Allianz Life Insurance Company of North America, the U.S. subsidiary of German insurer Allianz SE, has confirmed that attackers accessed a third-party, cloud-based CRM system on July 16, 2025 and stole personal data belonging to the "majority" of its roughly 1.4 million U.S. customers. The intrusion did not involve exploitation of a software vulnerability. It began with a phone call. Reported impact figures vary meaningfully depending on how the population is counted: the company's own framing describes the majority of 1.4 million customers, ObscureIQ puts the confirmed population at approximately 1.5 million individuals spanning customers, financial professionals and select employees, and secondary aggregation cited by DinosaurSE gives a precise regulatory-style figure of 1,497,036 people. Have I Been Pwned indexed approximately 1.1 million unique email addresses in the leaked data, which is likely the source of the widely repeated "1.1 million" headline number.
What Happened
On July 16, 2025, a threat actor gained access to a third-party cloud CRM platform used by Allianz Life. Every source in this set that names the platform identifies it as Salesforce, and describes the compromise as part of a coordinated 2025 wave against Salesforce customer tenants rather than an isolated event. Allianz Life publicly acknowledged the incident days later, confirming that personal information of most of its 1.4 million customers had been taken.
Attribution across the sources consistently points to ShinyHunters. ObscureIQ describes the collective as operating in coordination with Scattered Spider and Lapsus$, an alignment that has become common in reporting on this cluster. DinosaurSE hedges more, framing ShinyHunters as "suspected" and "possibly tied" to the incident. Treat the attribution as strongly indicated by tradecraft overlap rather than as a formal, victim-confirmed identification.
Microsoft's July 2026 research, the highest-tier source here, does not name Allianz Life. What it does provide is the authoritative technical picture of the campaign class this breach belongs to: activity observed between mid-2025 and mid-2026 with tradecraft commonly associated with ShinyHunters, targeting customer Salesforce instances through vishing and supply chain compromise, and abusing trusted OAuth relationships for access, exfiltration and persistence. Microsoft states plainly that this activity was not the result of a vulnerability inherent to Salesforce.
What Was Taken
The exposed fields reported across sources are consistent and severe: names, gender, dates of birth, email addresses, phone numbers, home addresses, and Social Security numbers. ObscureIQ rates the data sensitivity as elevated and assigns a Breach Risk Index of 72 out of 100, flagging the records as currently circulating on the dark web.
On volume, the sources do not agree on a single number and should not be collapsed into one:
- Approximately 1.4 million customers, with the "majority" affected, per Allianz Life's own confirmed statement as relayed across S1 and S4.
- Approximately 1.5 million individuals including customers, financial professionals and select employees, per ObscureIQ.
- 1,497,036 people, a precise figure carried in aggregated reporting cited by DinosaurSE alongside an offer of two years of credit monitoring.
- Approximately 1.1 million unique email addresses indexed by Have I Been Pwned, per ObscureIQ. DinosaurSE separately reports "approximately 1.1 million customers," which appears to conflate the HIBP dedupe count with the affected population.
The most defensible reading is that the total notified population sits near 1.5 million individuals across several categories, of which roughly 1.1 million resolved to unique email addresses once deduplicated. Anyone citing a single figure without that context is flattening a real distinction.
Financial account credentials and payment data are not claimed as exposed by any source here. Absence of a claim is not the same as confirmation of safety, and this brief does not assert either way.
Why It Matters
This is an identity-layer breach, not a network breach, and that is the strategic point. The perimeter held. Multi-factor authentication was not defeated by brute force. A human being authorized access, and the attacker inherited legitimate privileges from that moment forward.
That inheritance is what makes the technique so effective at scale. Microsoft notes that abusing trusted OAuth relationships allowed enumeration and querying of CRM records while evading conventional authentication detections. The malicious activity looks like an approved integration doing approved things. Volume-based exfiltration through native data-export tooling reads as normal business use unless you are specifically instrumented to see it.
The sector context sharpens the risk. Insurers concentrate medical data, financial records and identity details in one place, making policyholder files unusually valuable for fraud, account takeover and extortion. SecurityScorecard has found that 59% of insurance breaches involve third-party vectors, and Noah Intelligence reports that the Allianz Life incident is being cited as a reference case for how a compromised external relationship becomes a route into core systems.
For the affected individuals, the exposure is permanent in the way that matters. Passwords rotate. Dates of birth and Social Security numbers do not.
The Attack Technique
The chain described by ObscureIQ maps cleanly onto Microsoft's documented intrusion paths:
- Voice phishing. The attacker called an Allianz Life employee and social-engineered them directly. Microsoft identifies vishing targeting OAuth consent as one of two primary intrusion paths in this campaign class.
- Malicious OAuth consent. The victim was walked into authorizing a malicious OAuth application connected to the Salesforce tenant. This is consent abuse, not credential theft. No password was needed, and MFA on the user account did not stand in the way because the user completed the flow themselves.
- Inherited privileges. The connected app operated with user and application privileges, enabling enumeration and querying of CRM records without generating the authentication anomalies most detection stacks are tuned for.
- Bulk export. Data was pulled out through the platform's own data-export tooling, at scale.
- Persistence. Microsoft observes that these access paths frequently led to persistent access, meaning the OAuth grant survives password resets and session revocation until the grant itself is revoked.
Microsoft additionally documents a second path in the same campaign set: supply chain compromise through trusted workflows and integrations such as Salesloft and Gainsight. Nothing in these sources indicates that path was used against Allianz Life, but it belongs in any assessment of tenant exposure. Microsoft observed this activity across many tenants in retail, education and manufacturing, so treat the technique as broadly deployed rather than finance-specific.
What Organizations Should Do
Restrict OAuth consent to an allowlist. End-user consent for third-party connected apps should be off by default in Salesforce and equivalent SaaS platforms. Route every new connected app through an admin approval workflow. This single control breaks the entire chain described above.
Audit every existing OAuth grant now. Inventory connected apps, their scopes, their owners and their last-used dates. Revoke anything unrecognized, unowned or dormant. Remember that revoking a user session does not revoke a token issued to a connected app.
Turn on Salesforce Event Monitoring and alert on export volume. Microsoft explicitly recommends enabling Salesforce event monitoring, and notes it worked with Salesforce to improve Defender for Cloud Apps telemetry granularity, adding near-real-time detection with connected application attribution and expanded permission insights. If you run Defender for Cloud Apps, make sure those detections are live. Baseline normal bulk-export behavior per app and alert on deviation.
Harden the helpdesk and the phone channel. These crews target call centers and IT support with voice social engineering, and stolen session tokens and cookies can undermine passwordless logins or MFA alone because the attacker is trying to look like a trusted user. Require out-of-band identity verification for any request touching access, MFA resets or app authorization, and train staff that a caller asking them to approve a prompt is the attack.
Move vendor risk from paperwork to live access paths. Noah Intelligence, citing Cyber Defense Magazine, notes that many vendor-risk programs still lean on questionnaires and audits while attackers care about live access paths, device trust and privilege levels. Map what each integration can actually read, and scope it down.
Assume the data is already in circulation. ObscureIQ assesses these records as currently active on the dark web. For affected populations, credit monitoring is table stakes; credit freezes are the stronger control. For the organization, expect this data to fuel targeted phishing and account-takeover attempts against your customers indefinitely.
Sources: 🔒 Over 1 4 Million Impacted Allianz Life Suffers A Major Data Breac... | Defending SaaS-based applications against ShinyHunters OAuth abuse... | Allianz Life Insurance Breach (2025): 1.1 Million Policyholder Reco... | Allianz Life Data Breach Exposes Information Of Over 1 Million – Di... | Kathy Morrow | Julie Rea | VP Deputy General Counsel / Chief Compliance Officer Hybrid Halvolink | Insurers face rising cyber threats as attackers target identity and...