Cybersecurity Guide

Insurance Industry Cybersecurity: Risks, Regulations and Solutions

Last updated:

Written by Steven Bowcut

With over 30 years of experience in the security industry, Steven Bowcut is a skilled editor, writer, and consultant.

In this guide

Cybersecurity matters in insurance because companies must protect sensitive policyholder records and keep underwriting, claims and payments working.

Their main exposures include stolen credentials, social engineering, ransomware, data theft, compromised vendors and weaknesses in customer-facing applications. Effective security combines risk assessment, identity protection, data controls, incident response and oversight.

Insurance company cybersecurity is not the same as cyber insurance, a product that insures specified cyber-related losses. An insurer may need strong defenses for its own systems even if it also sells cyber coverage to other businesses.

Why are insurers attractive cyberattack targets?

Insurance businesses rely on interconnected people, information and technology. Customer applications may contain identity and payment data; claims may include photographs, reports, medical records and correspondence; agents and administrators may connect to core systems; and cloud or file-transfer providers may handle sensitive records on the insurer’s behalf.

Cyber incidents can damage more than confidentiality. Altered bank details can divert a claims payment, and a disabled claims portal can prevent customers from obtaining timely assistance. Protection therefore covers three outcomes: confidentiality, integrity and availability.

What kinds of data must insurance companies protect?

InformationCommon insurance use
Personal identifiersPolicy applications, identity checks, beneficiaries and claimants
Financial informationPremiums, refunds, bank details, claims payments
Claims and underwriting filesLoss descriptions, supporting documents, photographs and correspondence
Health information where applicableHealth plan administration, medical claims, certain life or disability processes
Credentials and system recordsCustomer portals, broker tools, employee access and audit logs

Structured data is organized in consistent fields, such as a policy number or renewal date.

Unstructured data includes photos, scanned documents, voice recordings and written reports. Either may be sensitive. Controls should reflect access, retention and possible harm rather than the file format alone.

What cybersecurity risks do insurance companies face?

Phishing and impersonation. Attackers may trick employees or help desks into disclosing credentials, resetting accounts or approving payments. Training helps, but strong identity checks, phishing-resistant MFA where appropriate, secure session handling and independently verified financial changes are also important.

Ransomware and extortion. Malware may interrupt underwriting or claims, while stolen data can be used for threats even when files remain accessible. Segmentation, patching, endpoint monitoring and restoration exercises reduce different parts of this risk.

Third-party and cloud incidents. Agents, administrators, software suppliers and shared cloud platforms can expand the attack surface. Insurers need vendor assessments, clear contracts, inventory of data flows and plans for supplier outages. NYDFS’s September 2026 guidance emphasizes shared dependencies and concentration risk.

Account takeover, fraud and accidental exposure. Customer accounts, broker credentials, claims attachments and payment workflows can be misused through unauthorized access or ordinary error. Limit privileges, monitor unusual activity and establish verification procedures that are workable under pressure.

What cybersecurity regulations apply to insurance companies?

There is no single rule for every U.S. insurance business. Licensing, location, insurance line, data handled and exemptions determine what applies.

  • NAIC Insurance Data Security Model Law (#668): A model for risk-based security programs, oversight, event investigations and reporting. States must adopt or adapt provisions for them to become binding in a jurisdiction.
  • NYDFS 23 NYCRR Part 500: Requirements for covered New York-regulated entities, including certain insurance licensees, subject to exemptions. Covered entities must maintain risk-based programs and meet applicable reporting and governance duties.
  • Health-information requirements: HIPAA covers health plans and certain business associates, not every insurer or every insurance document.
  • Other applicable requirements: State privacy and breach-notification statutes, relevant insurance laws and, for certain public-company insurers, securities disclosure rules may also matter.
  • NIST Cybersecurity Framework 2.0: A voluntary way to organize risk management across Govern, Identify, Protect, Detect, Respond and Recover; it is not an accreditation or blanket legal safe harbor.

NYDFS issued clarification on September 10, 2026 emphasizing documented, regularly updated risk assessments and the need to evaluate critical assets, cloud environments, vendors and concentration risks. The letter describes existing Part 500 duties, not a newly enacted requirement.

How can insurers reduce cybersecurity risks?

  1. Map critical activities. Identify systems and providers supporting claims, underwriting, payment processing and customer assistance.
  2. Control access. Apply least privilege, MFA appropriate to risk, protected administrator accounts and verified help-desk recovery.
  3. Protect information throughout its lifecycle. Classify records, encrypt where appropriate, control transfers, monitor exports and dispose of records on a defensible schedule.
  4. Manage vendors and software. Check supplier access, test application security, apply patches and prepare for shared-platform disruptions.
  5. Prepare and rehearse response. Define notification responsibilities, preserve evidence, test secure backups and practice keeping essential claims functions available.
  6. Measure results. Review unresolved exposures, restoration test performance, access exceptions and supplier remediation instead of equating software purchase with risk reduction.

Risk assessment should drive the order of these steps. NIST provides a security-management framework; the organization’s applicable laws determine additional duties.

Related resources

How do AI and third-party providers change insurance cyber risk?

AI-based analysis may help security teams prioritize alerts, but model output can be wrong, manipulated or exposed to sensitive data it did not need. Criminals may use synthetic speech or convincing messages for impersonation.

Insurance uses of AI for underwriting, claims and fraud detection also raise separate governance issues involving oversight, fairness and data practices. The NAIC adopted an AI Model Bulletin in December 2023, but a model bulletin is not uniformly binding law.

Third parties create both confidentiality and operational risks. A claims file may move from the insurer to a processor, administrator and technology vendor; a breakdown in a shared service can affect several operations.

Vendor security therefore requires monitoring and business-continuity planning, not just a one-time questionnaire.

What can insurers learn from real incidents?

Aflac disclosed unauthorized activity detected on June 12, 2025 in parts of its U.S. environment. The company’s initial findings suggested social engineering. Aflac stated the incident was contained within hours, that its systems were not affected by ransomware and that its core services continued.

In December 2025, Aflac reported that files involved personal information associated with approximately 22.65 million people; the company described notifications and customer assistance.

Its June 2026 SEC quarterly reporting continued to discuss related regulatory communications and disputes. The main lesson is that a major information exposure can occur without a widespread service outage.

Delta Dental, 2026 enforcement action. A New York DFS consent order linked a 2023 MOVEit Transfer data incident to documented problems in nonpublic-information disposal procedures, incident reporting, and response planning at two regulated dental insurance entities.

The order specified a $2.25 million civil penalty. The lesson is to control file retention and connect technical incident discovery to regulatory reporting decisions.

Is cyber insurance a substitute for cybersecurity?

No. Cybersecurity protects an insurer’s people, information and operations. Cyber insurance is a contract that may pay specified losses subject to coverage terms.

An insurer underwriting cyber policies may ask customers about access controls or incident plans, but having a policy does not prevent an incident or meet regulatory duties. See the separate cyber insurance guide.

For market perspective, the NAIC’s 2025 market report, covering 2024 U.S. business, reported about $9.14 billion in cyber insurance direct written premiums, approximately 7% lower than in 2023. This does not establish that every policy’s price fell; written premium and individual rates are different measures.

Frequently asked questions

Do all insurers need to follow NYDFS cybersecurity rules?

No. Part 500 covers entities with specified New York financial-services authorizations, including relevant insurance licensees, and has exemptions. It is not a nationwide requirement.

Do all insurers have to comply with HIPAA?

No. Certain health plans and business associates do, but HIPAA does not generally apply to every life or property-and-casualty insurance operation.

What should an insurer prioritize first?

Find its critical business processes and sensitive records, identify who and what has access, close obvious identity and supplier weaknesses, and test the ability to respond to and recover from incidents.

How can cybersecurity professionals work in insurance?

Security analysts, identity specialists, incident responders, third-party risk analysts and privacy or compliance professionals can apply their skills to insurance operations. These jobs differ from cyber insurance underwriting and claims roles. Explore other cybersecurity sectors.

References