Cyber Incident Victim: State Farm
Date:
Jul 2019
Location:
United States of America
Summary
State Farm experienced a credential stuffing attack where attackers confirmed valid login credentials through unauthorized access attempts. The company detected the incident and reset affected account passwords as a precaution, though no fraudulent activity was identified in compromised accounts. While the exact number of impacted customers remains undisclosed, notifications were issued advising vigilance. The incident highlights risks associated with reused credentials across multiple services, a common tactic in such attacks targeting financial institutions and other organizations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
State Farm detected a credential stuffing attack on July 6, 2019, prompting an investigation into unauthorized access attempts targeting customer accounts. The attackers leveraged previously compromised username-password pairs obtained from unrelated third-party breaches to systematically test login credentials on State Farm's systems. This automated process confirmed valid credential matches, though the company did not publicly disclose the exact number of compromised accounts. Following discovery, State Farm initiated password resets for all impacted accounts as a containment measure to prevent further unauthorized access. No evidence of fraudulent activity within the compromised accounts was identified during forensic analysis. The company subsequently notified affected customers about the incident without specifying notification timelines or communication channels. Internal security teams monitored account activity for anomalies post-incident.
Credential stuffing attacks represent a widespread threat vector, with Akamai reporting over 3.5 billion such attacks targeting financial services organizations between 2017-2018. This incident followed similar patterns observed in attacks against HSBC, Reddit, and Sky, where attackers reused credential sets across multiple platforms. Successful credential validation in such attacks typically leads to the resale of verified account access on dark web marketplaces. State Farm's public guidance emphasized routine password changes and multi-factor authentication adoption, though these recommendations were not presented as direct responses to the incident. The company's containment strategy focused exclusively on credential resets rather than system-wide authentication protocol changes. Financial sector organizations remain frequent targets due to the high value of compromised financial accounts.