Overview

• Threat actors claiming ties to ShinyHunters, Scattered Spider and Lapsus$ publicly released complete Salesforce “Accounts” and “Contacts” tables containing about 2.8 million customer and partner records
• Leaked data includes sensitive personal identifiers such as dates of birth, Tax Identification Numbers and phone numbers alongside professional credentials and firm affiliations
• The breach originated through a mid-July social-engineering attack on a third-party Salesforce CRM rather than a compromise of Allianz Life’s internal network
• Allianz Life says it notified the FBI, filed a notice with Maine’s Attorney General and is alerting affected customers and business partners
• So far there is no sign that core policy systems were accessed, but exposed CRM records carry significant risk of identity theft, fraud and phishing as the inquiry continues