String of Cyberattacks Against Insurance Industry Could Disrupt Home and Auto Policyholders

Scattered Spider, a hacker group known for its recent string of cybersecurity attacks on retailers, has seemingly set its sights on a new target — the U.S. insurance industry.

The threat group has targeted the U.S. and U.K. retail industries since April, but attackers linked to the group pivoted toward the insurance industry in June. Scattered Spider has a pattern of working its way through a sector, according to the Google Threat Intelligence Group (GTIG).

Given the hacker group’s history, the GTIG issued a statement advising insurance companies to be on high alert for social engineering schemes targeting help desks and call centers.

Google’s warning to insurers comes after a June 7 cyberattack on Pennsylvania-based Erie Insurance caused a network outage, preventing customers from contacting the insurer and filing claims.

Erie Insurance is working with law enforcement to determine the source of the attack and hasn’t yet pinned the incident on Scattered Spider. Philadelphia Insurance also confirmed a system outage on June 11. The company’s outage downed phones, email, and customer online applications.

Policyholders could become targets and face claims delays if attacks continue

The Erie Insurance and Philadelphia Insurance outages prevented policyholders from contacting their insurers. More customers will face disruptions to filing claims, resolving billing issues, and purchasing policies if hackers continue their attacks on the insurance industry.

Attackers may also directly target home and auto insurance policyholders.

“People should be particularly careful when receiving unexpected emails, text messages, or phone calls from people claiming to be insurance companies,” said David Fong, vice president of information security at Insurify.

Hackers might use details from your policy information to try to convince you to disclose your Social Security number or credit card numbers to prevent policy cancellation, said Fong. But customers shouldn’t give in to pressure campaigns.

“Remember, real insurance companies have regulations that require specific notice periods. No legitimate company will contact you with urgent requests for verification of data or sudden changes that require immediate payment.”

Most states require insurers to provide at least 30 days’ notice before a premium increase or policy change. Insurers also have to warn customers before canceling or non-renewing car insurance. Required notice for home insurance cancellations and non-renewals varies by state.

What’s next? Consumers should remain cautious as AI increases cyberattacks

AI will continue to greatly accelerate the sophistication and frequency of cyberattacks, says Fong. “Insurers will need to invest equally in their internal cybersecurity and in providing clear, accessible, and secure customer communications.”

Policyholders will also need to remain vigilant against phishing and manipulation tactics. Customers should cautiously regard urgent or threatening communications, as they may be from an attacker rather than an insurer.

If a communication seems suspicious, customers can best protect themselves by directly visiting their insurance companies’ websites and calling the listed numbers.

Related articles