Industry Brief: Insurance Cyber Risk Priorities

Insurers should rank cyber risk with two questions. Where can an attacker move money or change a policy? And where does customer data sit outside the systems you control? Most other priorities follow from the answers.

What makes insurance different

An insurer holds three things attackers want. It keeps personal, financial and often health data for long periods. It has the authority to pay. And it runs a distribution network of brokers, agents and delegated underwriters who log into its systems every day.

Claims add a fourth. Payments are triggered by people, often through manual approval, on the strength of documents that arrive by email. A convincing caller or a forged change of bank details can be enough to redirect a payout. That is a fraud problem and a security problem at once, and in many insurers the two teams still see only half of each event.

The security question for leadership is therefore not whether the core platform is hardened. It is whether the people and partners who can act on the platform can be impersonated.

Where exposure concentrates

What the evidence shows

The identity pattern is documented. US government advisories on the Scattered Spider group describe help desk social engineering and the resetting of multi-factor authentication to take over accounts. Google’s threat intelligence team and press reporting later described the same group turning to the insurance sector. That is a documented shift in targeting. It does not show that every insurer is equally exposed.

Our judgment is that claims payment and intermediary access deserve more attention than they usually get. Neither is a technology failure. Both depend on a process step where a person decides whether to trust a request.

Priorities, in order

1. Protect the points where money and policies change. Verification for payee changes, large payouts, credential resets and broker account changes comes before any new tooling.

2. Know your intermediaries by what they can do. A small broker with portal access and delegated authority may carry more risk than a large vendor that never touches customer data.

3. Reduce what an attacker can take. Retention limits and cleanup of claim files outside the core systems cut the impact of any breach.

4. Be able to run claims without the core platform. A cyber event during a catastrophe event, when claims volumes already surge, is the hardest case to plan for. Decide the minimum claims service and test it.

5. Keep underwriting exposure out of this register. The cyber risk an insurer writes for clients, including accumulation across clients, is a different risk with different owners. Mixing it with the insurer’s own operational exposure hides both.

Regulatory context

Obligations differ by where the insurer is licensed. Confirm applicability and current text before relying on this summary.

Decisions for leadership

• Which payment and policy changes will never be approved on a single unverified request.

• Which intermediaries are tier one, and what evidence you will accept from them.

• How long claim and policy data is kept, and where copies are allowed to sit.

• The minimum claims service the business must keep running, and the time in which it must return.

• Who owns the fraud and security overlap, so one team sees the whole event.

Indicators worth reporting

• Share of high-risk actions that require out-of-band verification.

• Share of tier-one intermediaries with validated, not self-declared, control evidence.

• Time taken in an exercise to restore claims intake without the core platform.

• Volume of sensitive claim data held outside approved systems.

Sources

• Cybersecurity and Infrastructure Security Agency and FBI, Scattered Spider advisory. cisa.gov cisa.gov

• Google Threat Intelligence Group, public reporting on Scattered Spider activity against the insurance sector, and trade press coverage of the same. cyberscoop.com

• New York State Department of Financial Services, Cybersecurity Requirements for Financial Services Companies, 23 NYCRR Part 500. dfs.ny.gov dfs.ny.gov

• National Association of Insurance Commissioners, Insurance Data Security Model Law (Model #668). content.naic.org content.naic.org

• European Union, Digital Operational Resilience Act (DORA). eur-lex.europa.eu eur-lex.europa.eu

• National Institute of Standards and Technology, Cybersecurity Framework 2.0. nist.gov nist.gov