An unauthorized intrusion in June 2025 prompted a network shutdown at Philadelphia Insurance Companies and related Tokio Marine businesses, disrupting communications and insurance systems. Regular operations resumed by July 1; the company ruled out ransomware and confirmed stolen files containing personal data.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Services continued but with longer processing, response, delivery, or completion times.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Philadelphia Insurance Companies experienced an unauthorized network intrusion late June 9 into June 10, 2025. The insurer disconnected its network to contain the threat, disrupting business systems and customer communications. Its official account says no systems were encrypted and the incident was not ransomware. A subsequently filed breach notice confirms that an unauthorized party acquired files.
The outage also affected Tokio Marine America, First Insurance Company of Hawaii and their shared services provider, Tokio Marine North America Services. AM Best documented the insurers’ shared outage, while Carrier Management reported that the insurers and services company disconnected systems following the June 9 detection. Erie Insurance’s outage was a separate incident.
PHLY’s June 10 notice identified unavailable phone and email services and customer access to online applications. Policyholders could initiate claims through a designated telephone line. Our initial reporting documented those effects before the company publicly clarified the cause and rejected the ransomware characterization.
Restoration proceeded in stages. Employees were regaining limited access to key systems by June 17–18, while claims and customer service call centers provided alternate access. PHLY also reported delayed invoice distribution. It resumed billing with original bill dates and extended a payment grace period through Aug. 1; that accommodation does not establish an outage lasting until August.
On July 1, PHLY announced that regular operations had resumed and that its website and MyPHLY were available, while acknowledging possible minor technical issues. Tokio Marine America’s dated FAQ likewise reported resumed regular operations. The recovery announcements support a resolved operational assessment, although language about continued internal restoration leaves the precise date of complete recovery uncertain.
Confidence is high in the intrusion and resulting disruption because the affected companies described the protective shutdown and service effects. Their explicit denial supports classifying this as a cyberattack without ransomware. Email unavailability does not establish email-system compromise or malware transmission; the companies specifically denied those findings.
Philadelphia Indemnity Insurance Company’s filed breach notice confirms unauthorized activity June 9–10 and acquisition of files. On July 9, its review determined that an acquired file contained a recipient’s name, birthdate and driver’s license number. The notice does not establish a total affected-person count or equivalent data theft at every company affected by the shared outage.
The Insurer reported Scattered Spider responsibility, while noting that Tokio Marine had not identified the actor. Confidence in that attribution is low: the reviewed company disclosures do not name an attacker or provide technical evidence tying the intrusion to the group. Broader warnings about attacks on insurers do not independently establish responsibility for this incident.
The initial access method, scope of compromised systems, number of affected people, any extortion demand or payment, and exact completion of internal restoration remain unverified. The reviewed early company posts describe an outage without cyber-specific wording; a precise date for the first company acknowledgment of the intrusion is not established. The July 9 data-review finding is separate from operational recovery.
The Insurer reports Scattered Spider responsibility and notes that Tokio Marine has not named the actor. Attribution confidence is low; no company confirmation or incident-specific technical proof was found. This is a reporting-based association, not a verified actor self-claim, proof of ransomware or a basis to infer the initial access method.
First Insurance Company of Hawaii’s Honolulu headquarters is the base of an affected insurer. This does not establish effects on the surrounding population.
Tokio Marine America’s New York principal place of business is the base of an affected insurer. This does not establish effects on the surrounding population.
Bala Cynwyd is the headquarters location of PHLY and its shared services provider. The relationship identifies affected organizations’ base rather than all residents or businesses.
Our initial report documents unavailable phones, email and customer-facing applications and a claims workaround.
Company identifies unavailable communications and applications and a telephone claims workaround.
Separate TMNA section describes shared insurer/TMNAS containment shutdown and June17–18 limited access, call-center workarounds and explicit ransomware denial.
Rating agency documents shared network outage at PHLY, Tokio Marine America and FICOH, with continuity workarounds during restoration.
Company confirms unauthorized access and protective shutdown, denies ransomware/encryption, describes restored regular operations and remaining technical work.
PHLY announces resumed regular operations, website and MyPHLY availability, with possible minor technical issues.
TMA confirms June 9–10 intrusion, protective shutdown and resumed regular operations; denies ransomware, encryption and email-system compromise.
PHLY reports regular operations resumed with minor technical issues; phones, email and online access had been affected.
Reports core-system recovery, flat renewal-rate accommodations and suspected Scattered Spider responsibility while noting no company attribution.
Later reporting describes regulatory disclosure of acquired customer data and no named actor.
Filed notice confirms June9–10 unauthorized activity and acquired files; July9 review identified names, birthdates and driver’s license numbers.
Signed-in members can report an error, update, or missing source.
