Allianz Life Insurance Company of North America has confirmed a significant data breach that compromised the personal information of the majority of its 1.4 million U.S. customers, along with financial professionals and select employees.

The breach occurred on July 16, when a “malicious threat actor” infiltrated a third-party cloud-based system used by the company. According to Allianz Life, the attackers used a social engineering technique to access personally identifiable information (PII). While the company emphasized that its own internal systems were not breached, the scale and sensitivity of the data accessed have raised serious concerns.

“We took immediate action to contain and mitigate the issue and notified the FBI,” Allianz Life said in an official statement. The company has also reported the incident to several other regulatory authorities, including the Maine Attorney General’s Office.

The compromised data includes customer information belonging solely to Allianz Life in the U.S.—no other global Allianz entities were affected. The insurer has begun notifying impacted individuals and is offering 24 months of identity theft protection and credit monitoring.

Spokesman Brett Weinberg declined to specify what kind of personal data was exposed, citing an ongoing investigation. However, in cases of social engineering, attackers often manipulate employees or vendors to gain access to systems or sensitive credentials—potentially exposing names, addresses, social security numbers, and financial details.

Allianz Life, a subsidiary of Munich-based Allianz SE, employs nearly 2,000 people in the U.S., primarily in Minnesota. The global parent company serves more than 125 million customers worldwide across financial services and insurance.

This breach adds to growing concerns over cybersecurity vulnerabilities in the financial sector—particularly when third-party platforms are involved. As data breaches become more common and sophisticated, insurers and regulators alike face mounting pressure to tighten digital defenses and transparency practices.