Zenith Insurance

Profile narrative

Zenith Insurance, also known by its alias Zenith Insurance, is a workers compensation insurance provider headquartered in Woodland Hills, California, United States. The company entered public scrutiny after a federal lawsuit alleged that it, together with other insurers, hired private investigators to illegally access attorney‑client privileged workers compensation files. The lawsuit, filed in the U.S. District Court in Los Angeles, claimed that Zenith Insurance’s hired investigator Oliver Glover participated in the unauthorized acquisition of sensitive personal data from injured workers’ legal records.

The alleged activity targeted the workers compensation sector, specifically law firms and databases handling compensation claims in California, with the stated strategic objective of gaining a litigation advantage and reducing financial exposure in judgments and settlements. According to the complaint, the insurers directed the hacking to obtain thousands of claimant files so they could use the information to negotiate lower payouts, indicating a financially motivated goal rather than espionage or disruption. No evidence in the source material links Zenith Insurance to state sponsorship or a broader criminal consortium.

The reported tactics involved private investigators gaining unauthorized access to computer systems storing workers compensation files and downloading tens of thousands of documents containing Social Security numbers, birth dates, addresses, and medical details. The source does not reference specific malware families, exploit kits, or custom tooling, focusing instead on the act of illicit file access and data exfiltration by hired investigators. A representative example of the alleged operation is the case of Adela Gonzalez, whose personal information was purportedly stolen from her lawyer’s database, leading to the class‑action lawsuit that also named Zenith Insurance as a defendant. This incident illustrates the claimed pattern of behavior attributed to the threat actor.

Incidents

Attributed incidents are available to members.