Back Theinsurer

NAIC says leaked data has been published online by threat actor ShinyHunters

Theinsurer • June 26, 2026

The National Association of Insurance Commissioners said publicly available statutory financial reports, credit rating agency data and rating determinations of insurer investments have been published online by a threat actor that ‌gained unauthorized access .

These statutory financial statements made public were already available before this incident through state websites, InsData or resellers and the credit rating determination data does not include any rating agency investment rationale reports, the agency said.

"We have engaged an outside data consultant to further evaluate the dataset ⁠to validate our internal analysis. We anticipate this review to take at least several weeks," the agency said in a statement on Thursday.

The NAIC disclosed on June 17 that it had identified on or June 11 unauthorized access to its PeopleSoft systems by an unknown third party, after which it promptly activated incident response procedures.

"From the information known to date, there is no current evidence that personal information (PII) or payment or financial account information was impacted, including ‌credit ⁠card or banking information," the NAIC said in its latest statement.

As of now, the NAIC said its regulatory filing systems are operating as normal and are secure.

ShinyHunters claimed responsibility for the data breach. It said that over 3.1 terabytes of NAIC data, comprising ⁠more than 105,000 files, were compromised, Cyber Risk Insurer reported earlier this week.

The group said this includes 2.1 million insurer regulatory filing PDFs, 40,000 quarterly statistical CSVs with federal ⁠EINs and company data, more than 45,000 licensed rating agency files from Moody's, Fitch, S&P, Kroll, DBRS and AM Best with CUSIP and ISIN identifiers, ⁠statutory annual and quarterly financial statements, premium and loss statistics and HR Ratings master data.

ShinyHunters warned that if the NAIC did not reach out by Monday, June 22, it would leak the data and cause “several annoying (digital) problems.”

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ShinyHunters Target SSO Accounts in Voice Phishing Attacks The ShinyHunters extortion gang has claimed responsibility for a series of voice phishing attacks targeting single sign-on (SSO) accounts at major platforms including Okta, Microsoft, and Google. In these attacks, threat actors impersonate IT support to trick employees into providing their credentials and multi-factor authentication codes, enabling access to corporate SaaS platforms and potential data theft for extortion purposes. 158 sources 51

Extracted Entities

NAIC says leaked data has been published online by threat actor ShinyHunters

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Industries (1)

Platforms (1)