Insider threats are a significant and often underestimated cyber risk to insurance companies. External cyber attacks often dominate headlines. But insider cyber threats can be equally — if not more — damaging because insiders have access to and knowledge of internal systems and processes. We explore the nature of insider threats specific to insurance companies and the potential impact on cybersecurity and mitigation strategies.
An insider threat is a cybersecurity risk from people who have or had permission to access an organization’s systems, data or premises. Insiders include current or former employees, contractors, partners or anyone else with insider knowledge and access.
In cybersecurity, insider threats can be intentional or unintentional.
For example, social engineering, where an employee or system is tricked into giving information or access to information, is a common unintentional insider threat.
In insurance companies, where important or sensitive customer information, financial data and special algorithms are at risk, insider threats pose cybersecurity challenges. These threats can take various forms, including:
The consequences of insider cyber incidents can be severe, potentially leading to financial losses, reputational damage, regulatory fines and legal liabilities.
Concerned about client privacy, insurance companies often don’t share specific numbers about insider threats. But wider industry reports and studies provide an understanding of the overall number of insider incidents across different industries.
The 2024 Verizon Data Breach Investigations Report shows insiders were responsible for 35% of data breaches analyzed, highlighting how widespread insider threats are across industries.
Insurance companies are particularly vulnerable to insider threats due to their operations. Employees and contractors often have access to a lot of personally identifiable information, financial data and proprietary algorithms used for underwriting and risk assessment. The misuse or unauthorized disclosure of such information can lead to identity theft, fraud and financial losses for both the company and its customers.
Several high-profile cases show the potential impact of insider threats on insurance companies.
In 2018, a former employee of a major insurance firm was convicted of stealing confidential client data, including policyholder names, addresses and Social Security numbers. The employee planned to use the information for identity theft and tax fraud. The incident resulted in significant reputational damage for the insurer and raised concerns about its data security practices and internal data controls.
In another case, a claims adjuster at an insurance company fraudulently changed claims records to inflate payments made to policyholders, resulting in substantial financial losses for the company before the fraud was discovered.
These cases illustrate how insider threats can exploit weaknesses within insurance companies.
To prevent insider threats, insurance companies must take a proactive and multi-layered approach to data security and risk management. Key strategies include:
Insider threats pose a significant and growing cyber risk to insurance companies. Insider incidents can compromise sensitive information, financial assets and customer trust. The exact number of insider attacks within the insurance industry isn’t readily quantifiable due to underreporting and confidentiality concerns. However, the potential impact of insider incidents on insurers underscores the importance of strong data and cybersecurity measures and proactive risk management strategies.
By establishing comprehensive data security controls, fostering a culture of cybersecurity awareness and protecting your data, insurance companies can better defend against insider threats and safeguard their assets and reputation in a digital world.
Charlie Samolczyk is joined by Louise Smith and Taffy Jo Mayers for the next instalment of Talking Technology.
