15 ms·

Allianz Life says 'majority' of customers' personal data stolen in cyberattack

278 points by thm 1y ago

SoftTalker 1y ago
Yawn. Another day, another breach. Our industry is pathetic.
- Rotundo 1y ago
  This will continue until there are serious repercussions for a company.
  - SoftTalker 1y ago
    Unclear who is responsible here, Allianz or their third party "cloud-based CRM provider." But I think that fundamentally, secure cloud-based SaaS is impossible. This stuff needs to be on-prem and airgapped from the internet. That makes some functionality complicated or impossible, but we're seeing that what we have now is not working.
    - nothercastle 1y ago
      Buck stops at Allianz but the 3rd party might share some of the minuscule cost of bullshit identity protection services
    - filleokus 1y ago
      Allianz have more than 150k employees with offices in 50+ countries. Not all of them need access to the CRM of course, but I think going back to on-prem is just asking for different kind of trouble. We don't have any details now, but I wouldn't be surprised if the cloud-based CRM provider didn't have a very technical interesting weakness, but rather that some kind of social engineeringy method was used. If global companies like this instead had stuff running on-prem all around the world the likelihood of more technical vulnerabilities seems MORE likely to me. (Air gapping is of course possible, but in my experience, outside of the most security sensitive areas the downsides are simply not acceptable. Or the "air gapping" is just the old "hard shell" / permitter based access-model...)
    - mr_mitm 1y ago
      Airgapped means you're transferring data by thumbdrive or CD, which is hugely impractical. You probably meant firewalled.
- BinaryIgor 1y ago
  There are inherent tradeoffs when using centralized solutions like that; unless the company does not use any third-party software and is paranoid about its security - these incidents and breaches will occur, unfortunately.
slashdev 1y ago
All these endless data breaches could be reduced if we fixed the incentives, but that's difficult. We could never stop it, because humans make mistakes, and big groups of humans make lots of mistakes. That doesn't mean we shouldn't try. It seems to me a parallel path that should be pursued is to make the impact less damaging. Don't assume that things like birth dates, names, addresses, phone numbers, emails, SSNs, etc are private. Shut down the avenues that people use to "steal identities". I hate the term stealing identity, because it implies the victim made some mistake to allow it to happen. When what really happened is the company was lazy to verify that the person they're doing business with is actually who they say they are. The onus and liability should be on the company involved. If a bank gives a loan to you under my name, it should be their problem, not mine. It would go away practically overnight as a problem if that were changed. Companies would be strict about verifying people, because otherwise they'd lose money. Incentives align. Identify theft is not the only issue with data leaks / breaches, but it seems one of the more tractable.
- DicIfTEx 1y ago
  > I hate the term stealing identity, because it implies the victim made some mistake to allow it to happen. When what really happened is the company was lazy to verify that the person they're doing business with is actually who they say they are. The onus and liability should be on the company involved. You may enjoy this sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
  - MichaelZuo 1y ago
    It is really strange that is not already the case.
    - Buttons840 1y ago
      "It's really strange that the status-quo favors those with more wealth and power."
      - 1y ago
giantfrog 1y ago
This will never, ever, ever stop happening until executives start going bankrupt and/or to jail for negligence. Even then it won’t stop, but it would at least decrease in frequency and severity.
- SoftTalker 1y ago
  Unless there is willfull negligence (very difficult to prove) or malicious behavior I don't think putting people in jail will help. Most of this stuff happens by accident not by intent. Financial consequences to the company might be a deterrent, of course then you're dealing with hundreds or thousands of people potentially unemployed because the company was bankrupted by something as simple as a mistake in a firewall somewhere or an employee falling victim to a social engineering trick. I think the path is along the lines of admitting that cloud, SaaS and other internet-connected information systems cannot be made safe, and dramatically limiting their use. Or, admitting that a lot of this information should be of no consequence if it is exposed. Imagine a world where knowing my name, SSN, DOB, address, mother's maiden name, and whatever else didn't mean anything.
  - fn-mote 1y ago
    > Most of this stuff happens by accident not by intent. Consider the intent of not hiring enough security staff and supporting them appropriately. It looks a lot like an accident. You could even say it causes accidents.
    - SoftTalker 1y ago
      Hiring more people does not prevent the chance of mistakes. It may even increase them. I know places that spend lavishly on security (and employee education w/r/t social engineering, etc.) and have still been breached.
      - AlotOfReading 1y ago
        Google and Apple spend lavishly on security and are probably the most heavily attacked companies in the world, often by nation-state adversaries. Yet as far as I can remember, neither has had a successful breach like this in well over a decade. Clearly it's possible.
BinaryIgor 1y ago
Well, to some degree it will always happen, no matter how careful the companies are. Unless it's e2e encrypted (like in Proton Mail or Proton Drive), these incidents will occur. Manage your risk accordingly.
- SoftTalker 1y ago
  At some point it has to be unecrypted to be useful. That's where the vulnerability is.
  - BinaryIgor 1y ago
    Depends whether and to what extend your service provider needs it - for Proton, it's always client only decrypted
- mvdtnz 1y ago
  There are very serious drawbacks to e2e encryption that can't be ignored for all use cases. Searching and indexing, reporting, analytics and performance are aspects of a program which become difficult or impossible if all of your data is encrypted everywhere other than the client. It's easy to just wave your hands and say "all data should be e2e encrypted" but it's not that straightforward.
  - BinaryIgor 1y ago
    Unfortunately, you're right; I guess there is no easy, handle-it-all answer; it all depends on the specifics of a given system
jmkni 1y ago
> “On July 16, 2025, a malicious threat actor gained access to a third-party, cloud-based CRM system used by Allianz Life,” referring to a customer relationship management (CRM) database containing information on its customers. So who the hell was the "third-party, cloud-based CRM system"?
- MontagFTB 1y ago
  Depending on the CRM, is this not a HIPAA violation?
  - marcusb 1y ago
    Why would it be? Is Allianz Life a covered entity? If so, why would it depend on the specific CRM being used?
    - tfehring 1y ago
      Allianz Life publishes a HIPAA privacy notice at [0], which states: > This notice applies to individuals who participate in any of the following programs under the closed line of business: > • Long term care > • Medical > • Medical supplemental > • Hospital income > • Cancer and disease specific coverage > • Dental benefits > The Covered Entity’s actions and obligations are undertaken by Allianz employees as well as the third parties who perform services for the Covered Entity. However, Allianz employees perform only limited Covered Entity functions – most Covered Entity administrative functions are performed by third party service providers. It sold long term care insurance policies until 2010. (Disclosure, I happen to have worked at Allianz Life a long time ago, though I have no nonpublic information about any of this.) [0] https://www.allianzlife.com/-/media/Files/Allianz/PDFs/about/H40016-Allianz-HIPAA-Closed-Block-Privacy-Notice.pdf https://www.allianzlife.com/-/media/Files/Allianz/PDFs/about...
- milesskorpen 1y ago
  Does it matter? Wasn't a technical breach of their systems, but instead social engineering.
deleted 1y ago
[deleted]
nothercastle 1y ago
The punishment for poor data security is so low it’s not worth paying for it in most companies. And of course the government makes it nearly impossible to change your ssn yet still uses it as a means of verifying so almost everyone is exposed by now.
rr808 1y ago
Kinda frustrating the last few months I've had to upload bank statements and payslips to rent a house and also refinance a mortgage. I know all my financial details are out there floating and invevitably get leaked. I should be able to upload somewhere temporary where these docs are checked then safely deleted.
fock 1y ago
I was on the train when some executive support staff joined my car (train ran late and they were easy to find on the internet ...). They behaved like misogynistic ogres and I can vividly imagine those people laugh about this. 0 regard for other people or their societal responsibility.
time4tea 1y ago
Mandatory £1000 fine per record lost. Would be company-terminal for companies with millions of customers - and thats right. Right now it's just cheaper to not care, then send a trite apology email when all the data inevitably gets stolen. The status quo, nobody gives a crap, with the regulators literally doing nothing, cannot continue. In the UK, the ICO is as effective as Ofwat. (The regulator that was just killed for being pointlessly and dangerously usless) (Edit: fix autocorrect)
- grapescheesee 1y ago
  Mandatory amount paid directly to the customer of record, instead of fractions of a cent on the dollar, in year long class action settlements might help the disenfranchised 'customers'.
- sunrunner 1y ago
  > Would be company-terminal What happens to customers of the affected company in this case? Does this not now pass on a second problem to the people actually affected?
- unsupp0rted 1y ago
  Would be national economy terminal too
sMarsIntruder 1y ago
Hello KYC
Buttons840 1y ago
I say this often, and it's quite an unpopular idea, and I'm not sure why. Security researchers, white-hat hackers, and even grey-hat hackers should have strong legal protections so long as they report any security vulnerabilities that they find. The bad guys are allowed to constantly scan and probe for security vulnerabilities, and there is no system to stop them, but if some good guys try to do the same they are charged with serious felony crimes. Experience has show we cannot build secure systems. It may be an embarrassing fact, but many, if not all, of our largest companies and organizations are probably completely incapable of building secure systems. I think we try to avoid this fact by not allowing red-team security researches to be on the lookout. It's funny how everything has worked out for the benefit of companies and powerful organizations. They say "no, you can't test the security of our systems, we are responsible for our own security, you cannot test our security without our permission, and also, if we ever leak data, we aren't responsible". So, in the end, these powerful organizations are both responsible for their own system security, and yet they also are not responsible, depending on whichever is more convenient at the time. Again, it's funny how it works out that way. Are companies responsible for their own security, or is this all a big team effort that we're all involved in? Pick a lane. It does feel like we're all involved when half the nation's personal data is leaked every other week. And this is literally a matter of national security. Is the nation's power grid secure? Maybe? I don't know, do independent organizations verify this? Can I verify this myself by trying to hack the power grid (in a responsible white-hat way)? No, of course not; I would be committing a felony to even try. Enabling powerful organizations to hide their security flaws in their systems, that's the default, they just have to do nothing and then nobody is allowed to research the security of their systems, nobody is allowed to blow the whistle. We are literally sacrificing national security for the convenience of companies and so they can avoid embarrassment.
- AbstractH24 1y ago
  At what point do we need to treat this data like one’s health data? The risks associated with medical malpractice certainly slows the pace of innovation in healthcare, but maybe that’s ok.
- thatguy0900 1y ago
  I mean, the problem is people will break things. How do you responsibly hack your local electric grid? What if you accidentally mess with something you don't understand, and knock a neighborhood out? How do we prove you just responsibly hacked into a system full of private information then didn't actually look at a bunch of it?
amai 1y ago
Actually Allianz offers an insurance against cyberattacks like this: https://www.allianz.de/aktuell/storys/cyberschutz-knoten-im-system/ https://www.allianz.de/aktuell/storys/cyberschutz-knoten-im-...
- ok123456 1y ago
  Good to see the contractually required endpoint protection was working.
- 7373737373 1y ago
  Insurance is part of the problem - companies prefer to insure themselves rather than employ and support the research and development of secure software. As long as this is the more economical thing to do, nothing will change.
  - rswail 1y ago
    It is in the interest of Allianz and other insurers to employ and support R&D of secure software though.
    - 7373737373 1y ago
      Do they actually do this though? Or give the money to their owners/shareholders instead?
- deleted 1y ago
  [deleted]
bee_rider 1y ago
Ignoring the whole pain in the ass this will be for their customers—at what point does this become a tragedy of the commons failure? Actually, I don’t know the case-law on this sort of stuff. If your bank authenticates using credentials that are generally publicly known by black-hats for most people—stuff like your social security number and some random bits of trivia (mothers maiden name)—shouldn’t they be responsible for any breaches?
urquhartfe 1y ago
Fundamentally the issue is that companies are just not investing enough in engineering and IT. When you farm out this work to offshore workers on a shoestring budget, the result is utterly predictable.
- alephnerd 1y ago
  This isn't an offshore situation though. I've worked with Allianz's cybersecurity personas previously on EBRs/QBRs, and the issue is they (like a lot of European companies) are basically a confederation of subsidiaries with various independent IT assets and teams, so shadow IT abounds. They have subsidiaries numbering in the dozens, so there is no way to unify IT norms and standards. There is an added skills issue as well (most DACH companies I've dealt with have only just started working on building hybrid security posture management - easily a decade behind their American peers), but it is a side effect of the organizational issues.
  - insomniacity 1y ago
    > They have subsidiaries numbering in the dozens, so there is no way to unify IT norms and standards. That is their choice though - they could setup a technology services subsidiary, and then provide IT services to the other subsidiaries, transparently to the end users in those subsidiaries.
Retr0id 1y ago
Ah! Well. Nevertheless,
SilverElfin 1y ago
Is there any consequence? I’ve seen now a new practice where companies won’t even tell you what was compromised. For example a big one last year (?) was at the University of Washington. I had family receive vague letters saying some other place called Fred Hutch cancer center got hacked, and for some reason, the patient data of the university’s own hospitals was shared with this other place (even though they aren’t patients of Fred Hutch). Both Fred Hutch and UW refuse to tell individuals what data of theirs was compromised, but just say it can include all personal info including medical records and test results and social security numbers. It’s infuriating to just see a vague letter with free credit monitoring from companies that should be doing more and fined more.
ofjcihen 1y ago
That’s partially due to SF devs not knowing enough about the product but also due to Salesforce treating security as an afterthought. For a poorly configured implementation it takes 2 web requests as an unauthenticated user to know all of the data you can pull down and then do it. Don’t even get me started on the complete lack of monitoring. I basically had to design an entire security monitoring setup outside of Salesforce using their (absolutely awful) logs to get anything close to usable. Edit: here’s a guide someone wrote. https://www.varonis.com/blog/misconfigured-salesforce-experi https://www.varonis.com/blog/misconfigured-salesforce-experi... Seriously, you can automate this and then throw it at the end of recon to find SF sites. I’ve done it.
j45 1y ago
I wonder if there are independent data audits that can be in place which report back to customers.
snickerdoodle12 1y ago
Jail the executives.
barbazoo 1y ago
Depending on which entity, this could affect hundreds of millions of people.
pwarner 1y ago
Presumably this https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion https://cloud.google.com/blog/topics/threat-intelligence/voi...
Havoc 1y ago
Classic corporate “my bad” and then nothing
486sx33 1y ago
[dead]
ern 1y ago
I don't know how the social engineering happened, beyond what's mentioned in the article as a possibility (calling helpdesks). But there's a ton of corporate information that's widely available for exploitation. LinkedIn, for example is a goldmine for social engineering, and there's no way to secure a profile from being viewed by logged-in users, even if they are unconnected. I'm surprised more employers don't closely audit their employees profiles.
NoImmatureAdHom 1y ago
Corporate death penalty
hulitu 1y ago
> Allianz Life says 'majority' of customers' personal data stolen in cyberattack Thank god that only customers' personal data was stolen. As long as the CEO's personal data or the members's of the board of directors personal data is safe, nobody gives a fuck. /s
AbstractH24 1y ago
What’s the CRM?
scotty79 1y ago
This is really terrible setup that my personal data is collected by random companies and kept in diverse conditions for unspecified time. This shouldn't be allowed. I should be able to define some of my data as sensitive and it should be held in one place and companies when they need a bit of my data should always get it from that one place with my permission. I should be able to review every access and revoke permission. They shouldn't be legally allowed to even cache it. Banks should keep this kind of stuff. You want to keep a new piece of information on me? Cool submit it to my bank and I can review it and decide if I should let you store it or should it go to the bank or shouldn't it be stored at all.

278 points by thm 1y ago

SoftTalker 1y ago

Yawn. Another day, another breach. Our industry is pathetic.

Rotundo 1y ago
This will continue until there are serious repercussions for a company.
- SoftTalker 1y ago
  Unclear who is responsible here, Allianz or their third party "cloud-based CRM provider." But I think that fundamentally, secure cloud-based SaaS is impossible. This stuff needs to be on-prem and airgapped from the internet. That makes some functionality complicated or impossible, but we're seeing that what we have now is not working.
  - nothercastle 1y ago
    Buck stops at Allianz but the 3rd party might share some of the minuscule cost of bullshit identity protection services
  - filleokus 1y ago
    Allianz have more than 150k employees with offices in 50+ countries. Not all of them need access to the CRM of course, but I think going back to on-prem is just asking for different kind of trouble. We don't have any details now, but I wouldn't be surprised if the cloud-based CRM provider didn't have a very technical interesting weakness, but rather that some kind of social engineeringy method was used. If global companies like this instead had stuff running on-prem all around the world the likelihood of more technical vulnerabilities seems MORE likely to me. (Air gapping is of course possible, but in my experience, outside of the most security sensitive areas the downsides are simply not acceptable. Or the "air gapping" is just the old "hard shell" / permitter based access-model...)
  - mr_mitm 1y ago
    Airgapped means you're transferring data by thumbdrive or CD, which is hugely impractical. You probably meant firewalled.
BinaryIgor 1y ago
There are inherent tradeoffs when using centralized solutions like that; unless the company does not use any third-party software and is paranoid about its security - these incidents and breaches will occur, unfortunately.

slashdev 1y ago

All these endless data breaches could be reduced if we fixed the incentives, but that's difficult. We could never stop it, because humans make mistakes, and big groups of humans make lots of mistakes. That doesn't mean we shouldn't try. It seems to me a parallel path that should be pursued is to make the impact less damaging. Don't assume that things like birth dates, names, addresses, phone numbers, emails, SSNs, etc are private. Shut down the avenues that people use to "steal identities". I hate the term stealing identity, because it implies the victim made some mistake to allow it to happen. When what really happened is the company was lazy to verify that the person they're doing business with is actually who they say they are. The onus and liability should be on the company involved. If a bank gives a loan to you under my name, it should be their problem, not mine. It would go away practically overnight as a problem if that were changed. Companies would be strict about verifying people, because otherwise they'd lose money. Incentives align. Identify theft is not the only issue with data leaks / breaches, but it seems one of the more tractable.

DicIfTEx 1y ago
> I hate the term stealing identity, because it implies the victim made some mistake to allow it to happen. When what really happened is the company was lazy to verify that the person they're doing business with is actually who they say they are. The onus and liability should be on the company involved. You may enjoy this sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- MichaelZuo 1y ago
  It is really strange that is not already the case.
  - Buttons840 1y ago
    "It's really strange that the status-quo favors those with more wealth and power."
    - 1y ago

giantfrog 1y ago

This will never, ever, ever stop happening until executives start going bankrupt and/or to jail for negligence. Even then it won’t stop, but it would at least decrease in frequency and severity.

SoftTalker 1y ago
Unless there is willfull negligence (very difficult to prove) or malicious behavior I don't think putting people in jail will help. Most of this stuff happens by accident not by intent. Financial consequences to the company might be a deterrent, of course then you're dealing with hundreds or thousands of people potentially unemployed because the company was bankrupted by something as simple as a mistake in a firewall somewhere or an employee falling victim to a social engineering trick. I think the path is along the lines of admitting that cloud, SaaS and other internet-connected information systems cannot be made safe, and dramatically limiting their use. Or, admitting that a lot of this information should be of no consequence if it is exposed. Imagine a world where knowing my name, SSN, DOB, address, mother's maiden name, and whatever else didn't mean anything.
- fn-mote 1y ago
  > Most of this stuff happens by accident not by intent. Consider the intent of not hiring enough security staff and supporting them appropriately. It looks a lot like an accident. You could even say it causes accidents.
  - SoftTalker 1y ago
    Hiring more people does not prevent the chance of mistakes. It may even increase them. I know places that spend lavishly on security (and employee education w/r/t social engineering, etc.) and have still been breached.
    - AlotOfReading 1y ago
      Google and Apple spend lavishly on security and are probably the most heavily attacked companies in the world, often by nation-state adversaries. Yet as far as I can remember, neither has had a successful breach like this in well over a decade. Clearly it's possible.

BinaryIgor 1y ago

Well, to some degree it will always happen, no matter how careful the companies are. Unless it's e2e encrypted (like in Proton Mail or Proton Drive), these incidents will occur. Manage your risk accordingly.

SoftTalker 1y ago
At some point it has to be unecrypted to be useful. That's where the vulnerability is.
- BinaryIgor 1y ago
  Depends whether and to what extend your service provider needs it - for Proton, it's always client only decrypted
mvdtnz 1y ago
There are very serious drawbacks to e2e encryption that can't be ignored for all use cases. Searching and indexing, reporting, analytics and performance are aspects of a program which become difficult or impossible if all of your data is encrypted everywhere other than the client. It's easy to just wave your hands and say "all data should be e2e encrypted" but it's not that straightforward.
- BinaryIgor 1y ago
  Unfortunately, you're right; I guess there is no easy, handle-it-all answer; it all depends on the specifics of a given system

jmkni 1y ago

> “On July 16, 2025, a malicious threat actor gained access to a third-party, cloud-based CRM system used by Allianz Life,” referring to a customer relationship management (CRM) database containing information on its customers. So who the hell was the "third-party, cloud-based CRM system"?

MontagFTB 1y ago
Depending on the CRM, is this not a HIPAA violation?
- marcusb 1y ago
  Why would it be? Is Allianz Life a covered entity? If so, why would it depend on the specific CRM being used?
  - tfehring 1y ago
    Allianz Life publishes a HIPAA privacy notice at [0], which states: > This notice applies to individuals who participate in any of the following programs under the closed line of business: > • Long term care > • Medical > • Medical supplemental > • Hospital income > • Cancer and disease specific coverage > • Dental benefits > The Covered Entity’s actions and obligations are undertaken by Allianz employees as well as the third parties who perform services for the Covered Entity. However, Allianz employees perform only limited Covered Entity functions – most Covered Entity administrative functions are performed by third party service providers. It sold long term care insurance policies until 2010. (Disclosure, I happen to have worked at Allianz Life a long time ago, though I have no nonpublic information about any of this.) [0] https://www.allianzlife.com/-/media/Files/Allianz/PDFs/about/H40016-Allianz-HIPAA-Closed-Block-Privacy-Notice.pdf https://www.allianzlife.com/-/media/Files/Allianz/PDFs/about...
milesskorpen 1y ago
Does it matter? Wasn't a technical breach of their systems, but instead social engineering.

deleted 1y ago

[deleted]

nothercastle 1y ago

The punishment for poor data security is so low it’s not worth paying for it in most companies. And of course the government makes it nearly impossible to change your ssn yet still uses it as a means of verifying so almost everyone is exposed by now.

rr808 1y ago

Kinda frustrating the last few months I've had to upload bank statements and payslips to rent a house and also refinance a mortgage. I know all my financial details are out there floating and invevitably get leaked. I should be able to upload somewhere temporary where these docs are checked then safely deleted.

fock 1y ago

I was on the train when some executive support staff joined my car (train ran late and they were easy to find on the internet ...). They behaved like misogynistic ogres and I can vividly imagine those people laugh about this. 0 regard for other people or their societal responsibility.

time4tea 1y ago

Mandatory £1000 fine per record lost. Would be company-terminal for companies with millions of customers - and thats right. Right now it's just cheaper to not care, then send a trite apology email when all the data inevitably gets stolen. The status quo, nobody gives a crap, with the regulators literally doing nothing, cannot continue. In the UK, the ICO is as effective as Ofwat. (The regulator that was just killed for being pointlessly and dangerously usless) (Edit: fix autocorrect)

grapescheesee 1y ago
Mandatory amount paid directly to the customer of record, instead of fractions of a cent on the dollar, in year long class action settlements might help the disenfranchised 'customers'.
sunrunner 1y ago
> Would be company-terminal What happens to customers of the affected company in this case? Does this not now pass on a second problem to the people actually affected?
unsupp0rted 1y ago
Would be national economy terminal too

sMarsIntruder 1y ago

Hello KYC

Buttons840 1y ago

I say this often, and it's quite an unpopular idea, and I'm not sure why. Security researchers, white-hat hackers, and even grey-hat hackers should have strong legal protections so long as they report any security vulnerabilities that they find. The bad guys are allowed to constantly scan and probe for security vulnerabilities, and there is no system to stop them, but if some good guys try to do the same they are charged with serious felony crimes. Experience has show we cannot build secure systems. It may be an embarrassing fact, but many, if not all, of our largest companies and organizations are probably completely incapable of building secure systems. I think we try to avoid this fact by not allowing red-team security researches to be on the lookout. It's funny how everything has worked out for the benefit of companies and powerful organizations. They say "no, you can't test the security of our systems, we are responsible for our own security, you cannot test our security without our permission, and also, if we ever leak data, we aren't responsible". So, in the end, these powerful organizations are both responsible for their own system security, and yet they also are not responsible, depending on whichever is more convenient at the time. Again, it's funny how it works out that way. Are companies responsible for their own security, or is this all a big team effort that we're all involved in? Pick a lane. It does feel like we're all involved when half the nation's personal data is leaked every other week. And this is literally a matter of national security. Is the nation's power grid secure? Maybe? I don't know, do independent organizations verify this? Can I verify this myself by trying to hack the power grid (in a responsible white-hat way)? No, of course not; I would be committing a felony to even try. Enabling powerful organizations to hide their security flaws in their systems, that's the default, they just have to do nothing and then nobody is allowed to research the security of their systems, nobody is allowed to blow the whistle. We are literally sacrificing national security for the convenience of companies and so they can avoid embarrassment.

AbstractH24 1y ago
At what point do we need to treat this data like one’s health data? The risks associated with medical malpractice certainly slows the pace of innovation in healthcare, but maybe that’s ok.
thatguy0900 1y ago
I mean, the problem is people will break things. How do you responsibly hack your local electric grid? What if you accidentally mess with something you don't understand, and knock a neighborhood out? How do we prove you just responsibly hacked into a system full of private information then didn't actually look at a bunch of it?

amai 1y ago

Actually Allianz offers an insurance against cyberattacks like this: https://www.allianz.de/aktuell/storys/cyberschutz-knoten-im-system/ https://www.allianz.de/aktuell/storys/cyberschutz-knoten-im-...

ok123456 1y ago
Good to see the contractually required endpoint protection was working.
7373737373 1y ago
Insurance is part of the problem - companies prefer to insure themselves rather than employ and support the research and development of secure software. As long as this is the more economical thing to do, nothing will change.
- rswail 1y ago
  It is in the interest of Allianz and other insurers to employ and support R&D of secure software though.
  - 7373737373 1y ago
    Do they actually do this though? Or give the money to their owners/shareholders instead?
deleted 1y ago
[deleted]

bee_rider 1y ago

Ignoring the whole pain in the ass this will be for their customers—at what point does this become a tragedy of the commons failure? Actually, I don’t know the case-law on this sort of stuff. If your bank authenticates using credentials that are generally publicly known by black-hats for most people—stuff like your social security number and some random bits of trivia (mothers maiden name)—shouldn’t they be responsible for any breaches?

urquhartfe 1y ago

Fundamentally the issue is that companies are just not investing enough in engineering and IT. When you farm out this work to offshore workers on a shoestring budget, the result is utterly predictable.

alephnerd 1y ago
This isn't an offshore situation though. I've worked with Allianz's cybersecurity personas previously on EBRs/QBRs, and the issue is they (like a lot of European companies) are basically a confederation of subsidiaries with various independent IT assets and teams, so shadow IT abounds. They have subsidiaries numbering in the dozens, so there is no way to unify IT norms and standards. There is an added skills issue as well (most DACH companies I've dealt with have only just started working on building hybrid security posture management - easily a decade behind their American peers), but it is a side effect of the organizational issues.
- insomniacity 1y ago
  > They have subsidiaries numbering in the dozens, so there is no way to unify IT norms and standards. That is their choice though - they could setup a technology services subsidiary, and then provide IT services to the other subsidiaries, transparently to the end users in those subsidiaries.

Retr0id 1y ago

Ah! Well. Nevertheless,

SilverElfin 1y ago

Is there any consequence? I’ve seen now a new practice where companies won’t even tell you what was compromised. For example a big one last year (?) was at the University of Washington. I had family receive vague letters saying some other place called Fred Hutch cancer center got hacked, and for some reason, the patient data of the university’s own hospitals was shared with this other place (even though they aren’t patients of Fred Hutch). Both Fred Hutch and UW refuse to tell individuals what data of theirs was compromised, but just say it can include all personal info including medical records and test results and social security numbers. It’s infuriating to just see a vague letter with free credit monitoring from companies that should be doing more and fined more.

ofjcihen 1y ago

That’s partially due to SF devs not knowing enough about the product but also due to Salesforce treating security as an afterthought. For a poorly configured implementation it takes 2 web requests as an unauthenticated user to know all of the data you can pull down and then do it. Don’t even get me started on the complete lack of monitoring. I basically had to design an entire security monitoring setup outside of Salesforce using their (absolutely awful) logs to get anything close to usable. Edit: here’s a guide someone wrote. https://www.varonis.com/blog/misconfigured-salesforce-experi https://www.varonis.com/blog/misconfigured-salesforce-experi... Seriously, you can automate this and then throw it at the end of recon to find SF sites. I’ve done it.

j45 1y ago

I wonder if there are independent data audits that can be in place which report back to customers.

snickerdoodle12 1y ago

Jail the executives.

barbazoo 1y ago

Depending on which entity, this could affect hundreds of millions of people.

pwarner 1y ago

Presumably this https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion https://cloud.google.com/blog/topics/threat-intelligence/voi...

Havoc 1y ago

Classic corporate “my bad” and then nothing

486sx33 1y ago

[dead]

ern 1y ago

I don't know how the social engineering happened, beyond what's mentioned in the article as a possibility (calling helpdesks). But there's a ton of corporate information that's widely available for exploitation. LinkedIn, for example is a goldmine for social engineering, and there's no way to secure a profile from being viewed by logged-in users, even if they are unconnected. I'm surprised more employers don't closely audit their employees profiles.

NoImmatureAdHom 1y ago

Corporate death penalty

hulitu 1y ago

> Allianz Life says 'majority' of customers' personal data stolen in cyberattack Thank god that only customers' personal data was stolen. As long as the CEO's personal data or the members's of the board of directors personal data is safe, nobody gives a fuck. /s

AbstractH24 1y ago

What’s the CRM?

scotty79 1y ago

This is really terrible setup that my personal data is collected by random companies and kept in diverse conditions for unspecified time. This shouldn't be allowed. I should be able to define some of my data as sensitive and it should be held in one place and companies when they need a bit of my data should always get it from that one place with my permission. I should be able to review every access and revoke permission. They shouldn't be legally allowed to even cache it. Banks should keep this kind of stuff. You want to keep a new piece of information on me? Cool submit it to my bank and I can review it and decide if I should let you store it or should it go to the bank or shouldn't it be stored at all.