In a statement, the insurer confirmed that a "threat actor" sent an email alleging possession of sensitive customer data.