Tag: insurance

US insurance giant Aflac says hackers stole personal and health data of 22.6 million people

Dec 23, 2025 9:19 PM

Tags: data, hacker, identity, insurance

Aflac, one of the largest insurance companies in the U.S., confirmed hackers stole reams of personal data, including Social Security numbers, identity documents, and health information. First seen on techcrunch.com Jump to article: techcrunch.com/2025/12/23/us-insurance-giant-aflac-says-hackers-stole-personal-and-health-data-of-22-6-million-people/
US insurance giant Aflac says hackers stole personal and health data of 22.6 million

Dec 23, 2025 7:19 PM

Tags: data, hacker, identity, insurance

Aflac, one of the largest insurance companies in the U.S., confirmed hackers stole reams of personal data, including Social Security numbers, identity documents, and health information. First seen on techcrunch.com Jump to article: techcrunch.com/2025/12/23/us-insurance-giant-aflac-says-hackers-stole-personal-data-of-22-6-million/
Best of 2025: Scattered Spider Targets Aflac, Other Insurance Companies

Dec 22, 2025 3:18 PM

Tags: attack, cybercrime, group, insurance

Fresh off a series of recent attacks targeting major retail companies in the United States and the UK, the notorious Scattered Spider cybercrime group is now targeting insurance companies, and earlier this month apparently bagged a high-profile victim in Aflac. The intrusion in Aflac, which was detected June 12 when the insurance company’s security team..…
What CISOs should know about the SolarWinds lawsuit dismissal

Dec 22, 2025 8:18 AM

Tags: attack, ceo, ciso, control, corporate, cyber, cybersecurity, defense, finance, fraud, government, incident, insurance, jobs, risk

Responsibility without authority is the real risk: At the heart of the SolarWinds lawsuit was a familiar problem for security leaders: responsibility without authority. The dynamic that caught Tim Brown in the SEC’s jaws is that, despite his experience, seniority, and title, he, like most CISOs, carries tremendous responsibility without any real organizational authority to…
What CISOs should know about the SolarWinds lawsuit dismissal

Dec 22, 2025 8:18 AM

Tags: attack, ceo, ciso, control, corporate, cyber, cybersecurity, defense, finance, fraud, government, incident, insurance, jobs, risk

Responsibility without authority is the real risk: At the heart of the SolarWinds lawsuit was a familiar problem for security leaders: responsibility without authority. The dynamic that caught Tim Brown in the SEC’s jaws is that, despite his experience, seniority, and title, he, like most CISOs, carries tremendous responsibility without any real organizational authority to…
ISMG Editors’: When KYC No Longer Signals Trust

Dec 19, 2025 8:19 PM

Tags: ai, cyber, identity, insurance, intelligence, risk

Also: Cyber Insurers Brace for AI Risk, Shopping Agents Rewrite E-commerce. In this week’s ISMG Editors’ Panel, four editors examine how artificial intelligence is quietly reshaping trust, risk and decision-making, from identity verification and cyber insurance to the rise of AI agents in online shopping. The ISMG Editors’ Panel runs weekly. First seen on govinfosecurity.com…
D&O liability protection rising for security leaders, unless you’re a midtier CISO

Dec 18, 2025 9:19 AM

Tags: access, best-practice, breach, business, ciso, compliance, control, cyber, cybersecurity, data, data-breach, defense, finance, governance, incident response, insurance, jobs, law, network, risk, risk-management, security-incident, tool

A question of indemnity: But Ryan Griffin, US cyber leader at insurance broker McGill and Partners, points out that the difference between D&O insurance and a direct indemnification agreement is often misunderstood.”The most crucial tool for a CISO’s protection is the indemnification agreement with their employer,” Griffin explains. “The D&O policy is how the company…
D&O liability protection rising for security leaders, unless you’re a midtier CISO

Dec 18, 2025 9:19 AM

Tags: access, best-practice, breach, business, ciso, compliance, control, cyber, cybersecurity, data, data-breach, defense, finance, governance, incident response, insurance, jobs, law, network, risk, risk-management, security-incident, tool

A question of indemnity: But Ryan Griffin, US cyber leader at insurance broker McGill and Partners, points out that the difference between D&O insurance and a direct indemnification agreement is often misunderstood.”The most crucial tool for a CISO’s protection is the indemnification agreement with their employer,” Griffin explains. “The D&O policy is how the company…
The 12 Months of Innovation: How Salt Security Helped Rewrite API AI Security in 2025

Dec 17, 2025 3:19 PM

Tags: access, ai, api, attack, automation, breach, business, ciso, cloud, compliance, control, crowdstrike, cyber, data, data-breach, defense, detection, email, exploit, github, governance, injection, insurance, intelligence, privacy, risk, risk-management, software, strategy, supply-chain, threat, tool, waf

As holiday lights go up and inboxes fill with year-in-review emails, it’s tempting to look back on 2025 as “the year of AI.” But for security teams, it was something more specific the year APIs, AI agents, and MCP servers collided across the API fabric, expanding the attack surface faster than most organizations could keep…
How to create a ransomware playbook that works

Dec 16, 2025 9:19 AM

Tags: access, antivirus, attack, authentication, awareness, backup, best-practice, breach, business, communications, corporate, credentials, cyber, cybersecurity, data, defense, detection, edr, email, encryption, exploit, finance, firewall, flaw, identity, incident response, infrastructure, insurance, law, least-privilege, malicious, malware, mfa, mobile, phishing, ransom, ransomware, risk, skills, social-engineering, software, strategy, technology, threat, tool, training, update, vulnerability

Staffing, skills, and training: Many organizations continue to find that cybersecurity experts are in short supply, so staffing up teams is a challenge. That can be problematic for a ransomware strategy. Companies need to have a variety of skills in place, including expertise in incident detection and prevention, incident response, firewall configuration, and other areas.They…
How to create a ransomware playbook that works

Dec 16, 2025 9:19 AM

Tags: access, antivirus, attack, authentication, awareness, backup, best-practice, breach, business, communications, corporate, credentials, cyber, cybersecurity, data, defense, detection, edr, email, encryption, exploit, finance, firewall, flaw, identity, incident response, infrastructure, insurance, law, least-privilege, malicious, malware, mfa, mobile, phishing, ransom, ransomware, risk, skills, social-engineering, software, strategy, technology, threat, tool, training, update, vulnerability

Staffing, skills, and training: Many organizations continue to find that cybersecurity experts are in short supply, so staffing up teams is a challenge. That can be problematic for a ransomware strategy. Companies need to have a variety of skills in place, including expertise in incident detection and prevention, incident response, firewall configuration, and other areas.They…
How to create a ransomware playbook that works

Dec 16, 2025 9:19 AM

Tags: access, antivirus, attack, authentication, awareness, backup, best-practice, breach, business, communications, corporate, credentials, cyber, cybersecurity, data, defense, detection, edr, email, encryption, exploit, finance, firewall, flaw, identity, incident response, infrastructure, insurance, law, least-privilege, malicious, malware, mfa, mobile, phishing, ransom, ransomware, risk, skills, social-engineering, software, strategy, technology, threat, tool, training, update, vulnerability

Staffing, skills, and training: Many organizations continue to find that cybersecurity experts are in short supply, so staffing up teams is a challenge. That can be problematic for a ransomware strategy. Companies need to have a variety of skills in place, including expertise in incident detection and prevention, incident response, firewall configuration, and other areas.They…
How Cyber Insurance MGAs Shape Policies for Evolving Cyber Risks

Dec 16, 2025 5:19 AM

Tags: ciso, cyber, cybersecurity, insurance, risk

Managing general agents help insurers navigate sectors where they lack expertise. A cybersecurity policy written by an MGA is more likely to reflect an understanding of the risks CISOs deal with. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/how-cyber-insurance-mga-shape-cyber-risk-policy
Youth Sports, NCAA Insurance Claims Potentially Hacked

Dec 16, 2025 12:19 AM

Tags: breach, data-breach, hacking, healthcare, insurance

National Accident Health Says Breach Exposed Medical Info of 181,000 People. A Maine-based third-party administrator that handles healthcare claims involving day care centers, youth sports and NCAA athlete accidents is notifying more than 181,000 individuals that their medical information and personal identifiers may have been accessed or stolen in a hacking incident. First seen on…
Ransomware-Bande attackiert Ideal Versicherung

Dec 15, 2025 4:19 PM

Tags: cyberattack, infrastructure, insurance, ransomware

Die Ransomware-Bande Akira hat die Versicherungsgruppe Ideal angegriffen.Auf seiner Webseite informiert das Versicherungsunternehmen Ideal aktuell über einen Cyberangriff. Die Systeme seien vorsorglich vom Netz genommen worden und der Geschäftsbetrieb würde nur noch eingeschränkt funktionieren, heißt es.Die zur Versicherungsgruppe gehörende Ahorn AG ist demnach ebenfalls von dem IT-Ausfall betroffen. Hingegen blieb das Tochterunternehmen myLife Lebensversicherung verschont.…
Ransomware-Bande attackiert Ideal Versicherung

Dec 15, 2025 4:19 PM

Tags: cyberattack, infrastructure, insurance, ransomware

Die Ransomware-Bande Akira hat die Versicherungsgruppe Ideal angegriffen.Auf seiner Webseite informiert das Versicherungsunternehmen Ideal aktuell über einen Cyberangriff. Die Systeme seien vorsorglich vom Netz genommen worden und der Geschäftsbetrieb würde nur noch eingeschränkt funktionieren, heißt es.Die zur Versicherungsgruppe gehörende Ahorn AG ist demnach ebenfalls von dem IT-Ausfall betroffen. Hingegen blieb das Tochterunternehmen myLife Lebensversicherung verschont.…
Cyberangriff auf Ideal Gruppe: Systeme von Berliner Versicherung kompromittiert

Dec 15, 2025 2:19 PM

Tags: cyberattack, insurance, ransomware

Die auf Alters- und Pflegevorsorgeversicherungen spezialisierte Ideal Gruppe untersucht einen Ransomware-Befall. Der Geschäftsbetrieb ist eingeschränkt. First seen on golem.de Jump to article: www.golem.de/news/cyberangriff-hacker-attackieren-ideal-versicherung-mit-ransomware-2512-203275.html
Cyberangriff: Hacker attackieren Ideal Versicherung mit Ransomware

Dec 15, 2025 1:19 PM

Tags: cyberattack, hacker, insurance, ransomware

Die auf Alters- und Pflegevorsorgeversicherungen spezialisierte Ideal Gruppe untersucht einen Ransomware-Befall. Der Geschäftsbetrieb ist eingeschränkt. First seen on golem.de Jump to article: www.golem.de/news/cyberangriff-hacker-attackieren-ideal-versicherung-mit-ransomware-2512-203275.html
Organizations can now buy cyber insurance that covers deepfakes

Dec 9, 2025 11:32 PM

Tags: ai, cyber, cybersecurity, deep-fake, insurance

Cybersecurity insurer Coalition said it will start covering certain incidents where AI and deepfakes lead to reputational harm. First seen on cyberscoop.com Jump to article: cyberscoop.com/url-coalition-cybersecurity-insurance-coverage-deepfakes-reputational-harm/
Organizations can now buy cyber insurance that covers deepfakes

Dec 9, 2025 11:32 PM

Tags: ai, cyber, cybersecurity, deep-fake, insurance

Cybersecurity insurer Coalition said it will start covering certain incidents where AI and deepfakes lead to reputational harm. First seen on cyberscoop.com Jump to article: cyberscoop.com/url-coalition-cybersecurity-insurance-coverage-deepfakes-reputational-harm/
23andMe to Get $16.5M in Unused Cyber Insurance

Dec 5, 2025 11:32 PM

Tags: browser, chrome, cyber, insurance

Bankrupt Firm Plans to Use the Settlement Money to Pay Off Cyber Claims. As part of its ongoing Chapter 11 bankruptcy proceedings, 23andMe Holding Co. – now named Chrome Holding – has reached a settlement with its cyber insurers for the carriers to buy back $16.5 million of the consumer genetics testing firm’s unused cyber…
Akamai Study Shows Microsegmentation Boosts Security

Dec 1, 2025 7:49 PM

Tags: cyber, cyberattack, defense, insurance, threat

Microsegmentation no longer remains a buzzword. In today’s threat landscape, organizations are adopting it as a frontline defense against cyberattacks and higher cyber insurance premiums. About 90% of organizations are using some form of segmentation, according to Akamai’s 2025 Segmentation Impact Study. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/akamai-study-shows-microsegmentation-boosts-security-i-5501
What security pros should know about insurance coverage for AI chatbot wiretapping claims

Nov 18, 2025 7:49 AM

Tags: ai, insurance

AI-powered chatbots raise profound concerns under federal and state wiretapping and eavesdropping statutes that is being tested by recent litigation, creating greater exposure … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/18/stephanie-gee-reed-smith-ai-chatbot-legal-risks/
How shadow IT leaves every industry in the dark

Nov 15, 2025 12:49 AM

Tags: access, ai, breach, cloud, compliance, computer, control, data, data-breach, fintech, group, healthcare, infrastructure, insurance, Internet, mobile, network, privacy, regulation, risk, saas, service, technology, tool, unauthorized, vulnerability

Industry Examples of Shadow IT and Shadow AI Healthcare Consumer messaging, unapproved storage of medical imaging files, certificate challenges due to specialized portals for specific healthcare groups, department-run electronic health record (EHR) environments, unapproved telehealth platforms, AI for note summarization Insurance Custom applications for new insurance policy introductions, certificate challenges, maintenance issues, unsanctioned SaaS for…
How shadow IT leaves every industry in the dark

Nov 15, 2025 12:49 AM

Tags: access, ai, breach, cloud, compliance, computer, control, data, data-breach, fintech, group, healthcare, infrastructure, insurance, Internet, mobile, network, privacy, regulation, risk, saas, service, technology, tool, unauthorized, vulnerability

Industry Examples of Shadow IT and Shadow AI Healthcare Consumer messaging, unapproved storage of medical imaging files, certificate challenges due to specialized portals for specific healthcare groups, department-run electronic health record (EHR) environments, unapproved telehealth platforms, AI for note summarization Insurance Custom applications for new insurance policy introductions, certificate challenges, maintenance issues, unsanctioned SaaS for…
Press Release: CIO100 and CSO30 ASEAN Awards Gala 2025 Celebrate Regional Excellence in Technology Leadership

Nov 14, 2025 8:49 AM

Tags: ai, business, cio, computer, cyber, cybersecurity, defense, finance, framework, group, healthcare, insurance, intelligence, international, resilience, service, technology

The CIO100 and CSO30 ASEAN and Hong Kong Awards Gala on November 12, 2025, delivered a powerful validation of the region’s technology leadership maturity. CIO ASEAN and CSO ASEAN had the privilege of hosting an evening that brought together the most elite CIO100 and CSO30 award winners, and technology teams from Singapore, Malaysia, Indonesia, Vietnam,…
Press Release: CIO100 and CSO30 ASEAN Awards Gala 2025 Celebrate Regional Excellence in Technology Leadership

Nov 14, 2025 8:49 AM

Tags: ai, business, cio, computer, cyber, cybersecurity, defense, finance, framework, group, healthcare, insurance, intelligence, international, resilience, service, technology

The CIO100 and CSO30 ASEAN and Hong Kong Awards Gala on November 12, 2025, delivered a powerful validation of the region’s technology leadership maturity. CIO ASEAN and CSO ASEAN had the privilege of hosting an evening that brought together the most elite CIO100 and CSO30 award winners, and technology teams from Singapore, Malaysia, Indonesia, Vietnam,…
IDOR Attacks and the Growing Threat to Your API Security FireTail Blog

Nov 11, 2025 12:20 PM

Tags: access, advisory, api, attack, authentication, banking, best-practice, breach, business, cisa, cloud, cyber, cybersecurity, data, data-breach, detection, email, endpoint, exploit, finance, group, hacker, identity, india, infrastructure, insurance, leak, office, open-source, risk, strategy, theft, threat, unauthorized, vulnerability

Nov 11, 2025 – Jeremy Snyder – IDOR Attacks: Common And Deadly IDOR attacks, or Insecure Direct Object Reference (IDOR) attacks, are one of the most common and costly forms of API breach. In an IDOR attack, hackers directly reference internal objects in a web application that uses APIs1. IDOR attacks specific to APIs consist…
IDOR Attacks and the Growing Threat to Your API Security FireTail Blog

Nov 11, 2025 12:20 PM

Tags: access, advisory, api, attack, authentication, banking, best-practice, breach, business, cisa, cloud, cyber, cybersecurity, data, data-breach, detection, email, endpoint, exploit, finance, group, hacker, identity, india, infrastructure, insurance, leak, office, open-source, risk, strategy, theft, threat, unauthorized, vulnerability

Nov 11, 2025 – Jeremy Snyder – IDOR Attacks: Common And Deadly IDOR attacks, or Insecure Direct Object Reference (IDOR) attacks, are one of the most common and costly forms of API breach. In an IDOR attack, hackers directly reference internal objects in a web application that uses APIs1. IDOR attacks specific to APIs consist…
Your passwordless future may never fully arrive

Nov 11, 2025 9:20 AM

Tags: access, api, attack, authentication, breach, ceo, ciso, cloud, compliance, credentials, cyber, cybersecurity, group, infrastructure, insurance, mfa, network, passkey, password, risk, service, strategy, technology, vpn, zero-trust

All-in passwordless strategies fall short: Jim Taylor, chief product and strategy officer at RSA, says today’s enterprise environment and existing passwordless approaches make “100% passwordless not possible just yet,” adding that “85% is possible, with the 15% representing the complicated and the very specialized” needs such as “security admins who need to log in to…