Actor claims to sell 50 million Progressive customer records
A threat actor on a dark web forum claims to sell a dataset of 50 million Progressive customer records, one of the largest US auto insurers. The data allegedly includes full names, home addresses, phone numbers and vehicle details such as make, model and VIN. The claim is unverified, Progressive has not commented, and the figure may include aggregated or older data; if genuine, it enables targeted phishing and insurance fraud.
What happened
A threat actor on a dark web forum is advertising a dataset it claims holds 50 million records of Progressive customers, one of the largest auto insurers in the United States. The post says the data includes full names, home addresses, phone numbers and vehicle details such as make, model and VIN. The claim is unverified and Progressive has not commented.
Why it matters
If genuine, the mix of addresses and vehicle data enables targeted phishing and insurance fraud against customers. The 50 million figure has not been verified and may include aggregated or older data. Scams may follow even without a confirmed breach.
What to do
Watch Progressive's official channels for a statement. Warn customers about contact attempts using policy or vehicle data. Review your reporting channel for fraud cases.
For the technical team
- Affected
- Progressive Base de dados de clientes da Progressive, uma das maiores seguradoras de automóveis dos EUA; alegação de 50 milhões de r · Progressive customers, one of the largest US auto insurers; claimed dataset of 50 million records with full names, home addresses, phone numbers and vehicle details (make, model and VIN).
- Exploitation
- No technical exploitation reported. Sale claim reported by DailyDarkWeb; multiple samples were shared, consistent with policyholder data. The 50 million figure is unverified and Progressive has not commented.
- Fix
- Not applicable; no vulnerability or fix described in the sources.
- Vector
- Not described in the sources. This is a claimed database sale on a dark web forum, with no information on how the data was allegedly obtained.
- More details
- Buyers are steered to Telegram channels linked to the UNC6783 cluster. DailyDarkWeb analyst note: unverified threat-actor claim, not confirmation of a breach, and the figure may include aggregated or older data.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
