Insurance companies have a big target on their proverbial radar as cyber attackers increasingly focus on industries that are rich in personal, medical, corporate, and other sensitive data that can be monetized after a data breach.
In 2023 alone, Multiple insurance companies are being targetedJune also included Sun Life due to an attack on vendor Pension Benefits Information LLC. In May, the Prudential Insurance outbreak affected more than 320,000 customer accounts. New York Life Insurance Company had 25,700 accounts affected during the same period as the Prudential attack. Up to 2.7 million people at Genworth Financial were affected. All of these insurance companies were victims of the MOVEit file transfer cyber attack.
Besides MOVEit, other common ransomware attacks also targeted the insurance industry. Point32Health, the parent company of Harvard Pilgrim Health Care and Tufts Health Plan, was hit by a ransomware attack in April, while NationsBenefits reported that the company fell victim to his Cl0p ransomware gang. The largest attack on an insurance company in the United States affected 9 million Managed Care of North America (MCNA) dental patients who were victims of the Rockbit attack.
consulting company Deloitte pointed out“Cyber attacks in the insurance industry are rapidly increasing as insurers move to digital channels to build closer customer relationships, offer new products, and increase their share of customers’ financial portfolios. This change is driving increased investment in traditional core IT systems (such as policy and claims systems) as well as agent portals, online claims applications, and claims management. It also includes a highly integrated enablement platform, including web- and mobile-based apps for ”
The company added: “Insurance companies must find new and innovative ways to analyze data, while also finding ways to protect it from cyberattacks.”
The application reveals many things
As Deloitte pointed out, there are a variety of reasons why insurance brokers and insurers are in a tough spot right now, but a few stand out as the main drivers. The most common is to obtain personally identifiable information or personal health information and resell it for profit, but there are also more nefarious inducements to attack insurance companies. For example, applying for insurance.
The amount of a company’s personal data displayed on insurance applications can mean big bucks to cyber attackers, says Risk, national co-chair of the Cyber Risk practice and insurance broker Marsh McLennan Agency. says management consultant Mark Shine. Schein said the application should include information such as the amount of insurance a company has (ransomware attackers don’t want to leave money on the table when demanding a ransom) and any flaws the company may have. Point out that it contains a vast amount of potentially useful information. Built-in network security.
Other insurance products, such as errors and omissions insurance and directors and officers insurance, can provide valuable information regarding trade secrets, personal information of key company executives, and data on potential commercial transactions, Schein said. points out.
Patricia Titus is the Chief Privacy and Information Security Officer at Markel Insurance, a proprietary surety, specialty, and international underwriting insurance company. She agrees that applications can provide a deep understanding of a company’s technology profile.
Titus said insurance claims can identify technology debt. unpatched software, outdated hardware that may not have manufacturer security or software patches, legacy systems that may exhibit potential security vulnerabilities, and corporate network security. Other possible defects. These vulnerabilities can be exploited by attackers.
Every aspect of an insurance transaction is vulnerable
Titus points out that insurance customers aren’t the only ones who need to evaluate their cybersecurity infrastructure. Markel is looking at ways to better protect not only its customers’ data, but its own data as well.
In Markel’s case, the company is considering techniques to better micro-segment networks and limit an attacker’s ability to move laterally within a network if they are able to penetrate a company’s defenses. Titus says. She points out that moving laterally is the biggest advantage for an attack if they can find a hole in the network.
Titus added that human data is always interesting to cyber attackers. If an attacker has access to an insurance application or approved insurance, they can learn a lot about a potential target. Individuals and businesses alike need to insure high-value luxury items such as antiques. But companies also insure trade secrets that cannot be disclosed through patents (think, for example, the Coca-Cola recipe), personal data about management and officers, and errors and omissions that may occur during business transactions. I’m hanging it. After all, businesses are protecting vast amounts of data that can be identified and compromised if an insurance policy or application is compromised.
Schein recommends that companies submitting insurance claims only send encrypted files so that attackers cannot read what is intercepted during transmission.
