Over 13M Kemper Corporation records leaked on the dark web, hackers claim

Kemper Corporation, a major American insurer, has been posted on the ShinyHunters hacker gang’s dark web blog. The attackers claim that negotiations with the company failed, leading them to leak over 13 million records, apparently including personal information.

ShinyHunters posted alleged Kemper data on its dark web site in the late hours of April 15th. The hacker group had threatened to leak the insurer's data for several days previously, citing failure to reach an agreement as the reason for uploading stolen records.

With around $5 billion in revenue, Kemper is among the top insurers in the United States, keeping around 10,000 employees on its payroll. We’ve reached out to the company for and will update this article once we receive a .

ShinyHunters claim it has at least 29GB of data, stolen from Kemper’s Salesforce account. Earlier this year, the hackers compromised multiple Salesforce accounts by tricking company employees into revealing their access credentials through social engineering.

The Cybernews research team is currently investigating the data sample shared by the attackers to verify whether ShinyHunters do, in fact, hold information stolen from Kemper.

Unfortunately, many of the Salesforce attack victims have been consistent in posting real data so far. However, attackers sometimes inflate the importance of the data to pressure victims into meeting their demands.

Meanwhile, leaking personally identifiable information (PII) almost always increases cybersecurity risks for people whose data ends up online. Attackers can exploit it for identity theft or for social engineering, further deepening their foothold in target organizations.

At the same time, the impact of leaked corporate data depends on the type of exposed records. Exposed financial records could cause a lot more harm than, for example, employee training materials.

ShinyHunters has dominated cybersecurity headlines in 2026. After successfully obtaining credentials to the Salesforce environment from its employees, the hacking group accessed records for hundreds of Salesforce client companies.

Businesses and organizations often use Salesforce for customer service, marketing automation, analytics, and other services. What type of data ShinyHunters accessed depends on how its clients were using the platform.

Earlier this week, attackers dumped a large dataset supposedly taken from Rockstar Games , the company behind one of the most successful video games in history, Grand Theft Auto.

Another recent victim on ShinyHunters' hit list is the National Railroad Passenger Corporation, better known as Amtrak , with threat actors claiming access to over 9 million records from America’s primary passenger railroad services provider.

ShinyHunters claims to have breached Kemper Corporation's Salesforce environment, posting over 13 million records and 29GB of data on the dark web on April 15th. Kemper has not yet publicly confirmed or denied the breach.

While the full contents are still under investigation, ShinyHunters claims the leaked data includes personally identifiable information (PII) of Kemper customers. The specific data types have not been confirmed.

The attack is part of ShinyHunters' broader 2026 campaign. The gang uses social engineering tactics to trick employees into revealing their login credentials. Once inside a company's Salesforce account, attackers can access customer records, marketing data, and internal documents.

Unlock more exclusive Cybernews content on YouTube.