Was the attack actually sophisticated? Usually, when megacorporations get pwned, the attack is not sophisticated at all, but they pretend it is (for PR reasons). This page doesn't tell us much about the nature of the attack, which is understandable. And as for what was compromised... almost everything of value?

Given that this is an insurance company, I imagine the attackers were either criminals (who wanted to steal this information for identity theft), or state-sponsored attackers (who would want this information for HUMINT reasons, such as verifying identities or determining good targets).