"The threat actor was able to obtain personally identifiable data related to the majority of Allianz Life's customers, ... third-party, cloud-based CRM system...Based on our investigation to date, there is no evidence the Allianz Life network or other company systems were accessed, including our policy administration system."
I take it from this that the systems which ran the actual business where the data belonged were OK. So why was some 3rd party CRM also holding the data if it wasn't essenital for running the business? I think we all know that one - marketing. The people who send out "click here" emails to customers, training the customers to be phished and clearly expecting customers to click on them because that's what they'd do themselves; the most easily phished staff in the business.