NAIC Data Breach: 3.1TB of Data Compromised

The National Association of Insurance Commissioners (NAIC), a nonprofit organization that helps insurance regulators from all 50 states set standards and protect consumers, disclosed a data breach involving unauthorized access to its systems.

The NAIC discovered the breach on or about June 11, 2026, and posted a notice on its website with updates on June 17 and June 18. The investigation remains ongoing.

On or about June 11, 2026, the NAIC identified unauthorized access to its PeopleSoft system by an unknown third party. The incident has been identified as a ransomware attack.

According to dark web intelligence, a threat actor known as ShinyHunters claimed responsibility for the breach on June 18, 2026, posting on a forum hosted on the Tor network. The group claimed to have obtained 3.1 terabytes of data from the NAIC, alleging that multiple systems were affected, including INSData, Vision credit feeds, SERFF, OPTINS, UCAA, EDP and RDC.

The data allegedly obtained includes regulatory filings, statistical reports, insurer financial statements and rating agency files containing financial identifiers such as CUSIP and ISIN numbers.

At this stage, the NAIC has not confirmed what specific information was accessed or whether any personal information was involved.

NAIC's response to the breach

After detecting the unauthorized access, the NAIC promptly activated its incident response procedures and took steps to contain the situation, according to its notice. The organization engaged outside cybersecurity experts and is coordinating with law enforcement as part of its ongoing investigation.

The NAIC has committed to notifying individuals directly if it determines their personal information was involved in the breach. Additionally, the NAIC has asked anyone who receives a suspicious communication claiming to come from the organization not to respond or click any links. Instead, individuals should preserve the message and report it to cyberincident@naic.org.

The organization has stated it will continue to update its security notice page as more information becomes available.