Farmers Insurance breach impacts over 1 million customers

The Farmers Insurance Group is notifying more than one million customers their personal information was exposed in a recent cyberattack earlier this year.

The American insurance giant said it began sending breach notification letters about the May 29th “security incident” out of an “abundance of caution” on August 22nd.

The breach may have involved the “personal information of certain individuals,” it said.

Farmers revealed in a notice posted on its website and also filed with the Office of the Maine Attorney General, that the intrusion originated with unauthorized access to a third-party vendor and a database containing Farmers' customer information.

“The third-party vendor had monitoring tools in place, which allowed the vendor to quickly detect the activity and take appropriate containment measures, including blocking the unauthorized actor,” Farmers said.

According to multiple filings with the Main AG under its subsidiaries, Farmers Insurance Exchange, Farmers Group, and the Farmers New World Life Insurance Company, a total of 1,111,386 individuals have been impacted.

The Farmers Insurance Group of Companies currently makes up one of the country's largest insurers of vehicles, homes, and small businesses, as well as a wide range of other specialty insurance and financial services products, the company’s website states.

Founded in 1928 and with corporate addresses in California and Washington, Farmers boasts more than 19 million individual insurance policies, roughly 48,000 agents, 21,000 employees, and serves over 10 million households in all 50 states.

Customer data accessed by hackers

Upon launching a comprehensive investigation and subsequent review, Farmers said it was determined on July 24th that “certain personal information related to a select population of Farmers customers was subject to unauthorized access and acquisition.”

Customer information compromised in the database is said to have included:

• Name
• Address
• Date of birth
• Driver’s license number
• Last four digits of Social Security number (in some cases).

Farmers said it found no evidence that additional personal information was accessed.

Still, Farmers urges its customers to “remain vigilant against identity theft and fraud, review financial account statements and credit reports for any anomalies, and notify their financial institution of any unauthorized transactions or suspected identity theft.”

The company is offering twenty-four months of free identity-monitoring services to any impacted customers.

Last month, a cyberattack at US insurance firm Allianz Life also exposed the personal data of 1.1 million customers.

That incident was attributed to another third-party vendor attack, this time on the company's cloud-based CRM system. It was one of many Customer Relationship Management, or CRM platform, attacks this year.