Allstate disclosed a data breach to the Texas Attorney General on August 21, 2026 exposing names, addresses, dates of birth, Social Security number information, and other personal data. A ransomware group called ExfilSquad separately claims to hold more than 657,000 records and 15.1 GB of Allstate data. If you're a current or former Allstate customer, agent, employee, or job applicant, freeze your credit at all three bureaus, request an IRS Identity Protection PIN, and remove your data from broker sites before criminals cross-reference the leak.
What Happened in the Allstate Data Breach?
Two connected disclosures surfaced in mid-2026:
- July 26, 2026: A ransomware group calling itself ExfilSquad posted a listing claiming to have exfiltrated more than 657,000 records and 15.1 GB of data from Allstate. The listing referenced personally identifiable information alongside recruitment, licensing, onboarding data, and internal employee account details. This claim originates from the ransomware group itself and has not been independently corroborated in a public breach filing at the same scale.
- August 21, 2026: Allstate formally notified the Texas Attorney General of a data breach affecting 377 Texas residents. Allstate confirmed the personal information exposed included names, addresses, Social Security number information, dates of birth, and other personal data. Affected consumers are being notified by U.S. Mail.
Whether the two events are the same incident, related, or separate is not yet public. Regulators typically file per-state notifications, so the Texas number is not the total — more state notifications are expected in the weeks ahead. Treat the exposure as national in scope until Allstate publishes a comprehensive figure.
What Data Was Exposed?
Confirmed via the Texas Attorney General filing:
- Full names
- Home addresses
- Social Security number information
- Dates of birth
- Other personal data (not itemized in the filing)
ExfilSquad's separate listing additionally references recruitment, licensing, onboarding, and internal employee account information — suggesting the affected population may include job applicants, licensed agents, and Allstate staff, not just insurance customers.
SSN + DOB + address is the identity-theft trifecta
The specific combination confirmed by Allstate — name, address, SSN, and DOB — is everything a criminal needs to open credit cards, file fraudulent tax returns, apply for loans, or take over your existing insurance and bank accounts. Every affected person should freeze credit at all three bureaus this week, not "eventually."
Are You Affected?
Because the full affected population has not been published, treat these signals as "assume affected":
- You receive a physical letter from Allstate dated August or September 2026
- You are a current or former Allstate auto, home, life, or renters policyholder
- You applied for a job with Allstate, filed onboarding paperwork, or licensed as an Allstate agent
- You are a current or former Allstate employee, contractor, or agency staff member
Allstate is notifying by U.S. Mail. If a friend or family member received a letter, request one yourself — some letters get lost or misaddressed, and being notified is not a prerequisite for taking protective action.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Immediate Steps to Take
Step 1: Freeze Your Credit at All Three Bureaus
A credit freeze prevents anyone — including you — from opening new credit lines in your name until you lift it. Free, reversible, and the single most effective action after an SSN exposure. Freeze at:
Also freeze Innovis (fourth bureau) and ChexSystems (protects against fraudulent new bank accounts).
Step 2: Lock Your Social Security Number
Create an account at ssa.gov/myaccount and enable eServices Block, preventing anyone from creating a My Social Security account in your name. Follow our step-by-step: How to Lock Your Social Security Number.
Step 3: Get an IRS Identity Protection PIN
SSN + DOB is exactly the combination used for tax-refund fraud. Request an IRS Identity Protection PIN at irs.gov/ippin. A criminal cannot file a fraudulent return in your name without the PIN, and you'll get a fresh one every year.
Step 4: Rotate Passwords on Insurance and Financial Accounts
If you used the same password for your Allstate account and other services (bank, brokerage, retirement, email), rotate all of them now with unique passwords stored in a password manager. Enable phishing-resistant 2FA — an authenticator app or hardware key, not SMS — because SMS 2FA is defeated by SIM swaps enabled by exactly the phone-plus-SSN combination that leaked here.
Step 5: Watch for Insurance-Specific Phishing
Expect emails, texts, and calls impersonating Allstate, other insurers, or state insurance departments, referencing your policy number, real address, and "claim update" or "refund" language. Any inbound request to verify banking, log in, or make a payment should be answered by calling the number on the back of your Allstate insurance card — never a number in the message.
Cut the Trail: Remove Your Data From Broker Sites
The Allstate leak on its own is dangerous. It becomes far more dangerous when attackers pair it with data-broker records — relatives, past addresses, phone numbers, employer, court records — which they can buy for pennies on Spokeo, BeenVerified, Whitepages, and 100+ similar sites. Removing your data from those brokers breaks the chain: when an attacker looks you up after the Allstate leak and finds nothing on the public web, most give up and move to easier targets.
PrivacyOn shrinks your public footprint fast
PrivacyOn removes your personal information from 100+ major data broker sites, adds 24/7 dark web monitoring, and covers up to 5 family members from $8.33/month. Start with a free scan to see exactly which brokers are exposing your address and phone — the same data attackers will try to cross-reference against the Allstate dump.
Longer-Term Protection
- Enroll in any free monitoring Allstate offers in the notification letter, then supplement it — breach-response monitoring alerts you after fraud, not before
- Set fraud alerts at all three credit bureaus (separate from the freeze; alerts warn lenders to verify identity)
- Add dark-web monitoring for your email and SSN so you know when they appear in new dumps
- Use email aliases for future insurance quotes and account signups (iCloud Hide My Email, Firefox Relay, DuckDuckGo Email Protection) so one leak doesn't burn your primary inbox
- Review bank and brokerage statements weekly for the next 12 months — SSN-based fraud typically surfaces months after the underlying breach
- Report suspected identity theft at IdentityTheft.gov to generate a formal FTC recovery plan
Frequently Asked Questions
Is the Allstate 2026 breach confirmed?
Yes. Allstate formally notified the Texas Attorney General on August 21, 2026 that names, addresses, Social Security number information, dates of birth, and other personal data were exposed. Additional state notifications are expected. A separate ransomware-group claim from ExfilSquad in July 2026 alleged 657,000 records and 15.1 GB of Allstate data; that claim is not yet independently corroborated in a public filing at the same scale.
How many people were affected by the Allstate breach?
Allstate's Texas Attorney General filing lists 377 Texas residents, but this is a per-state count — not the national total. More state disclosures are expected in the weeks ahead. The ExfilSquad claim references more than 657,000 records; treat any current number as a floor, not a ceiling.
Was my Social Security number leaked in the Allstate breach?
Allstate's own notification to the Texas Attorney General confirms Social Security number information was among the exposed data, alongside names, addresses, and dates of birth. If you receive an Allstate notification letter, treat your SSN as exposed and freeze your credit immediately at all three bureaus.
What if I only quoted or applied with Allstate but never bought a policy?
ExfilSquad's separate listing references recruitment, licensing, and onboarding data — suggesting the affected pool may include job applicants and agents, not just customers. If you ever submitted personal information to Allstate for any reason, take protective action even without a notification letter.
Should I accept the free credit monitoring Allstate is offering?
Yes — but do not stop there. Free breach-response monitoring alerts you after fraud happens; it does not prevent it. Pair it with a credit freeze at all three bureaus, an IRS IP PIN, and data-broker removal to shrink the attack surface criminals can use against you.
Is there a better identity protection service after a breach like this?
Yes — PrivacyOn is our top pick. It removes your personal information from 100+ data broker sites so attackers cannot cross-reference the Allstate leak with your current address and relatives, adds 24/7 dark web monitoring, and covers up to 5 family members from $8.33/month. Free monitoring from Allstate's breach-response vendor only alerts you after fraud has already happened; PrivacyOn shrinks the exposed surface first, which is what stops most opportunistic attackers.
Can I sue Allstate over the 2026 breach?
Several plaintiffs' firms announced investigations into potential class actions the week Allstate disclosed. If you are affected, save your notification letter and any related correspondence; you may qualify to join a class action later. This is not legal advice — consult an attorney for your situation.
How long will Allstate-breach data be dangerous?
SSN, DOB, and address don't expire. Once this data enters criminal circulation it remains useful for the rest of your life — and it will be repeatedly cross-referenced against future leaks. That's why long-term measures (permanent credit freezes, annual IP PIN, ongoing broker removal, dark-web monitoring) matter far more than any one-time cleanup.