A Major U.S. Life Insurance Company Was Hacked. 1.4 Million Customers' SSNs Were Exposed. It's Own Systems Were Never Touched.
Case Study Third-Party Risk May 2026 · 8 min read On July 16, 2025, attackers used a phone call to social engineer access to a third-party CRM system used by a major life insurer. They never touched the insurer's internal networks. They didn't need to. The vendor had the data. The vendor had the access. And the vendor was the open door. A major U.S. life insurance company has 1.4 million customers. On July 16, 2025, threat actors accessed the personal data of the majority of those customers — names, addresses, Social Security numbers, dates of birth, policy numbers, and financial information. The insurer's internal systems were never breached. Its policy administration platform remained secure throughout the entire incident. No attacker ever penetrated the insurer's own network infrastructure. They didn't need to. The insurer used a third-party cloud-based CRM system to manage customer relationsh...