Skip to content
Back to victims

Allstate

exfilsquad

Ransomware leak-site victim intelligence

Data size
15.1 GB UNCOMPRESSED
Files
1
Posted
Jul 26, 2026
Country
US
Industry
Financial Services

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, our reporting

ExfilSquad claims to have stolen 15.1 GB of data from Allstate, comprising roughly 657,000 records containing significant PII, recruitment and licensing information, onboarding data, and internal employee account information. The leak post claims a single file, published as a 7z archive named allstate_exfilsquad.7z. The leak page lists the victim as the United States and provides a creation date of 1786015909; the publication status is “published.”

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

DATA SUMMARY:\n657K~ records containing: significant PII, recruitment and licensing information, onboarding data, and internal employee account information.

File types seen
7z × 1
Sample files (1)
allstate_exfilsquad.7z

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

trackers
["udp://tracker.publictracker.xyz:6969/announce", "udp://seedpeer.net:6969/announce", "http://tracker.opentrackr.org:1337/announce", "udp://open.stealth.si:80/announce", "http://open.tracker.cl:1337/announce", "udp://tracker.torrent.eu.org:451/announce", "udp://tracker.wildkat.net:6969/announce", "udp://tracker.qu.ax:6969/announce", "udp://tracker.peerfect.org:6969/announce", "udp://tracker.opentrackr.com:6969/announce", "udp://tracker.ilibr.org:6969/announce", "udp://tracker.ducks.party:1984/announce", "udp://tracker.corpscorp.online:80/announce", "udp://tracker.bittor.pw:1337", "udp://tracker.auctor.tv:6969/announce", "udp://tracker-udp.gbitt.info:80/announce", "udp://torrentclub.online:54123/announce", "udp://t.overflow.biz:6969/announce"]
creation date
1786015909