Skip to content
Breach Index · running record

Allianz data breach (2025): Allianz Life’s CRM theft, Allianz UK’s Oracle EBS hit, and earlier vendor cases

Allianz is a German insurance and asset management group that owns Allianz Life of North America, Allianz UK (LV= General Insurance), PIMCO and Allianz Global Investors. Two separate 2025 attacks hit the group: a social-engineering theft from Allianz Life’s cloud CRM, and Clop’s Oracle E-Business Suite campaign at Allianz UK. This page records what each unit confirmed.

Short answer

Was Allianz hacked?

Yes. Allianz Life Insurance Company of North America said that on 16 July 2025 an attacker used social engineering to get into a third-party, cloud-based CRM system and took personal data on most of its customers, financial professionals and some employees. A later Maine AG filing put the total at 1,497,036 people (as reported by SecurityAffairs). Allianz said there was no evidence its own network or policy administration system was accessed.

In November 2025 Allianz UK confirmed it was a victim of Clop’s Oracle E-Business Suite campaign: data on 80 current and 670 former customers of its personal lines business was taken, per The Register. Allianz UK said this was unrelated to Allianz Life.

Earlier, PIMCO’s Japan arm disclosed in 2024 that a storage and shipping contractor was hit by ransomware, possibly exposing business contact details of 137 people. We found no confirmed breach of Allianz SE’s own group systems.

Timeline at a glance

  1. 16-17 Jul 2025Attacker social-engineers access to Allianz Life’s cloud CRM; detected next day. (The Register)Confirmed
  2. 26 Jul 2025Allianz Life files with Maine AG: “majority” of ~1.4M customers affected. (TechCrunch)Confirmed
  3. Aug 20252.8M records from Allianz Life’s Salesforce tables leaked; ShinyHunters blamed by BleepingComputer. (SecurityAffairs)Reported
  4. 18 Aug 2025Have I Been Pwned counts 1.1M unique people; SSNs reported to Texas and Massachusetts. (TechCrunch)Reported
  5. Oct 2025Maine AG total: 1,497,036 people. (SecurityAffairs / Maine AG)Confirmed
  6. 10 Nov 2025Allianz UK confirms Oracle EBS breach: 80 current, 670 former customers. (The Register)Confirmed
  7. Oct-Nov 2024PIMCO Japan: vendor ransomware may have exposed 137 business contacts. (PIMCO Japan)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Allianz incident timeline, in detail

Confirmed = acknowledged by Allianz, a regulator filing or a court. Reported = credible reporting Allianz has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jul-Nov 2025ConfirmedZero-day in enterprise software (Oracle EBS)

Allianz UK confirms customer data stolen in Clop’s Oracle E-Business Suite campaign

What happened. Clop claimed it had attacked Allianz-owned Liverpool Victoria (LV). Allianz UK, which trades as LV= General Insurance, told The Register the actual victim was its own personal lines business (home, car, pet and travel insurance), reached through Oracle E-Business Suite. Google linked the campaign to CVE-2025-61882 and said attacks may have begun as early as July 2025.

Impact. 80 current and 670 former Allianz UK customers affected, all contacted and offered support, per Allianz UK. It said LV pension customers and systems were not affected, that it reported itself to the ICO, and declined to say whether it was extorted.

Sources: The Register, 10 Nov 2025

Jul-Oct 2025ConfirmedThird-party cloud CRM / social engineering

Allianz Life: social engineering into a cloud CRM exposes about 1.5 million people

What happened. Allianz Life said a threat actor gained access on 16 July 2025 to a third-party, cloud-based CRM system it uses, using a social engineering technique; The Register reported it was detected on 17 July. Allianz Life notified the FBI, filed with the Maine AG on 26 July and began notifying people around 1 August. It did not name the CRM vendor; Have I Been Pwned said the database was hosted by Salesforce (per TechCrunch).

Impact. Allianz Life said the data covered the majority of its roughly 1.4 million customers, plus financial professionals and select employees. HIBP listed names, gender, date of birth, email and home addresses and phone numbers; TechCrunch reported Allianz told Texas and Massachusetts that Social Security numbers were taken too. A Maine AG filing gave 1,497,036 people (via SecurityAffairs). Allianz offered 24 months of identity protection and credit monitoring.

Sources: TechCrunch, 26 Jul 2025 · The Register, 28 Jul 2025 · TechCrunch, 18 Aug 2025 · SecurityAffairs, 2 Oct 2025 (Maine AG total)

Aug 2025ReportedData leak / extortion

Stolen Allianz Life Salesforce tables published online

What happened. SecurityAffairs, citing BleepingComputer, reported that the attackers leaked about 2.8 million records from Allianz Life’s Salesforce “Accounts” and “Contacts” tables, covering individual customers and business partners such as wealth managers, brokers and advisers. BleepingComputer tied the theft to ShinyHunters, which was then claiming Salesforce thefts alongside Scattered Spider and Lapsus$ members. Allianz Life declined to name the attacker.

Impact. The leak included names, addresses, phone numbers, dates of birth and tax IDs, plus adviser licence and firm details, per SecurityAffairs. 2.8 million is a record count, not a people count; HIBP found 1.1 million unique people.

Sources: SecurityAffairs, 13 Aug 2025 · TechCrunch, 18 Aug 2025

31 Jul 2025ReportedLitigation

Class actions filed against Allianz Life in Minnesota

What happened. A proposed nationwide class action was filed against Allianz Life Insurance Company of North America in the US District Court for the District of Minnesota on 31 July 2025, alleging weak security, poor monitoring and slow notice.

Impact. Allegations only; no ruling or settlement was found in the sources we read.

Sources: Insurance Business, 4 Aug 2025

Oct-Nov 2024ConfirmedThird-party / vendor ransomware

PIMCO Japan: ransomware at a promotional-items contractor may have exposed 137 contacts

What happened. PIMCO Japan said its storage and shipping contractor for promotional items, 株式会社倉業サービス (Sogyo Service), was hit by ransomware. The same contractor attack was disclosed by Invesco Japan.

Impact. Names, business addresses and phone numbers of 137 people: contacts at client firms and event companies, and PIMCO Japan staff. A forensic review could not confirm an actual leak, PIMCO said in its 25 November 2024 final report.

Sources: PIMCO Japan notice, 17 Oct 2024 · PIMCO Japan final report, 25 Nov 2024

Where the reports disagree

  • How many Allianz Life people? Allianz first said only “the majority” of about 1.4 million customers. Have I Been Pwned counted 1.1 million unique people in the leaked data (August 2025). The Maine AG filing reported by SecurityAffairs in October 2025 gives 1,497,036, which also covers financial professionals and employees. The attackers’ leak held about 2.8 million records, including duplicates and business contacts.
  • Which vendor? Allianz Life never named the CRM. Have I Been Pwned and other reporting say it was a Salesforce-hosted database; nothing we read says Salesforce’s own platform was breached.
  • LV or Allianz UK? Clop named Liverpool Victoria; Allianz UK says the stolen data was its own personal lines customers’ and LV pension customers were not affected.

The pattern across the record

The weak point was a person and a SaaS tenant

Allianz Life’s core systems were not breached; an employee or help-desk process was talked into giving an attacker access to cloud CRM data. The same 2025 campaign hit many other Salesforce customers.

Mass-exploitation campaigns reach every unit

Allianz UK’s loss came from a zero-day in Oracle EBS used against dozens of firms at once. Large groups get hit through whatever widely used product a gang is exploiting that season.

Small vendors in the asset-management arm

PIMCO Japan’s case, like Invesco Japan’s, came from a contractor that ships promotional items and holds client contact lists.

What it means for Allianz customers — and what to do

If you hold an Allianz Life annuity or policy, or were an Allianz UK personal lines customer, assume your contact details, date of birth and possibly SSN are in criminal hands. The main risks are impersonation and identity fraud.

  1. 1.Freeze your credit if you are a US customer

    Allianz Life told two states that SSNs were taken. A freeze with Equifax, Experian and TransUnion is free and blocks new-credit fraud.

    SSN exposure action plan
  2. 2.Enrol in the offered monitoring

    Allianz Life offered 24 months of identity protection and credit monitoring. Use the code in your letter, not a link in an unsolicited email.

    Breach notice decoder
  3. 3.Expect convincing “Allianz” calls and emails

    The leaked data includes adviser and firm details, so a scammer can name your adviser. Call Allianz on the number on your policy documents before acting.

  4. 4.Advisers and brokers: warn your clients

    Business partner records were in the leak. Expect phishing aimed at you and at clients who know your name.

    Identity protection lab

CISO takeaways

Assess your SaaS tenants, not just the vendor

Connected apps, data export tools and help-desk resets decided this breach. Review who can authorise a new app against your CRM.

SaaS security assessment
Rehearse an OAuth consent abuse

Practise spotting and revoking a malicious connected app before it pulls your customer tables.

OAuth consent lab
Map the notification clocks

Allianz Life filed with Maine within ten days; UK firms answer to the ICO within 72 hours. Map them in advance.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Allianz Life says majority of customers’ personal data stolen in cyberattack — TechCrunch, 26 Jul 2025
  2. 2.Majority of 1.4M customers caught in Allianz Life data heist — The Register, 28 Jul 2025
  3. 3.Allianz Life hit with class action after major July data breach — Insurance Business, 4 Aug 2025
  4. 4.Hackers leak 2.8M sensitive records from Allianz Life in Salesforce data breach — SecurityAffairs, 13 Aug 2025
  5. 5.Allianz Life data breach affects 1.1 million customers — TechCrunch, 18 Aug 2025
  6. 6.Allianz Life data breach impacted 1.5 million people — SecurityAffairs, 2 Oct 2025
  7. 7.Allianz UK joins growing list of Clop’s Oracle E-Business Suite victims — The Register, 10 Nov 2025
  8. 8.Notice on cyberattack at Sogyo Service — PIMCO Japan, 17 Oct 2024
  9. 9.Final report on Sogyo Service incident — PIMCO Japan, 25 Nov 2024

Frequently asked questions

Was Allianz hacked?

Yes. In July 2025 Allianz Life lost data on about 1.5 million people from a third-party cloud CRM after a social engineering attack, and in late 2025 Allianz UK confirmed 750 current and former customers’ data was taken in Clop’s Oracle E-Business Suite campaign.

What happened in the Allianz Life data breach in 2025?

On 16 July 2025 an attacker used social engineering to access a cloud CRM Allianz Life uses (reported as Salesforce-hosted). Names, addresses, phone numbers, emails, dates of birth and, per filings with Texas and Massachusetts, Social Security numbers were taken. Allianz said its own network and policy administration system were not accessed.

How many people were affected by the Allianz Life breach?

The Maine AG filing reported by SecurityAffairs gives 1,497,036 people. Have I Been Pwned counted 1.1 million unique people in the leaked files, and the leak itself held about 2.8 million records.

Who hacked Allianz Life?

Allianz Life has not named the attacker. BleepingComputer, as cited by SecurityAffairs, tied it to ShinyHunters, the group behind the 2025 wave of Salesforce data thefts.

Is there an Allianz Life data breach settlement?

Not that we found. Proposed class actions were filed in federal court in Minnesota from 31 July 2025. No settlement appeared in the sources we read as of November 2026.

Was Allianz UK affected by the Oracle EBS hack?

Yes. Allianz UK told The Register in November 2025 that 80 current and 670 former customers of its personal lines business were affected through Oracle E-Business Suite, and that it reported the incident to the ICO.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Allianz. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.