A single cybersecurity breach in the financial and insurance industries now costs companies an average of $6M.
Each incident can result in ransoms, fines, fraud, and long-lasting damage to a company’s reputation.
It doesn’t matter the size of the insurance agency. Cybercriminals are eager to access data from even a small portion of the hundreds of millions of policyholders served by this sector.
Understanding the threat landscape, as well as the latest cybersecurity solutions, is the best way to protect company and client data. This article will identify current risks, industry-specific mitigation strategies, and recent high-profile breaches at insurance agencies.
Top Stats About Cybersecurity for Insurance Firms
- Nearly 37% of insurers say cybersecurity will be the largest challenge facing the industry over the next three years.
- More than a quarter of the top 150 American insurance firms have reported a recent data breach.
- Since 2021, the number of financial organizations reporting at least one ransomware attack annually has increased by 31%.
- Nearly 60% of breaches in the insurance industry involve third-party software providers.
- One-quarter of cyberattacks in the financial and insurance sectors now come from social engineering, with many attacks leveraging AI to enhance success rates.
- In New York alone, 10 auto insurance providers were recently fined a total of more than $20.79M for failing to protect customer data.
Cybersecurity Vulnerabilities in the Insurance Industry
Insurance carriers inherently hold massive amounts of personal data. If cybercriminals get their hands on this data, they’re all but guaranteed a very rich payout on the dark web.
Here are some of the most common vulnerabilities exploited by cybercriminals targeting the insurance industry.
Unsecured Data in Legacy Systems
Health insurance companies hold highly sensitive data on 310M Americans.
Car insurance carriers automatically gather telematic data from drivers, processing data from 1B miles driven each day.
And, much of the personal data held by insurance firms is held for decades.
Nearly 75% of insurance firms still store client data in legacy systems with inherent security vulnerabilities.
Some firms have a combination of old and new tech stacks and, in the transition to the hybrid system, they’ve siloed data and lack visibility into many data storage systems.
Unsecured legacy systems leave insurers vulnerable to attacks like SQL injections and zero-day exploits.
However, many insurers are hesitant to update their legacy systems due to cost. McKinsey reported that one financial organization spent more than $100M to modernize its transaction processing system.
Early-Stage AI Systems
While the insurance industry remains heavily reliant on legacy systems, many firms are also optimistic about deploying new tech solutions (like AI).
For example, Aviva, the largest general insurance company in the UK, recently built and deployed more than 80 AI models to improve their claims operations.
Surveys show that more than three-quarters of the insurance industry has already deployed generative AI solutions. Nearly half have also deployed agentic AI.
However, cybersecurity is an afterthought. Less than 10% of insurance organizations say their systems are optimized for governance and security.
On a global scale, the World Economic Forum found that two-thirds of businesses believe that AI systems will have a significant impact on cybersecurity in the next year, but just 37% say their organization has a cybersecurity plan in place before deploying AI tools.
Inadequate IT Staff
Nearly 44% of insurance providers say their company doesn’t have enough specialized tech professionals.
This echoes the cybersecurity skills gap that’s being reported across sectors. Just 14% of organizations say they’re confident they have the IT staff necessary to ward off cyber threats.
Much of this vulnerability comes down to budget constraints.
A recent analysis found that 76% of property and casualty insurance agencies have annual revenues below $500K. Agencies of this size most likely don’t have the financial resources to hire dedicated cybersecurity staff members.
Reliance on Third-Party Vendors
Insurance firms use a number of third-party software vendors for services like cloud housing, payment processing, telematics collection, and claims administration. When considering cybersecurity, each one of these vendors represents a vulnerability and potential attack surface.
In May of 2025, Farmers Insurance fell victim to a cyberattack via a breach of Salesforce systems. The data breach impacted more than 1.1M Farmers Insurance clients and included a wealth of personal information like driver’s license numbers and social security numbers.
It’s suspected that data from 1.4M Allianz Life clients was stolen in a separate, but similar, Salesforce social engineering attack in July 2025.
Tools to Improve Cybersecurity for Insurance Companies
While there are numerous cybersecurity risks facing insurance agencies, there are just as many ways to stop criminals from infiltrating data-rich systems. Some of the simplest strategies, like multi-factor authentication, can stop many data breaches before they start.
Here are the key solutions that can provide the layered approach that the insurance sector needs.
Identity and Access Management
Recent research shows that 56% of insurance companies had at least one compromised credential over the past two years.
Overall, IBM says compromised credentials are responsible for 10% of data breaches.
Insurance agencies should first look to improve their identity and access management practices by implementing MFA across the organization’s employees and clients.
MFA requires users to provide two or more forms of proof in order to access a protected system. Nearly 90% of large firms (more than 10K employees) already use MFA, but in small and mid-sized organizations, MFA adoption drops to about 30%.
MFA would’ve stopped the 2024 data breach at Change Healthcare, a medical clearinghouse responsible for receiving and processing half of all health insurance claims and payments in the US.
Russian cybercriminals were able to breach a critical server that did not have MFA. The data of more than one-third of the American population was potentially stolen. A $22M ransom was ultimately paid to the hackers.
FIDO2, which stands for Fast Identity Online 2, is another option to strengthen IAM.
This is a standard for passwordless authentication that’s centered around cryptographic algorithms. In this setup, there’s a public key and a private key. The public key stays on the site or app, and the private key stays with the user, typically on a desktop or smartphone. Both keys have to come together to provide access to the user.
SASE (Secure Access Service Edge)
SASE solutions integrate several cloud-delivered cybersecurity methods into one system. This includes zero-trust network access, cloud access security broker, firewall-as-a-service, secure web gateway, and software-defined wide area network.
Because it’s a centralized system, SASE is able to provide uniform protection no matter the location of devices and workers. This is especially critical for insurance firms, as many agents travel off-site and work remotely.
The unified approach of SASE can also ease burdens on small IT teams or insurance companies with limited budgets.
Microsegmentation
In addition to implementing perimeter security to protect network entry points, insurance companies can adopt a very granular approach by using microsegmentation.
This cybersecurity strategy divides a network into segments that are each protected on an individual basis. Each segment has unique security policies that define which users and devices have access. For example, an insurance firm’s claims app server could be the only one that has access to the claims database.
Microsegmentation limits the impact of a breach by preventing hackers from moving laterally once they’re in the network. In fact, this strategy can decrease the amount of time it takes to contain ransomware by 33%.
Third-Party Risk Management
Cybercriminals know that, oftentimes, the easiest way to access an insurance company’s data is through a third-party vendor.
With tech sprawl and the proliferation of AI solutions, the insurance sector has more vendors (and more attack surfaces) than ever before. A single agency might work with vendors for claims processing, actuarial services, payment processing, medical record exchanges, credit reporting, and much more.
Third-party risk management is a continuous process, but here are the most critical steps to start.
- Executive leadership, legal teams, and IT teams should work together to predetermine risk tolerance criteria and thresholds for vendors. They should also create a unified system for managing documents, insights, and other information about vendor risks.
- Third-party risk management should be built into the software procurement process.
- Vendors should comply with standards like SOC 2, ISO 27001, and industry-specific regulations like HIPAA.
- Third-party vendors should be required to provide notice if they subcontract services to a fourth-party vendor.
- Insurance firms need to plan, test, and analyze the steps they will take if there is a third-party breach. They should establish liability and financial responsibility criteria at the outset of the contract.
- Insurance companies should maintain a right-to-audit privilege throughout the life of the contract.
Social Engineering Protection
More than 25% of insurance organizations have added employee training as a new cybersecurity tool in recent months.
This is due to the increase in social engineering attacks.
A study of more than 700 cyberattacks from the past year found that more than one-third of attacks began with a social engineering tactic.
Scattered Spider, a well-known group of cybercriminals, targeted several retail corporations with social engineering tactics in the first half of 2025. The group recently turned its attention to the insurance sector.
In many of the attacks, Scattered Spider hackers manipulated the company’s IT help desk. In one instance, the hacker reportedly impersonated an employee who had lost their phone and was locked out of their account. The help desk staff member reset the MFA settings and emailed new credentials, essentially inviting the hacker into all of the company’s systems.
Other criminals are attempting to dupe employees with chat messages, text messages, and phone calls using voice clones.
Some of the best defenses against social engineering are the simplest, like these:
- Complete bi-annual or annual training with all employees. Work through common social engineering scenarios in each session. Then, throughout the year, share information about new tactics that hackers are using against the company and the insurance sector.
- In attacks, cybercriminals will often stress the urgency of their request in order to fluster the employee and gain access. Reassure employees that they will not be punished for thoroughly vetting each request with the proper steps.
- If a request is made, require employees to verify it through a separate channel. For instance, if a person has sent an email requesting access to sensitive data, verify it through a Slack message.
How AI Impacts Cybersecurity Strategies in the Insurance Sector
When considering cybersecurity, AI is both a threat and an advantage for insurance agencies.
For instance, three-quarters of cybersecurity professionals say that attacks have increased in their organization in recent years, and 85% of them blame generative AI.
However, nearly 90% of IT departments are using AI to improve their cybersecurity efforts.
AI-Powered Cyberattacks
Cybercriminals are using AI to improve and automate their attacks from conception to completion.
They use AI tools to automatically scrape the internet and find potential victims. They’re able to access personal information that can make social engineering attacks and phishing campaigns much more believable.
One analysis showed that AI is used, in some way, to create nearly 83% of phishing emails today.
AI can also be used to create deepfake audio messages or videos in as little as 45 minutes. There are even instances of cybercriminals using deepfakes in real time in order to deceive executives on a video conference.
Beyond social engineering, hackers can also use AI to create malware aimed at infiltrating insurance companies. In particular, there’s been a marked increase in polymorphic malware. That’s malware that can create variants of itself by modifying its code each time it infects a new system, making it difficult to detect.
AI-Powered Cyber Defense
According to IBM, companies without AI-powered cybersecurity tools face an average data breach cost of $5.36M. That’s nearly 20% higher than the overall average.
Insurance IT teams can use AI to automate several processes, which alleviates the burden placed on understaffed departments and accelerates remediation.
For example, AI can be used for automated threat detection. This is a task that traditionally involved human analysts looking over massive amounts of data. Now, AI systems perform threat detection in the background without any human involvement.
AI is especially skilled at finding patterns and anomalies that would be too subtle for humans to recognize. The system can call out potential vulnerabilities that need attention and trigger immediate action if a threat is found.
Remediating threats is also much faster with AI. Without AI, teams waste countless hours manually looking through multiple alerts and coordinating ownership assignments. This slow response time can allow breaches to escalate quickly. On the other hand, AI systems provide contextual details about each alert, prioritize vulnerabilities, and create specific solutions for each one.
Overall, 30% of cybersecurity teams have already integrated AI tools, and another 42% are currently evaluating and testing AI solutions.
Geico: An Insurance Cybersecurity Case Study
Beginning in November 2020, cybercriminals carried out a number of attacks on Geico’s car insurance quoting tools.
The first of these attacks focused on the customer-facing online quoting tools. Hackers were able to gain access to the driver’s license numbers of several thousand New York residents.
During this time, the New York State Department of Financial Services (DFS) alerted Geico and other insurers to the possibility of hacking campaigns like this. However, DFS reports that Geico “failed to conduct a comprehensive review of its systems to prevent and detect future cyberattacks.”
Geico reportedly closed the specific back-end vulnerability that caused the breach of the customer-facing online quoting tools, but the breaches continued.
The second wave of breaches exploited vulnerabilities in a separate quoting tool used by Geico agents. This resulted in the theft of the personal information of more than 110K New York residents.
The cybercriminals used a number of stolen driver’s license numbers and personal information to file fraudulent unemployment claims during the pandemic.
In November 2024, DFS levied a fine of nearly $10M on Geico for failure to protect customer data.
In response, Geico said it’d be strengthening its cybersecurity practices by using MFA, maintaining logs, and enhancing its threat response strategies.
Conclusion
In the coming months, the cybersecurity threats facing insurers are likely to continue at a blistering pace. AI tools now enable hackers to swap their targets and improve their methods in days instead of months.
Insurance companies that implement strict IAM controls and comprehensive third-party vendor protocols can significantly reduce their attack vulnerabilities. However, securing the human element should also remain a top priority.
Companies that proactively search for cybersecurity automation tools and implement AI solutions are the most likely to be safe from the next wave of cyberattacks.