Cyber Threat Actor: Zenith Insurance

Zenith Insurance, also known by the alias Zenith Insurance, is a workers compensation insurance provider headquartered in Woodland Hills, California, United States of America. The entity operates within the insurance sector, specifically offering workers compensation coverage to employers in California and potentially other jurisdictions. Publicly available information identifies Zenith Insurance as a private company rather than a state‑sponsored or criminal consortium actor.

The actor’s alleged activities focus on the legal and healthcare data associated with workers compensation claims. According to a federal lawsuit, Zenith Insurance hired a private investigator, Oliver Glover, who admitted to downloading workers comp files from attorney‑client servers. The hacking was described as being directed by the insurers to obtain thousands of privileged documents belonging to injured workers and their lawyers, with the explicit purpose of gaining a litigation advantage and reducing financial exposure in judgments and settlements. This indicates a financially motivated objective rather than espionage or disruption. The reported tactics involve unauthorized access to servers containing sensitive personal information, including Social Security numbers, birth dates, addresses, and medical records, followed by the exfiltration of those files; no specific malware families, exploit tools, or initial‑access vectors such as phishing are mentioned in the source material.

The most notable publicly reported operation linked to Zenith Insurance is the alleged multi‑year intrusion that resulted in the copying of over 32,000 workers compensation files, a claim central to the lawsuit filed in the U.S. District Court in Los Angeles. No additional campaigns or distinct operation names are referenced in the available articles. Attribution to any foreign government or broader criminal alliance is not established; the actor is presented as a domestic corporation whose alleged misconduct was carried out through contracted private investigators. No further details regarding affiliations, tooling, or malware are provided in the source material.