What the Allianz Life Breach Teaches Us: Make Encryption‑in‑Use the Default - Paperclip

On July 16, 2025, Allianz Life Insurance Company of North America disclosed a cyber incident originating within a third‑party (Malwarebytes, Financial Times, TechRadar), cloud‑based CRM vendor’s environment. Reports indicate the breach exposed highly sensitive PII consisting of Social Security numbers combined with other controlled data belonging to most of its approximately 1.4 million U.S. customers. Multiple outlets and filings note the vector involved social engineering and misuse of common CRM export utilities, a pattern that has surged in 2025.

What happened—and why it matters

According to coverage from the Financial Times and security outlets, Allianz’s core systems were not breached; instead, attackers abused access to a vendor environment to exfiltrate customer records. Although Allianz Life Insurance has not publicly disclosed the specific name of the CRM platform affected, multiple sources including Google’s Threat Intelligence Group (GTIG), Mandiant, and BleepingComputer suggest that Salesforce was likely the targeted system. The breach is likely to have involved:

Voice phishing (vishing) attacks manipulating employees into granting access to Salesforce Data Loader.
Threat actor UNC6040 (aka “The Com,” linked to Scattered Spider) targeting Salesforce customers.
ShinyHunters launching similar campaigns against Salesforce CRM users.
Court documents referencing attacks on “Accounts” and “Contacts” tables, common Salesforce objects.

While Allianz has not officially confirmed Salesforce as the affected CRM, the convergence of threat actor activity, techniques, and technical evidence strongly supports this conclusion.

This aligns with a broader trend: Verizon’s 2025 Data Breach Investigations Report (DBIR) finds third‑party involvement in 30% of breaches (double the previous year’s number) while the human element remains a factor in roughly 60% of cases. In plain terms, once adversaries reach data in active use within SaaS platforms, traditional encryption and security controls that focus only on data at rest and in transit are insufficient.

The attacker playbook in 2025: vishing + CRM data loaders

Google’s Threat Intelligence reports detail a financially motivated cluster (UNC6040) running voice‑phishing campaigns that trick Salesforce (commonly targeted CRM) users into authorizing a malicious “Data Loader” application. Once authorized, the app can facilitate bulk exports of objects like Accounts and Contacts—exactly the kind of workflow that turns a credential compromise into a large‑scale data theft. Media and industry briefings have linked similar campaigns to groups such as Scattered Spider and ShinyHunters this year, and arrests tied to ShinyHunters were announced in late June.

The systemic gap: plaintext during use

Most enterprises have matured encryption at rest and in transit, often under mandates like NYDFS 23 NYCRR 500 and GDPR Article 32. But the Allianz incident underscores the remaining gap: when sensitive records are queried, joined, or exported, those datasets are typically decrypted somewhere in the stack. That plaintext “in‑use” moment is when attackers move from mere access to actual disclosure; something that could have been prevented with an Encryption-in-Use solution.

Encryption‑in‑Use: the control that changes the outcome

Encryption‑in‑Use keeps data encrypted even during operations like exact‑match lookups, CRUD (create, read, update, delete) activities, and range queries. Paperclip SAFE® achieves this using an advanced searchable symmetric encryption (SSE), always‑encrypted data model. The result: critical, controlled, and sensitive data is fully encrypted; there may have been a system compromise but there would be no disclosure of data.

If SAFE had been in‑line with the affected workflows…

Vendor compromise: Attackers would retrieve only encrypted, shredded fragments—not usable plaintext.
Credential abuse blast radius: Even with valid credentials or bulk export utilities, any export would have been limited to a controlled sampling (1,000 records vs. 1.4 million), and most likely would have remained encrypted and worthless to the thief.
Supply‑chain: Zero‑trust segmentation ensures third‑party tools and partners cannot expose sensitive content.

Quantifying the risk and the return

The 2025 IBM Cost of a Data Breach Report pegs the global average breach at $4.44M, with the U.S. average at a record $10.22M. AI‑assisted security programs may cut costs and speed containment, but ungoverned “shadow AI” raises exposure. For financial services where PII is durable and high‑value, each record stolen compounds long‑tail identity‑theft risk. By keeping data encrypted through the full lifecycle, encryption‑in‑use reduces the blast radius and costly follow‑on liabilities.

Compliance momentum favors always‑encrypted architectures

Regulators increasingly expect encryption across processing states. NYDFS 23 NYCRR 500.15 requires encryption of NPI at rest and in transit; GDPR Article 32 points to encryption and pseudonymization as appropriate measures; and the EU’s Digital Operational Resilience Act (DORA) tightens operational resilience, third‑party risk, and control expectations. Meanwhile, NIST has finalized post‑quantum cryptography standards (FIPS 203‑205), enabling crypto‑agile designs that protect systems from future post-quantum attacks.

Insurance‑sector learnings

Insurers depend on multi‑party data exchanges, agents, distributors, marketing platforms, CRM, and claims, making vendor-risk a first‑order concern. Public announcements within the sector show early adoption of encryption‑in‑use technology through integrations at the application/API layer, illustrating a practical path to adoption without ripping and replacing core systems.

How Paperclip SAFE works (at a glance)

SAFE inserts an “ingest → shred → deduplicate → salt & hash → encrypt → store” pipeline between source applications and the SAFE datastore, operating alongside core databases. This advanced encrypted workflow allows application driven queries without exposing the query, keys or any plaintext. SAFE leverages the strength of AES 256 cryptography and is post-quantum resistant. In addition, SAFE is crypto‑agile-by-design (CAbD), supporting algorithm updates aligned to emerging NIST guidance as cryptography algorithms evolve.

Action checklist for CRM leaders

Disable or strictly govern bulk export utilities; require step‑up MFA and approvals.
Validate connected apps; block untrusted Data Loader variants and enforce allow‑lists.
Adopt encryption‑in‑use for all sensitive, controlled, and private data such as SSNs, DOBs, policy IDs, and contact details flowing through SaaS.
Contractually require vendors to preserve encryption‑in‑use semantics end‑to‑end. Hold third-party vendors accountable to assuring that they implement encryption-in-use on any data they manage, process, or hold/archive for your organization.
Test incident response with a simulated CRM export‑abuse scenario tied to identity theft impacts.

Bottom line

Breach math changes when attackers never have access to plaintext data and can only steal ciphertext. Encryption‑in‑use is no longer a future ideal—it’s the present‑day control that turns a catastrophic data theft into a non‑event.

About Paperclip

Paperclip Inc. is a data security and content management innovator serving highly regulated industries. Paperclip SAFE® brings encryption‑in‑use to production via searchable symmetric encryption, supporting exact‑match and range queries over always‑encrypted data. Through API‑first integrations and a crypto‑agile design aligned to emerging NIST post‑quantum standards, Paperclip helps enterprises minimize plaintext exposure, reduce breach blast radius, and align with regulatory expectations across NYDFS, GDPR, HIPAA, PCI DSS 4.0, and DORA.