Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Insurance

Breach intelligence, attack campaigns, and threat reports targeting the Insurance sector.

84 threat reports
Page 1 of 7
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Insurance Threat Reports

Showing 1–12 / 84 reports
How an AI-Augmented MITM Attack Exposed Every Chainalysis Customer's Credentials
Financial Services2 days ago

How an AI-Augmented MITM Attack Exposed Every Chainalysis Customer's Credentials

In late October 2026, blockchain intelligence firm Chainalysis suffered a multi-stage breach that escalated from limited identity metadata exposure to a full-scope credential compromise affecting all customers. Attackers initially leveraged offensive agentic AI techniques to harvest names, email addresses, user IDs, and role labels. A subsequent on-path (MITM) attack then exposed usernames, password hashes, and live session tokens for the entire customer base—which includes law enforcement agencies, financial institutions, and crypto businesses globally. Chainalysis took its login portal, Reactor, Data Solutions, KYT UI, and address-screening APIs offline while forcing password resets and API key rotations. This incident underscores an accelerating trend of AI-augmented offensive techniques combined with classic network interception attacks targeting high-value SaaS platforms. As threat actors increasingly weaponize agentic AI to automate reconnaissance and credential harvesting at scale, organizations that rely on these platforms for regulatory compliance and financial crime investigation face compounding operational and legal exposure.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
When Every Email Looks Legitimate: How Generative AI Is Defeating Behavioral Detection
When Every Email Looks Legitimate: How Generative AI Is Defeating Behavioral Detection
Financial Services2 weeks ago

When Every Email Looks Legitimate: How Generative AI Is Defeating Behavioral Detection

In October 2026, Proofpoint revealed at its Protect 2026 conference that generative AI has fundamentally eroded the behavioral signals email security tools have relied upon for years. Attackers now produce fluent, hyper-personalized, and structurally unique messages at machine speed, eliminating the template reuse, language artifacts, and infrastructure patterns that traditional filters detect. A documented campaign targeted more than 30 real estate agents at a single firm with individually tailored property enquiries, each from a distinct mailbox, before pivoting to a weaponized video-meeting invitation. The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints totaling approximately $3.05 billion in losses, underscoring the financial scale of the threat. This report marks a structural inflection point: behavior-based email detection is no longer sufficient as a primary defense layer. Proofpoint's introduction of intent-based, multi-tier AI reasoning—anchored in its Nexus Intent-Based Detection Model—signals an industry-wide shift toward evaluating what a message is trying to accomplish rather than how it looks, a paradigm that will pressure every enterprise email security program to reassess its detection architecture.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Inside the ShinyHunters Betrayal: When Your Ransomware Negotiator Works for the Attacker
Inside the ShinyHunters Betrayal: When Your Ransomware Negotiator Works for the Attacker
Computer/Network Security2 weeks ago

Inside the ShinyHunters Betrayal: When Your Ransomware Negotiator Works for the Attacker

In October 2026, U.S. federal investigators revealed that executives at two ransomware negotiation firms maintained covert operational ties to ShinyHunters, a prolific extortion group responsible for over $70 million in victim payments that year. One U.S.-based consultant allegedly helped operate Shinywire, the group's victim-shaming extortion portal, while Canadian executive Edward Dubrovsky was arrested for threatening to disclose stolen data and interfering with commerce through extortion. Signal messages recovered during the Dutch arrest of ShinyHunters suspect Pepijn van der Stap exposed that negotiators knew of breaches—including the FBI jobs site hack—before victims were notified, revealing a systemic corruption of the incident response supply chain. This case exposes a structural flaw at the heart of the cyber extortion ecosystem: ransomware negotiators incentivized by percentage-based fees on ransom payments have a financial interest in ensuring victims pay—and pay more. As regulators and insurers scrutinize negotiator conflicts of interest, organizations must question whether their incident response partners are working for them or against them.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Hirudo Android Malware: The Next Evolution in Banking App Attacks
Hirudo Android Malware: The Next Evolution in Banking App Attacks
Banking/Mortgage3 weeks ago

Hirudo Android Malware: The Next Evolution in Banking App Attacks

In October 2024, researchers discovered Hirudo, a sophisticated Android banking trojan that replaces legitimate banking applications with malicious versions to bypass security controls. The malware targets financial institutions across Indonesia, China, India, Mexico, Morocco, and Thailand by distributing infected apps through fake shopping, adult content, and entertainment platforms. Once installed, Hirudo uninstalls genuine banking apps and replaces them with patched versions containing hooking engines that disable app signature verification, accessibility checks, and Play Integrity controls while enabling credential theft, screen recording, and remote device access. This incident highlights the evolution of mobile banking malware toward application-level compromises rather than traditional device-level attacks, representing a significant escalation in threat sophistication that challenges current mobile security paradigms and banking app protection mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How an AI Agent Exposed Critical Authentication Flaws in Enterprise Systems
How an AI Agent Exposed Critical Authentication Flaws in Enterprise Systems
Insurance3 weeks ago

How an AI Agent Exposed Critical Authentication Flaws in Enterprise Systems

In October 2026, Reflectiz's AI pentesting agent autonomously discovered a critical authentication bypass vulnerability on a major insurance company's production website with millions of users. The flaw allowed attackers to manipulate one-time passcode (OTP) delivery by changing the channel from SMS to email and redirecting codes to attacker-controlled addresses, completely bypassing the account verification process. The AI agent successfully exploited the vulnerability during an authorized assessment, demonstrating how authentication controls can be circumvented through parameter manipulation in login requests. This incident highlights the growing sophistication of AI-powered security testing and the persistent weakness in OTP implementations across enterprise applications, as organizations increasingly rely on multi-factor authentication while failing to properly validate delivery mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case
Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case
Computer/Network Security3 weeks ago

Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case

Edward Dubrovsky, a prominent 54-year-old cybersecurity executive and ransomware negotiator, was arrested in Pennsylvania in October 2026 on federal extortion charges under the Computer Fraud and Abuse Act. The Canadian-based security professional, who previously served as an executive at incident response firm Cypfer and authored strategic guides on cyber-extortion response, is suspected of involvement with the ShinyHunters cybercrime collective. FBI investigations suggest connections to the group's recent breach of FBIjobs.gov, where attackers claimed to have stolen data from nearly every FBI employee and job applicant. This case represents a significant insider threat scenario where a trusted cybersecurity professional allegedly participated in the very criminal activities they were supposed to defend against. This incident highlights the growing concern of insider threats within the cybersecurity industry itself, as professionals with privileged access and deep knowledge of defensive strategies increasingly become targets for recruitment by cybercriminal organizations or choose to monetize their expertise through illegal means.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
FBI Targets Ransomware Negotiation Industry: Edward Dubrovsky Arrest Signals New Enforcement Era
FBI Targets Ransomware Negotiation Industry: Edward Dubrovsky Arrest Signals New Enforcement Era
Insurance4 weeks ago

FBI Targets Ransomware Negotiation Industry: Edward Dubrovsky Arrest Signals New Enforcement Era

In October 2026, the FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware negotiations, at a cyber insurance conference in Pennsylvania. Dubrovsky, associated with firms Cypfer and CyberSteward, was charged with cyber extortion and conspiracy in connection with the ShinyHunters cybercrime group. ShinyHunters had recently breached FBI systems, stealing sensitive data on thousands of agents including medical records and operational details. The group has extorted over $70 million in 2026 through phishing attacks and data theft from SaaS platforms. This incident highlights the growing concern over the blurred lines between legitimate ransomware negotiation services and criminal facilitation. With ransomware attacks reaching record levels and negotiations becoming increasingly sophisticated, law enforcement is scrutinizing the entire ecosystem of ransomware response services, signaling a potential shift in how cybercrime enablement is prosecuted.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
MonsterCloud CEO Indicted: The Hidden Costs of Ransomware Recovery Fraud
MonsterCloud CEO Indicted: The Hidden Costs of Ransomware Recovery Fraud
Computer/Network Security1 month ago

MonsterCloud CEO Indicted: The Hidden Costs of Ransomware Recovery Fraud

Zohar Pinhasi, CEO of ransomware recovery firm MonsterCloud, was indicted in October 2026 for allegedly defrauding clients by secretly paying ransomware operators while claiming to use proprietary decryption technology. From June 2018 to June 2023, prosecutors allege Pinhasi facilitated over $8 million in ransom payments while charging victims more than $19 million for recovery services. In documented cases, MonsterCloud charged victims $150,000 after paying attackers $8,200, and $380,000 after paying $236,000 to cybercriminals. The scheme allegedly involved over 300 companies across the United States and Canada. This case highlights the growing sophistication of ransomware ecosystem fraud, where recovery firms exploit victim desperation during crisis situations. As ransomware attacks increase 41% year-over-year and average ransom demands exceed $2 million, the emergence of fraudulent recovery services represents a dangerous secondary victimization trend that organizations must vigilantly avoid.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Denmark's Massive Population Registry Breach Exposes 8.8 Million Citizens
Denmark's Massive Population Registry Breach Exposes 8.8 Million Citizens
Government Administration1 month ago

Denmark's Massive Population Registry Breach Exposes 8.8 Million Citizens

In September 2026, Denmark's Central Population Register (CPR) suffered a massive data breach affecting 8.8 million individuals—approximately 80% of all registered citizens. Threat actors exploited a private Danish company's legitimate access to the registry system, using brute-force techniques to enumerate valid CPR numbers and extract personal information including names, addresses, dates of birth, marital status, and unique identification numbers. The breach was discovered on October 2, 2026, prompting immediate security measures and a police investigation. This incident highlights the growing threat to national identity infrastructure and the critical need for enhanced access controls on sensitive government databases. As nation-state actors increasingly target civilian registration systems for intelligence gathering and social engineering campaigns, organizations must implement zero-trust principles and continuous monitoring to protect citizen data from unauthorized enumeration attacks.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure
Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure
Banking/Mortgage1 month ago

Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure

In October 2026, researchers discovered a critical vulnerability (CVE-2026-18397) in Thales Group's SConnect browser extension, a hardware authentication middleware used by over 1 million users to access highly sensitive government and financial systems including SWIFT banking networks. The vulnerability allows attackers to perform drive-by remote code execution attacks in 6-10 seconds through malicious websites or iframes, bypassing cryptographic security checks due to improper RSA signature validation and buffer handling. The flaw enabled attackers to load malicious DLLs and achieve complete system compromise on systems used for global financial transfers and government operations. This incident highlights the growing risks in authentication middleware as organizations increasingly rely on hardware-based MFA for critical infrastructure. With SConnect reaching end-of-life status and the emergence of AI-assisted exploit development, legacy authentication systems face unprecedented threats that could impact global financial stability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
RatHat Banking Trojan Weaponizes Gemini AI for Automated Victim Profiling
RatHat Banking Trojan Weaponizes Gemini AI for Automated Victim Profiling
Banking/Mortgage1 month ago

RatHat Banking Trojan Weaponizes Gemini AI for Automated Victim Profiling

RatHat Android banking trojan operators have integrated Google's Gemini AI into their malware-as-a-service platform to automatically assess victim financial profiles and prioritize high-value targets. Active since late 2025 with nearly 100 console deployments observed by September 2026, the malware exploits Android Debug Bridge (ADB) to gain shell access, bypassing traditional app permissions. The console analyzes stolen SMS messages and banking credentials to estimate victim wealth, while the malware uses AI-powered screen interaction to adapt to different Android interfaces for maintaining persistence. This incident represents a significant evolution in mobile banking malware, demonstrating how cybercriminals are weaponizing generative AI for victim profiling and adaptive attack techniques, making traditional mobile security defenses less effective against dynamically evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
153 Million Drivers Licenses Exposed: The Largest Government Identity Data Breach of 2026
153 Million Drivers Licenses Exposed: The Largest Government Identity Data Breach of 2026
Government Administration1 month ago

153 Million Drivers Licenses Exposed: The Largest Government Identity Data Breach of 2026

In September 2026, a massive database containing 153 million drivers' licenses was discovered for sale on the dark web, representing one of the largest exposures of government-issued identification data in history. The breach includes comprehensive personal information from drivers' licenses across multiple states, with threat actors actively marketing the dataset to cybercriminals for identity theft, fraud, and other malicious activities. The FBI has launched an investigation into the incident, which appears to involve data aggregated from multiple state motor vehicle departments or a centralized processing vendor. This breach demonstrates the vulnerability of critical identity infrastructure and the growing market for stolen personal identification data on underground forums. This incident highlights the escalating threat to government identity systems as cybercriminals increasingly target high-value datasets containing verified personal information for sophisticated fraud schemes and identity theft operations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports