Overview

• Farmers began notifying affected individuals on August 22 after a May 29 intrusion at a third-party vendor was flagged on May 30.
• Exposed information includes names, addresses, dates of birth, driver’s license numbers, and in some cases the last four digits of Social Security numbers.
• Public records list 1,071,172 people affected, while a sample notice cites 1,111,386, a discrepancy that remains unresolved.
• The company says it has seen no evidence of misuse, is offering two years of free identity-protection services, and briefly removed an online advisory during ongoing remediation.
• Security reporting links the incident to a broader Salesforce data-theft campaign using vishing and malicious OAuth apps, with activity attributed to clusters UNC6040/UNC6240 and the ShinyHunters extortion group.