Kemper Data Breach April 2026 - What Was Exposed and What To Do

What Happened

In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign. The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data they claimed included internal directory data, Salesforce records and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses and partial payment card data including the last 4 digits, expiry dates and card brands. Kemper confirmed the incident and stated they had engaged third-party cybersecurity experts and notified law enforcement.

Breach date

2026-04-15

Records affected

269,299

Verified

Yes

Domain

kemper.com

What Was Exposed

The following data types were included in the breach:

• Email addresses
• Names
• Partial credit card data
• Phone numbers
• Physical addresses
• Purchases

What You Should Do

If you had an account with Kemper, take these steps immediately:

1. Check if your account was affected at HaveIBeenPwned.com
2. Watch for phishing emails that reference the breach or impersonate the affected company
3. Contact your bank or card issuer to request a replacement card
4. Review recent statements for unauthorized transactions
5. Be alert for social engineering attempts using your exposed personal information
6. Enable two-factor authentication on the affected service if available
7. Consider using a password manager to generate unique passwords for each service

FAQ