Insurance Office of America, one of the largest privately held independent U.S. insurance brokerages, suffered a cybersecurity incident between June 25 and June 30, 2025. The company identified the unauthorized access on June 30 and engaged external cybersecurity specialists to investigate. The Daixin Team, a ransomware and extortion group active since 2022, claimed responsibility on a dark-web leak site on July 2, 2025, asserting it had obtained more than 100,000 internal documents.\n\nThe breach was formally disclosed to multiple state attorneys general beginning January 16, 2026, more than six months after the original intrusion. Have I Been Pwned and other breach-tracking services index approximately 144,000 records, while IOA's internal estimates initially put the affected population at around 12,900 individuals. Compromised fields include names, email addresses, phone numbers, and Social Security numbers. As an insurance brokerage handling commercial and individual client policies, IOA's records also include employer relationships and policy details, although those broader categories were not specifically named in the public disclosure.\n\nFor affected individuals, the practical risk is concentrated in identity-fraud and insurance-themed phishing scenarios. The combination of name, phone number, and Social Security number is a strong base for fraudulent credit applications, tax-return fraud, and identity-verification bypass. Insurance-specific scams referencing real coverage, policy numbers, or employer benefits programs are a particular concern given the brokerage context. Affected individuals should accept the credit monitoring offered by IOA, freeze credit at all three U.S. bureaus, monitor financial accounts closely, and remain alert to unsolicited messages purporting to come from IOA, current or former employers' benefits programs, or insurance carriers.

Insurance brokerages collect identity, policy, claims, contact, financial, and employer-linked records across advisory, placement, and client-service workflows.

IOA discovered the breach on June 30, 2025 and engaged external cybersecurity experts to investigate and contain the intrusion. The company filed formal breach disclosures with multiple state attorneys general including those of California, Maine, Massachusetts, New Hampshire, and Texas in mid-January 2026, roughly six and a half months after the original incident, and began written notifications to affected individuals on the same date. The Daixin Team, a ransomware and extortion group active since 2022, claimed responsibility on the dark web on July 2, 2025. U.S. plaintiff law firms began organizing class-action investigations following the January 2026 disclosures. IOA is offering free credit monitoring to affected individuals.