Farmers Mutual Fire Insurance Listed by Global Secret Group Ransomware Group

On July 26, 2026, Farmers Mutual Fire Insurance of Pennsylvania was listed on the leak site of the ransomware group Global Secret Group. The company, which operates farmersofmarble.com and employs 11-50 people, had 5.72 GB of internal files (18,699 files and 2,631 folders) exfiltrated during a ransomware attack. The leak-site listing does not specify exactly which types of customer or employee records were taken, nor does it state how many individuals may be affected.

Details from the Leak Site

The primary disclosure on the Global Secret Group leak site confirms that the insurance company suffered a ransomware intrusion and that attackers successfully exfiltrated data before encryption or during the incident. The listing includes a partial sample of the stolen material and states that the full archive is available to authorized parties on their platform. No ransom amount or payment deadline is publicly detailed in the initial listing. The disclosure indicates the breach occurred at the small Pennsylvania-based mutual fire insurance provider, whose operations focus on property and casualty coverage in the region.

5.72 GB of internal files were taken, organized into 18,699 individual files across 2,631 folders. The notification does not quantify the number of affected policyholders or employees.

Why This Matters for You and Your Family

When an insurance company is breached, the data most likely exposed includes names, addresses, dates of birth, Social Security numbers, policy details, claims histories, and banking information used for premium payments. Even though the exact contents remain undisclosed, insurance records are among the most valuable for identity thieves because they combine financial data with personal identifiers in one place. If your family holds a policy with Farmers Mutual Fire Insurance or has done business with them in the past, your information may now be in the hands of criminals who specialize in long-term extortion and data resale.

Small insurers like this one often have less sophisticated defenses than national carriers, yet they handle the same sensitive personal information. A breach here can quietly expose multiple generations of a household if parents, children, or grandparents share the same policy.

Doxxing and Identity-Chain Risks

Stolen insurance files frequently serve as the foundation for doxxing chains. Attackers can link your policy address to email accounts, phone numbers, usernames, and even children’s gaming accounts that use the same household details. Once these connections are mapped, criminals can pursue account takeovers, targeted phishing, or extortion threats that feel deeply personal because they reference real policy claims or home addresses. Credential leaks of this nature regularly cascade into gaming platforms, where children’s accounts become entry points for further harassment or social engineering.

Global Secret Group’s Track Record

Public reporting attributes Global Secret Group as a ransomware-as-a-service operation that emerged in late 2024. The group is known for targeting small-to-medium businesses, especially in the insurance, healthcare, and manufacturing sectors. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by rapid data exfiltration and deployment of ransomware. They then use dual-extortion tactics: threatening to publish sensitive files on their leak site while simultaneously demanding payment to prevent release. Notable prior victims have included regional service providers and municipal contractors, though many smaller incidents receive limited press coverage. The group maintains an active leak site and frequently updates it with new victims on a weekly basis.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in this insurance breach.
• Rotate any password you have ever used at farmersofmarble.com or with this insurer anywhere it is reused, and switch to 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak that touches your family is caught and acted upon in hours, not months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often chain back to the same breached address or parent email.
• Let DoxxScan remediation specialists handle data-broker takedown requests and removal of your exposed information instead of attempting manual cleanup across dozens of sites.

The incident is a reminder that even small regional insurers can become high-value targets and that your family’s exposure can extend far beyond the original breach through identity chaining. Running DoxxScan provides continuous monitoring across 15.4B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts. Acting quickly limits how far criminals can travel with the stolen data.