Incident · State breach notice (California AG)
illumifin data breach: an insurance administrator's files copied, 97,781 people
Compiled from public records. Updated 2026-11-13. By the cisonews.net Desk.
The illumifin data breach affected 97,781 people, according to the Oregon Department of Justice's breach list, which records a breach from October 28 to November 4, 2025 and notice sent on April 22, 2026. illumifin is an insurance technology company and third-party administrator. It says an intruder got into its network and copied files that held information it received from insurance clients. The letters go out on behalf of those clients, so most recipients know the insurer's name, not illumifin's. Indiana records 4,031 of its own residents across two reports.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
What happened at illumifin?
illumifin says it found unusual activity in part of its network on November 4, 2025, contained it, brought in a forensic firm and notified law enforcement. The investigation found that an unauthorized person had got in and taken copies of files. On November 10, 2025 it learned the files might hold information from its clients. It told each client on January 9, 2026 and gave them their lists of affected people on or around February 25, 2026.
| Date | What happened | Source |
|---|---|---|
| October 28, 2025 | Start of the breach window | Oregon list; Indiana report |
| November 4, 2025 | Unusual activity found | illumifin letter; Oregon list |
| November 10, 2025 | Files found to hold client data | illumifin letter |
| January 9, 2026 | Clients told | illumifin letter |
| On or around February 25, 2026 | Clients get their lists of affected people | illumifin letter |
| March 31, 2026 | Indiana notice under illumifin's name (43,152) | Indiana report |
| April 10, 2026 | Indiana notice for Liberty Bankers Life (21,291) | Indiana report |
| April 22, 2026 | Oregon notice date (97,781) | Oregon list |
Why did I get a letter about illumifin?
Because your insurer used it. The letter says illumifin provides services for a client, named in each letter, and writes on that client's behalf. One client is on the record: Indiana lists Liberty Bankers Life Insurance Company's own report, marked "(illumifin)", for 21,291 people. The guide to why you got a breach letter from a company you never dealt with explains vendor notices like this one.
What information was exposed?
It varies by person; each letter lists that person's data. The filed sample leaves the list blank. The letter does not offer credit monitoring. It asks recipients to watch their account statements and credit reports, and it encloses guidance on fraud alerts and freezes.
How many people were affected?
| Record | People | Notice date |
|---|---|---|
| Oregon DOJ, illumifin Corporation | 97,781 | April 22, 2026 |
| Indiana AG, Illumifin Corporation | 43,152 (3,107 in Indiana) | March 31, 2026 |
| Indiana AG, Liberty Bankers Life Ins Co (illumifin) | 21,291 (924 in Indiana) | April 10, 2026 |
| Texas AG, illumifin Corporation | 6,724 in Texas | Posted April 2, 2026 |
| HHS breach portal, illumifin Corporation as a business associate | 5,385 | Submitted March 10, 2026 |
The federal health breach portal lists illumifin Corporation as a business associate with 5,385 people, in a hacking incident on a network server submitted on March 10, 2026. That is far below the state totals, and none of the records says why.
Oregon's figure is the largest single count. Insurers that filed their own notices may count some of the same people again. The largest data breaches of 2026 shows where these totals sit.
Who do I call?
illumifin's line is 844-558-4433, Monday to Friday, 8:00 a.m. to 8:00 p.m. Central Time. A credit freeze at each of the three bureaus is free; the guide to credit monitoring offers explains when monitoring helps.
How many Texans were affected by the illumifin breach?
Texas's attorney general lists a report from illumifin Corporation, posted on April 2, 2026, with 6,724 Texans affected. It lists names, addresses, Social Security numbers, medical information, health insurance information and dates of birth among the information involved. The Texas ranking has 2026's largest reports. The figure counts Texas residents only; the public list gives no national total.
What the record leaves open
- Which insurers were illumifin's affected clients, beyond Liberty Bankers Life.
- How the intruder got in, and whether anything was encrypted.
- Why Oregon's breach window starts on October 28, a week before the activity was found.
How this disclosure's timing compares
illumifin Corporation disclosed 147 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.
California's breach-notice rule
California's breach law (Civil Code § 1798.82 for businesses, § 1798.29 for state agencies) requires any person or business that must notify more than 500 California residents of a single breach to submit one sample copy of that notice to the Attorney General electronically. The California Attorney General's breach list, where this notice was found, is built from those submissions. Source: California Department of Justice, Office of the Attorney General, Data Security Breach Reporting. The guide Data breach laws by state: notice deadlines and attorney general thresholds in 23 states reads the rule in full, and the glossary defines Breach notification law.
Other financial services incidents on cisonews.net
- ICW Group Holdings, Inc., Breach notice, first disclosed November 13, 2026
- Point72 Asset Management, L.P., Breach notice, first disclosed November 5, 2026
- The Vanguard Group, Inc., Breach notice, first disclosed November 4, 2026
- Hippo Analytics, Breach notice, first disclosed November 3, 2026; 176,128 affected in total (Indiana Attorney General)
- Baanx US Corp, Breach notice, first disclosed October 30, 2026; 6,594 affected in total (Indiana Attorney General)
Sources
- 2026-11-13 · ATexas Attorney General, data security breach reports, published November 13, 2026
- 2026-11-13 · AU.S. Department of Health and Human Services, Office for Civil Rights, breach portal (cases currently under investigation), published November 13, 2026
- 2026-03-31 · Aillumifin Corporation, sample notice filed with the California Attorney General, published March 31, 2026
- 2026-03-31 · ACalifornia Attorney General, data breach notification record, published March 31, 2026
- 2026-11-11 · AOregon Department of Justice, consumer data breach list, published November 11, 2026
- 2026-11-11 · AIndiana Attorney General, data breach year-to-date report 2026, published November 11, 2026
- undated · ACalifornia Department of Justice, Office of the Attorney General, Data Security Breach Reporting
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.