NAMIC Data Breach
The 2021 NAMIC data breach occurred in March 2021 when the member and account management database of the National Association of Mutual Insurance Companies (NAMIC) (namic.org), the largest property and casualty insurance trade association in the United States, was leaked online.
Exposed Data Types
7- Email addresses
- Names
- Usernames
- Passwords
- Phone numbers
- Physical addresses
- Job titles
About This Breach
What information was affected in the NAMIC incident?
The leaked account users table (acct_users.csv) and directory file (namic_emailaddresses.csv) encompass corporate executives, legal counsels, brokers, and operations specialists across member insurance firms. The incident compromised records for 28,675 unique professionals, exposing:
- Identity & Professional Credentials: Full names, system usernames, Active Directory identifiers, and corporate titles (e.g., Counsel, Vice President, Accountant).
- Organizational Data: Associated insurance carrier or brokerage (e.g., State Farm, Nationwide, Acuity).
- Contact Details: Canonical business and personal email addresses and direct telephone numbers.
- Physical Addresses: Corporate headquarters and regional office addresses, states, and postal codes.
- Authentication Secrets: ASP.NET Identity PBKDF2 password hashes and secondary Lyris passwords.
How many accounts were affected?
Rigorous RFC canonical parsing and deduplication confirmed 28,675 unique valid email addresses.
Technical analysis and security risks
The exposure originates from NAMIC's central ASP.NET member portal infrastructure with integrated Active Directory metadata. Leaking verified corporate contact channels and leadership roles across the insurance sector provides high-value intelligence for business email compromise (BEC), sophisticated spear-phishing, and credential-stuffing campaigns against financial service providers.
Recommended actions for affected users
Insurance industry members who maintained accounts on NAMIC portals should:
- Immediately update passwords on corporate single sign-on (SSO) and affiliated portal accounts.
- Ensure multi-factor authentication (MFA/2FA) is enforced across all enterprise access points.
- Exercise heightened caution regarding executive communications concerning fund disbursements or sensitive policy transfers.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
