Incident Overview

A threat actor going by bytetobreach claims to have breached VUMI Group, an international health and life insurance provider. VUMI Group operates globally and provides coverage to expatriates, multinational organizations, and high-net-worth individuals. The actor states the exfiltration took 6 days using carefully calibrated parameters to avoid crashing the server, and emphasizes that all databases and documents were taken exclusively from VUMI Group with no third-party involvement.

The breach reportedly exposes approximately 300,000 insured clients and over 25,000 staff, partners, and agents. The actor describes the dataset as containing "everything" and specifically highlights the following:

• Complete PII: Full personally identifiable information for both agents and clients.
• Social Security Numbers: SSNs for affected individuals, confirmed by a dedicated proof screenshot (5_SSN_NUMBERS.png).
• Passport Documents: Scanned passport documents for policyholders, confirmed by a separate proof screenshot (6_PASSPORT.png).
• W-9 Tax Forms: U.S. tax forms containing taxpayer identification numbers, legal names, addresses, and certification signatures.

The actor provided a methodical series of proof screenshots documenting the attack chain: 1_POSSIBLE_VULNERABILITY.png (initial vulnerability discovery), 2_PAYLOAD.png (exploit delivery), 3_DB_ENUM.png (database enumeration), 4_EXFILTRATION.png (data extraction), 5_SSN_NUMBERS.png (SSN data proof), and 6_PASSPORT.png (passport document proof). This structured proof format suggests a deliberate, documented attack rather than an opportunistic data grab.

The data is being distributed through OwnCloud with two backup links, and the actor prefers contact via Session or Signal messaging. Given that VUMI Group serves expatriates and international clients, the combination of SSNs, passport scans, and W-9 forms creates an exceptionally high identity theft risk. Passport documents in particular enable travel document fraud, while W-9 forms provide the exact information needed for tax identity theft.