A ransomware group claims it stole over 217,000 client policy and underwriting documents from insurance brokerage Higginbotham, covering files dating back to 2013. Higginbotham has not confirmed this breach claim publicly. Anyone who worked with the firm as a client, producer, or partner should watch for phishing attempts referencing real policy details and monitor accounts for unusual activity.
| Company | Higginbotham |
|---|---|
| Industry | Insurance |
| Data Types Exposed | Client Policy Documents, Underwriting Questionnaires, Producer Reports and Client Codes, Commission and Benefits Data, Customer Relationship Database Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Higginbotham Data Breach?
A ransomware group has claimed it broke into the systems of Higginbotham, a large independent insurance brokerage, and stole a massive trove of client documents. According to the group’s own leak-site posting, the stolen files include more than 217,000 policy and working documents dating from 2013 through 2026. Higginbotham has not publicly confirmed this Higginbotham data breach claim as of this writing.
The posting states the attackers obtained what they describe as a complete correspondence attachment store. This reportedly includes workers’ compensation and property policy files tied to named clients. Because the listing marks the case as “not paid,” it appears the attackers released the files after failing to secure a ransom payment.
It is not publicly known exactly when the unauthorized access occurred or when it was first discovered. As a result, the full timeline of this incident remains unclear. Higginbotham has not issued a statement describing an investigation, so there is currently no confirmed forensic response to report.
Who was affected?
The population affected by this claimed breach appears to include clients of Higginbotham’s insurance brokerage services. Based on the leak description, those affected may include businesses and institutions that purchased workers’ compensation or property coverage through the firm. Producers and employees whose business records appear in the data could also be impacted.
The exact number of individuals affected has not been publicly disclosed. However, the claimed dataset reportedly spans more than a decade, from 2013 through 2026, which suggests a broad range of clients and partners. Because Higginbotham operates as a brokerage working with many underlying insurance carriers, the scope of affected parties could extend beyond its direct policyholders.
What Information Was Potentially Exposed?
The leak-site posting describes several categories of business and client records that were allegedly taken. These details come only from the attacker’s own claims, so they have not been independently verified by Higginbotham. Still, the described categories are specific enough to outline here.
- Client policy and working documents, including workers’ compensation and property policies
- Carrier underwriting questionnaires
- Producer reports containing client codes, names, and policy numbers
- Producer emails referencing commission, prospect, and benefits data
- Client reference rosters naming insured institutions
- Producer books of business with policy numbers and premium amounts
- Customer relationship database records
If these claims are accurate, the exposure could create real risk for both individuals and institutions named in the files. For example, policy numbers combined with client names could let a scammer impersonate an insurance representative. This kind of information can also help a fraudster craft convincing phishing messages aimed at policyholders or employees.
In addition, underwriting questionnaires and benefits data often include sensitive business and financial details. If exposed, these records could be used for corporate impersonation scams or targeted social engineering against producers and brokers. Clients named in workers’ compensation files may also face a higher risk of targeted fraud attempts referencing their real coverage details.
What is the company doing?
Because this incident stems from a ransomware group’s claim rather than a confirmed company statement, there is no publicly disclosed Higginbotham response to describe yet. Higginbotham has not confirmed whether it is investigating the claim, restoring systems, or notifying affected clients. As a result, any assumptions about remediation steps would be speculative.
If Higginbotham does confirm the incident, affected individuals and organizations would typically expect to see a formal notification process begin. This could include direct notices to impacted clients, details about what data was involved, and potentially an offer of credit monitoring or identity protection services. Until an official statement is issued, however, the full scope of the company’s response remains unknown.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Anyone who has worked with Higginbotham as a policyholder, producer, or business partner should consider checking their credit reports regularly. This is a simple way to catch unauthorized accounts or inquiries early. You can request free reports from each of the three major credit bureaus.
Because this claimed breach involves business and policy data rather than confirmed Social Security numbers, the risk to personal credit may be lower. Still, it is wise to stay alert. Early detection of suspicious activity gives you more time to limit potential damage.
Watch for Phishing and Impersonation Attempts
Given the types of records described in this leak, affected individuals should be cautious of unexpected emails or calls referencing real policy numbers or client details. Scammers often use leaked business data to make phishing messages look legitimate. For instance, a fraudulent email might reference an actual workers’ compensation policy to appear credible.
Therefore, avoid clicking links or providing information in response to unsolicited messages, even if they look official. Instead, contact Higginbotham or your insurance carrier directly using a known phone number. This verification step can prevent you from falling victim to a targeted scam.
Review Business Communications and Vendor Correspondence
Producers and business clients named in the leaked files should review their email and vendor communication practices. Because producer emails reportedly included commission and prospect data, employees should watch for fraudulent requests that reference this type of information. This is especially important for finance and accounting staff who handle payments.
In addition, consider alerting your internal security or IT team about the claimed exposure. This allows them to flag unusual login attempts or payment requests tied to your organization’s name. Being proactive now can reduce the chance of a costly follow-up scam.
Consider Consulting a Data Breach Attorney
If you believe your information was included in this claimed breach, it may help to speak with a data breach attorney. An attorney can review the available facts and explain whether you may have legal options. This is particularly relevant if Higginbotham later confirms the incident and the scope of affected individuals becomes clearer.
Many attorneys who handle these cases offer a free initial consultation. As a result, reaching out costs nothing upfront and can help you understand your rights. This step is especially useful if you later learn your specific policy or business records were part of the leaked dataset.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.