What happened
Allianz Life disclosed that on 16 July 2025 a threat actor used social engineering to reach a third-party cloud-based CRM system holding its Salesforce data, affecting the majority of its roughly 1.4 million customers plus financial professionals and select employees. Have I Been Pwned recorded 1.1 million affected individuals, and about 2.8 million records from Salesforce Accounts and Contacts tables were later leaked. Exposed fields included names, dates of birth, contact details, tax IDs and professional licence data.
How the deception worked
Allianz Life fits the mid-2025 Salesforce pattern: a phone call to an employee from someone presenting as internal IT support, a fake Salesforce connect or login page, and an authorisation step the victim completes themselves. Because the outcome is an authorised connected app or a live session rather than a stolen password, MFA is never challenged again and the export runs through supported APIs. The crews then advertised the haul on a shared Telegram channel, using publicity as extortion pressure against a regulated insurer.
AI involvement · Suspected AI-enabled
Allianz Life did not describe AI use; the wider ShinyHunters campaign it belonged to was documented by EclecticIQ as abusing AI voice-agent platforms for automated vishing.
The control that would have caught it· our reading, not a claim from the sources
Lock connected-app installation to administrators, monitor for anomalous bulk object exports, and treat SaaS CRM as a crown-jewel system with its own phishing-resistant access policy.
Sources (4)
- Allianz Life security breach impacted 1.1 million customersSecurity Affairs·securityaffairs.comOpen ↗
- Allianz Life data breach exposed the data of most of its 1.4M customersSecurity Affairs·securityaffairs.comOpen ↗
- Social engineering attack obtains data on 'majority' of Allianz Life customersThe Record (Recorded Future News)·therecord.mediaOpen ↗
- Google Among Victims in Ongoing Salesforce Data Theft CampaignInfosecurity Magazine·infosecurity-magazine.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.