Almeida Law Group is investigating a data breach at Allstate. The breach occurred on June 19th, 2026 and was discovered on July 26th, 2026. If you were affected, contact Almeida Law Group.
About Allstate
Allstate is a publicly traded insurance holding company headquartered in Northbrook, Illinois, that operates primarily through Allstate Insurance Company. It is the second largest personal property and casualty insurer in the United States, offering auto, home, life, renters, and other insurance products, as well as retirement and investment products. Because the breach exposed Social Security numbers alongside names, addresses, and dates of birth, affected individuals face a meaningful risk of identity theft and financial fraud.
What Happened?
Allstate was listed in a Texas Attorney General data security breach report (record BR-0005276). According to that filing, an incident occurred on June 19th, 2026 and was not discovered until July 26th, 2026—a gap of 37 days. A total of 2,604 individuals were affected. Allstate began notifying consumers by U.S. Mail. The data confirmed by the Texas AG filing as having been exposed includes names, addresses, Social Security numbers, dates of birth, and at least one additional unspecified category of information.
On July 26th, 2026, ransomware group ExfilSquad claimed responsibility for the attack, alleging it accessed more than 657,000 records and 15.1 GB of sensitive data. These are attacker-side allegations, not company-confirmed disclosures. Insurance Business Magazine noted that Allstate has not confirmed the scope of any exposure, and the discrepancy between ExfilSquad’s claimed 657,000-plus records and the regulatory filing’s 2,604 affected individuals remains unresolved. ExfilSquad is reported to operate a double-extortion model combining data exfiltration with encryption, and according to GalaxyWarden has targeted organizations in insurance, healthcare, and manufacturing since emerging in late 2024.
Allstate also has a documented history of prior data security incidents. In March 2025, the New York State Attorney General sued Allstate and subsidiaries over breaches in 2020 and 2021 at subsidiary National General that exposed the driver’s license numbers of nearly 200,000 people, with the complaint alleging poor security practices and delayed consumer notification. Separately, law firm Edelson Lechtzin LLP announced on July 29th, 2026 that it is investigating potential class action claims on behalf of individuals whose data was compromised in this incident, and ClassAction.org reports that attorneys are evaluating whether a class action can be filed. As of August 21st, 2026, no filed class action complaint specific to this incident has been confirmed.
Key Facts at a Glance
- Company or Organization: Allstate
- Industry: Insurance Services (Property and Casualty, Life, Financial Protection)
- Location: Northbrook, Illinois
- Incident type: Ransomware / unauthorized access (ExfilSquad claim, not company-confirmed)
- Date of breach: June 19th, 2026
- Date breach discovered: July 26th, 2026
- Date of consumer notification: August 21st, 2026 (published at OAG website); notification sent via U.S. Mail
- Total persons affected: 2,604
- Prior breach: Yes — New York AG sued Allstate in March 2025 over 2020–2021 National General breaches affecting nearly 200,000 individuals
- Litigation status: Under investigation for potential class action by Edelson Lechtzin LLP and others as of July 29th, 2026; no filed complaint confirmed as of August 21st, 2026
- Source: Texas Attorney General data security breach report (BR-0005276); Insurance Business Magazine; Edelson Lechtzin LLP investigation announcement; GalaxyWarden ExfilSquad profile; CyberScoop
What Should You Do?
If you received a notice from Allstate, consider enrolling in any identity theft protection services offered and pay close attention to any enrollment deadline included in your letter. Because Social Security numbers were confirmed as exposed, you should place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—as soon as possible. A credit freeze is free and prevents new credit from being opened in your name without your direct authorization. Review your credit reports for unfamiliar accounts or inquiries at AnnualCreditReport.com, where you are entitled to free reports from each bureau. Monitor your existing financial accounts closely for unauthorized transactions. If you believe your information has already been misused, visit IdentityTheft.gov for step-by-step guidance from the Federal Trade Commission.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
