Allianz Life data breach: what happened and what to do

Allianz Life is the US life insurance and annuity arm of Allianz. Its 2025 breach didn't come from breaking into its own systems. It came from tricking a person.

What happened

Allianz Life said it was the victim of a cyber attack, which it attributed to "a social engineering technique". Social engineering means manipulating someone, often by phone or message, into handing over access. Filings and press reports say the attackers got into a third-party, cloud-hosted CRM (a database of customer relationships). The company said its own networks and policy administration systems weren't affected. Reports linked the incident to Salesforce, which stated that its platform hadn't been compromised, though Allianz never officially named the vendor.

Have I Been Pwned dates the breach to 16 July 2025. Millions of records were later leaked online, and it added the data on 18 August 2025.

How many people

The figures don't line up, so be careful. Have I Been Pwned counts 1,115,061 unique email addresses in the leaked data. A notice Allianz filed with the Maine Attorney General, as reported by Security Affairs, gives a larger total of 1,497,036 people affected. Attackers reportedly took about 2.8 million records, but that number includes duplicates and entries that aren't customers. They're different measures: email addresses in a leak versus people the company notified.

What was exposed

The leaked records held email addresses and names. Genders, dates of birth, phone numbers and physical addresses were in there too. Some reports mention other fields. Have I Been Pwned's list is the one to rely on.

For an insurance customer, that's exactly what a scammer needs to pose as the insurer. A caller who knows your name and address, plus your birth date and the fact that you hold a policy, sounds like the real thing. Birth dates never change. That one stays useful to criminals for years.

What Allianz Life did

Allianz Life notified affected people and regulators. It reportedly offered two years of free identity monitoring through Kroll. If you received a letter, it will have instructions for enrolling, and it's worth keeping.

What to watch for

Be wary of calls and emails about your policy, a claim, a payout or a request to confirm your details. Hanging up and calling back on a number printed on your policy documents is always safe.

Why social engineering works

No software flaw is needed when someone can be talked into granting access. Attackers who phone an employee and pose as IT support are doing the same thing to staff that scammers do to customers. A breach at a company you trust can come down to one convincing conversation. Nothing you could have spotted from outside.