Allianz Life Breach Tied to CRM Compromise

A malicious actor breached a customer relationship management platform used by Allianz Life Insurance of North America on July 16 and stole personally identifiable information of most of its 1.4 million U.S. customers, financial professionals and some employees, the company said.

Company spokesperson Brett Weinberg said the hacker gained access “using a social engineering technique.” The insurer did not disclose the CRM in question nor the name of the hacker. Bleeping Computer attributed the attack to the ShinyHunters extortion group.

ShinyHunters is a loose group of attackers that has existed since 2020 and been involved in a slew of high-profile incidents, including the theft of terabytes of data from clients of cloud-based data warehousing platform Snowflake. French police in June reportedly arrested five suspected hackers accused of being administrators of stolen data marketplace BreachForums, where ShinyHunters has been actively involved. French daily newspaper Le Parisien reported that the handle of one suspect was “ShinyHunters.”

“ShinyHunters is a group, much like Scattered Spider, so it would appear France arrested people that were a part of the group, but not the whole group,” said Trevor Hilligoss, a senior vice president with cybercrime threat intel firm SpyCloud Labs at SpyCloud.

Buttressing a possible ShinyHunters attribution is a June warning from Google that a threat actor it tracks as UNC6040 has had success recently in using voice phishing techniques to target Salesforce customer relationship management instances for date theft. One effective technique has been to impersonate IT support personnel and socially manipulate victims into authorizing a maliciously modified version of Saleforce’s Data Loader. UNC6040 overlaps with the cybercrime community that calls itself “The Community,” aka the Com, which has given rise to a number of cybercrime threat actors specializing in social engineering, including groups popularly known as Scattered Spider, Lapsus$ and Oktapus, aka 0ktapus. The threat actor may have partnered with ShinyHunters to commercialize the stolen data.

But it’s too early to make a definitive attribution to ShinyHunters, at least based on online chatter of hackers in criminal forums, Hilligoss said. “The criminals are being just as speculative as everyone else is, and no one from ShinyHunters, nor the broader community, has come out to claim responsibility,” he said.

While searching criminal forums for evidence of ShinyHunters, Information Security Media Group saw hackers offering for sale data putatively taken from Allianz Brazil and Allianz Spain. When asked about these listings, Weinberg responded that “the current situation only pertains to Allianz Life in the U.S.” The company did not comment further on the forum posts or whether its Brazilian or Spanish subsidiaries are investigating potential breaches.

“This breach is a stark reminder of how critical it is to have a comprehensive security and governance program around enterprise business applications such as CRM platforms, which store a massive amount of sensitive customer PII,” said Piyush Pandey, CEO at Pathlock, an identity and access security provider.

“It’s important to embrace real-time access risk analysis that continuously monitors whether corporate accounts have the right level of access based on their current context and behavior, not just their job title or group membership,” Pandey said.