exposed data includes names, addresses, dates of birth, driver’s license numbers, and in some cases the last four digits of Social Security numbers.
• Farmers reports the third-party vendor was breached on May 29 and detected suspicious activity on May 30, after which an investigation and containment actions followed.
• Security reporting links the incident to a broader campaign against Salesforce customers using vishing and malicious OAuth apps, attributed to UNC6040/UNC6240 and associated with ShinyHunters and Scattered Spider; victims in the spree reportedly include Google, Cisco, Workday, Adidas, Qantas, Allianz Life, and LVMH brands.
• Farmers has not named the vendor, and an online advisory confirming the breach was briefly posted then removed, while the company is offering two years of identity theft protection to affected individuals.