Zurich Japan zurich.co.jp Zurich Japan data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In January 2023, hackers got into customer data held by the Japanese arm of Zurich insurance. It covered over 756,000 unique email addresses, plus names, genders, dates of birth and details of insured vehicles. The data was later posted on a hacking forum.
View all 13,118 breaches- Breach date
- 8 Jan 2023
- Affected
- 756,737
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Vehicle details
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In January 2023, the Japanese arm of Zurich insurance suffered a data breach. According to Have I Been Pwned, it exposed 2.6M customer records containing over 756k unique email addresses. The data was later posted to a popular hacking forum. The Record reported the leak alongside a similar one at Aflac in Japan.
Sources checked: haveibeenpwned.com, therecord.media, consumer.ftc.gov
Last verified against the official page:
What was exposed
The records included names, email addresses, genders, dates of birth and details of the vehicles people had insured. No passwords were listed in the exposed data.
What criminals can do with it
An email address plus a name, a date of birth and the car someone owns is enough to write a believable message. A scammer can pose as an insurer, claim your policy has a problem, and ask you to click through or phone a number. Dates of birth also help anyone trying to pass a security question on another account. Because the records tie you to a specific vehicle, a message that mentions your car or policy is not proof it came from your insurer.
What to do
The main risk here is targeted phishing, so the steps below focus on spotting it. Nothing in the exposed data would let someone log in to your accounts directly, but a leaked date of birth can make other scams more convincing.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Scammers use leaked details like your name, date of birth or insured vehicle to sound convincing, and the FTC warns that they may pretend to be the breached company. Don't click links in messages about it. Contact the company through a phone number or website you already know. The FTC's breach guidance explains what to look for.
- 2
Check insurance messages before you act
If a message about your policy, a renewal or a payment arrives, open your insurer's official site or app yourself instead of using the link. Call the number printed on your policy documents.
- 3
Use a unique password on your email and insurance accounts
If you reused a password across sites, change it now and turn on two-factor login. A password manager makes this easier.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps monitoring and alerts you when they show up in a new leak. It can't remove data from a breach, so the other steps still matter.
Frequently asked
Was I affected by the Zurich Japan breach?
Have I Been Pwned lets you search your email address against this breach. The leak concerned customers of Zurich's Japanese arm, so it mainly matters if you held a policy there.
What was exposed?
Names, email addresses, genders, dates of birth and details of insured vehicles. Have I Been Pwned lists no passwords in this breach.
Should I change my password?
The data didn't include passwords, so there's no password to rotate because of this breach. Still, use a unique password on your email account, because phishing built from leaked details often tries to get it.
Sources
- Have I Been Pwned: Zurich
- Have I Been Pwned: Zurich Data Breach · haveibeenpwned.com
- Millions of Aflac, Zurich insurance customers in Japan have data leaked after breach · therecord.media
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- IdentityTheft.gov · identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
