Major Data Breach Hits WaterStreet, Impacts 40,000 Velocity Risk Clients

WaterStreet Company, a provider of insurance software, has reported a major data breach that exposed the sensitive personal information of nearly 40,000 customers associated with Velocity Risk Underwriters.

 

Based in Nashville, Tennessee, WaterStreet delivers insurance software solutions and support services to property and casualty (P&C) insurers, managing general agents (MGAs), insurtech companies, and startups, including Velocity Risk Underwriters.

 

In a data security incident notice submitted to the Office of the Maine Attorney General, WaterStreet said that on March 17, it detected unusual activity within its internal network. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation determined that an unauthorised actor accessed certain files on March 17, 2025. We conducted a thorough review of the files acquired to confirm whether it contained any sensitive information. Our review determined that personal information related to certain individuals was impacted by this event,” WaterStreet said.

 

The compromised data included names and other other personal identifiers including Social Security Numbers. The filing with the Maine state regulator’s office also states that WaterStreet has identified at least 39,310 Velocity Risk Underwriters customers affected by the incident.

 

“Please note this Incident did not occur to, nor involve, Velocity’s systems. Rather, the Incident occurred on WaterStreet’s system which contained certain personal information of individuals associated with insurance policies issued by Velocity and underwritten by State National Companies,” WaterStreet added.

 

The insurance software provider has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general. 

 

It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on WaterStreet. The insurance software provider also did not share details on who was behind the attack, how much data was compromised, or whether it has received a ransom demand.