Kemper kemper.com Kemper data breach: what happened and what to do
In April 2026, the ShinyHunters group published data it claimed came from Kemper's Salesforce environment. It included 269,299 unique email addresses with names, phone numbers, physical addresses and partial payment card data. Kemper confirmed the incident.
View all 13,115 breaches- Breach date
- 15 Apr 2026
- Affected
- 269,299
- Data exposed
- Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In April 2026, the ShinyHunters ransomware group named the American insurance holding company Kemper Corporation in a "pay or leak" extortion campaign. The group allegedly got into Kemper's Salesforce environment through social engineering, part of a wider campaign against hundreds of organisations using the same method.
The group later published tens of gigabytes of data it said included internal directory data, Salesforce records and Stripe payment logs. Have I Been Pwned counts 269,299 unique email addresses in it, and added the breach in May 2026.
What was exposed
Alongside the email addresses were names, phone numbers, physical addresses and partial payment card data: the last 4 digits, expiry dates and card brands. Full card numbers are not listed.
What that lets criminals do
A name, phone number, address and the last digits of a card make a phishing call or text credible. A caller can say they're from your insurer, quote the last 4 digits and ask you to "confirm" the rest. Treat any unexpected contact about a policy or payment the same way, however much it knows about you.
Kemper's response
Kemper confirmed the incident. It said it had engaged third-party cybersecurity experts and notified law enforcement.
What to do if you were in it
- 1
Don't trust calls or texts that quote your card details
Knowing the last 4 digits and expiry date proves nothing. Hang up and call the number on your card or policy documents.
- 2
Expect phishing that mentions Kemper or your policy
Delete messages with payment links or urgent renewal warnings. Log in to your account by typing the address yourself.
- 3
Check your card statements
Look for charges you don't recognise. If you see any, tell your card issuer and ask about a replacement card.
- 4
Watch for SIM swap attempts
With your name, phone number and address out there, set a PIN or passcode on your mobile account if your carrier offers one.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you know what to change. It can't remove data from a breach, but it tells you what to do next.
Frequently asked
Was I affected by the Kemper data breach?
Have I Been Pwned lists 269,299 email addresses from this breach. Search your address there or run a free Serus scan.
What was exposed in the Kemper data breach?
Email addresses, names, phone numbers, physical addresses and partial payment card data (last 4 digits, expiry dates and card brands).
Were full card numbers exposed?
Have I Been Pwned lists partial card data only: the last 4 digits, expiry dates and card brands.
Should I change my password?
Passwords aren't listed among the exposed data. Changing it is still sensible if you reuse it, and phishing is the bigger risk.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
