Insurance Office of America Brokerage Breach (2025): 144K Client SSN & Contact Records Exposed

About Insurance Office of America

Insurance Office of America (IOA) is one of the largest privately held independent insurance brokerage and risk-management firms in the United States. Founded in 1988 and headquartered in Longwood, Florida, the company provides insurance placement and advisory services to commercial and personal clients, including risk assessment, claims advocacy, and employee benefits programs. Operating offices in dozens of locations nationwide, IOA serves a wide spectrum of clients ranging from small businesses to large enterprises and high-net-worth individuals. As an insurance broker, the firm collects identity, employer, financial, claims, and beneficiary records as part of routine policy placement and administration workflows.

Why They Hold Your Data

Insurance brokerages collect identity, policy, claims, contact, financial, and employer-linked records across advisory, placement, and client-service workflows.

Recent Developments

IOA discovered the breach on June 30, 2025 and engaged external cybersecurity experts to investigate and contain the intrusion. The company filed formal breach disclosures with multiple state attorneys general including those of California, Maine, Massachusetts, New Hampshire, and Texas in mid-January 2026, roughly six and a half months after the original incident, and began written notifications to affected individuals on the same date. The Daixin Team, a ransomware and extortion group active since 2022, claimed responsibility on the dark web on July 2, 2025. U.S. plaintiff law firms began organizing class-action investigations following the January 2026 disclosures. IOA is offering free credit monitoring to affected individuals.

Data Points Exposed

Breach Impact

Direct institutional cost to IOA is mounting. The company faces multistate attorney-general filings, a class-action litigation pipeline, and the operational burden of customer notification six months after the underlying intrusion. The lengthy gap between incident discovery and public notification has drawn critical commentary, particularly because the Daixin Team had publicly claimed the attack within days. IOA has engaged outside cybersecurity counsel and is offering credit monitoring services to those notified. The reputational impact in the brokerage market is meaningful, since clients who rely on insurance advisors expect those advisors to safeguard sensitive policy and identity records. The Daixin Team has previously targeted healthcare-sector organizations such as Acadian Ambulance and Communicare.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).