Loading story…
Allianz Life and WestJet have both confirmed significant data breaches impacting a combined total of approximately 3.7 million customers and employees across North America. Allianz Life, an insurance company, reported that the personal data of about 1.5 million individuals was compromised following a security incident at an unnamed third-party customer relationship management (CRM) provider. The exposed information includes names, addresses, dates of birth, and Social Security numbers belonging to customers, staff, and financial professionals associated with Allianz. The company notified affected individuals through letters and reported the incident to the Maine Attorney General's Office, emphasizing the breadth of the data accessed. In parallel, Canadian airline WestJet disclosed that a cyberattack in June, allegedly carried out by the Scattered Spider group, resulted in the exposure of data for 1.2 million Americans. The breach affected WestJet’s online services and mobile app, prompting the airline to urge customers and staff to exercise additional caution. The compromised data at WestJet may include names, contact details, reservation information, and documents related to travel, though the airline assured that credit card numbers, CVV codes, and user passwords were not affected. WestJet also stated that the safety and integrity of its operations were never at risk during the incident. Both companies have faced scrutiny over the handling of sensitive personal information and the adequacy of their security measures, particularly in the context of third-party service providers. The incidents highlight the persistent risks associated with supply chain vulnerabilities and the growing trend of attackers targeting service providers to access large volumes of data. Regulatory authorities, such as the FTC and state attorneys general, are closely monitoring these breaches, and affected organizations are under pressure to improve their incident response and notification processes. The breaches underscore the importance of robust third-party risk management and the need for organizations to maintain transparency with customers following security incidents. As the number of large-scale data breaches continues to rise, these cases serve as a reminder of the critical need for comprehensive cybersecurity strategies and proactive defense measures across all sectors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The U.S. Federal Trade Commission filed a lawsuit against Sendit alleging improper collection of children's data. The action was reported as part of a broader breach and privacy roundup.
A wave of data breach disclosures affecting North America was reported, with roughly 3.7 million notification letters expected to be sent to affected individuals. The references indicate a broad set of breach notifications rather than a single incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several major organizations in the healthcare and insurance sectors have disclosed significant data breaches affecting millions of individuals. ARC Community Services reported a ransomware attack by the INC Ransom group, resulting in the exfiltration of sensitive patient data, including health and financial information. Aflac confirmed that a June cyberattack led to the theft of files containing insurance claims, health data, and Social Security numbers for over 22 million customers, with no operational disruption but widespread exposure of personal information. The Louisiana Office of Student Financial Assistance (LOSFA) notified students of unauthorized access to its systems, exposing names and Social Security numbers, though certain savings accounts were not affected. Oklahoma Spine Hospital agreed to a $1.1 million settlement following a July breach that compromised the data of nearly 39,000 patients, including medical and financial details. These incidents highlight the ongoing threat posed by cybercriminals targeting sensitive data in the healthcare and insurance industries. Victims in these breaches are being offered credit monitoring and identity protection services, and regulatory notifications have been issued. The attacks have prompted legal action, regulatory scrutiny, and, in some cases, leadership changes within affected organizations. Law enforcement and cybersecurity experts have been engaged to investigate and mitigate the impact of these breaches, which are part of a broader trend of targeted attacks against organizations handling large volumes of personal and health-related information.
Jun 29, 2026
Figure and Allianz Life disclosed separate breaches in which attackers used **social engineering** to gain access to systems holding large volumes of customer data. Figure said an employee was deceived into granting access, leading to the public posting of a dataset from January 2026 that contained more than **900,000 unique email addresses** as well as names, phone numbers, physical addresses, and dates of birth. Allianz Life reported that a cyberattack in July 2025 targeted data stored on **Salesforce** and was later followed by the online leak of **1.1 million unique email addresses**. The exposed Allianz Life records also included names, genders, dates of birth, phone numbers, and physical addresses, underscoring how social engineering attacks continue to drive large-scale exposure of sensitive personal information across financial services firms.
Jun 29, 2026
Qantas disclosed that a cyberattack exposed personal data belonging to about **5.7 million to 6 million customers**, making it one of the most significant airline-sector breaches reported in Australia. Early reporting said the incident affected customer records rather than flight operations, with exposed information understood to include personal and contact details held in airline systems. Coverage also linked the intrusion to the broader wave of attacks against airlines and travel firms attributed to **Scattered Spider**, a financially motivated threat group known for social-engineering tactics and extortion. Subsequent reporting said Qantas was among nearly **40 companies** facing ransom demands from the same hacker group, and that attackers later leaked data containing roughly **5 million customer records** after a ransom deadline passed. The leak escalated the incident from a large-scale breach to a public extortion event, increasing the risk of fraud, phishing, and identity abuse for affected customers while underscoring the aviation sector's exposure to coordinated intrusion-and-ransom campaigns.
Jul 3, 2026