Insurance — Cyber Threat Activity

Insurance holds no recorded incidents in our log and a deliberately thin actor graph of 5 groups, including Medusa, RomCom, Silent Ransom Group, Agrius and RedCurl, with 9 malware families linked through those actors. That sparseness understates a sector that became a named target in 2025, when incident responders reported social-engineering crews moving through US insurance carriers in a concentrated run before pivoting to retail, using help-desk impersonation to reset credentials and multi-factor enrolment rather than exploiting software. Insurers are attractive for reasons that compound. They hold medical histories, financial positions, claims investigations and personal data on entire policyholder populations, which makes them a data target on the scale of a health system. They hold underwriting and actuarial models that are the firm's competitive product. Cyber insurers in particular hold their clients' security assessments, incident histories and coverage limits, which is intelligence about which of those clients can pay a ransom and how much, and that makes a cyber underwriter a target-selection database for anyone who reaches it. The sector also sits behind a broad intermediary layer of brokers, claims adjusters, third-party administrators and managed repair networks, each holding policyholder data with weaker controls than the carrier. Read the empty incident count as a collection artefact rather than a finding: insurers disclose to regulators and policyholders rather than appearing on leak sites, and the actor associations shown come from published research rather than incidents we have attributed ourselves.

All sectors

Recent incidents

Threat actors targeting Insurance

Where these victims are

Malware used against Insurance

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 94.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions