✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Insurance
Breach intelligence, attack campaigns, and threat reports targeting the Insurance sector.
Explore Other Sectors
Insurance Threat Reports
Texas Parks and Wildlife Department Data Breach Exposes Over 3 Million Records
In June 2026, the Texas Parks and Wildlife Department (TPWD) disclosed a significant data breach involving its license system vendor, exposing personal information of over 3 million individuals. The compromised data includes driver's license information, passport numbers, email addresses, phone numbers, and residential addresses. Notably, Social Security numbers, dates of birth, and financial information were not affected. The breach was detected by the Texas Cyber Command, prompting an immediate investigation and the implementation of enhanced security measures. ([tpwd.texas.gov](https://tpwd.texas.gov/about/notification-of-data-security-incident/?utm_source=openai)) This incident underscores the escalating risks associated with third-party vendors in data security. Organizations are increasingly vulnerable to breaches through external partners, highlighting the necessity for stringent vendor management and comprehensive security protocols to safeguard sensitive information.
1 month ago
Kill Chain
DentaQuest Data Breach 2026: ShinyHunters Expose 2.6 Million Records
In May 2026, DentaQuest, a leading dental benefits administrator in the United States, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers infiltrated DentaQuest's network, exfiltrating over 234 GB of sensitive data, which included personal information of approximately 2.6 million individuals. The compromised data encompassed email addresses, full names, phone numbers, government-issued IDs, health insurance details, genders, and dates of birth. Following unsuccessful ransom negotiations, ShinyHunters publicly released the stolen data, amplifying the potential for identity theft and fraud among affected individuals. This incident underscores a troubling trend of cyber extortion targeting healthcare organizations, highlighting the critical need for robust cybersecurity measures and rapid incident response protocols to protect sensitive patient information.
1 month ago
Kill Chain
Data Broker Sentenced for Selling Elderly Americans' Personal Information
Between 2016 and 2023, Troy Murray, a 57-year-old from North Carolina, operated under the alias "Steve Dixon" to sell personal information of over 7 million elderly Americans to Jamaican scammers. These "lead lists" included names, phone numbers, addresses, and email addresses, which were used to perpetrate lottery fraud schemes. Murray charged approximately $500 per list, generating over $5.2 million in illicit profits. He was sentenced in May 2026 to 121 months in prison, three years of supervised release, and ordered to forfeit $5.2 million. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/man-sent-to-prison-for-selling-data-of-7-millions-elderly-americans/amp/?utm_source=openai)) This case underscores the escalating threat of elder fraud, with the FBI reporting a 37% increase in complaints from individuals aged 60 and older in 2025 compared to the previous year. Total losses for this demographic reached nearly $7.8 billion, highlighting the urgent need for enhanced protective measures and regulatory oversight to safeguard vulnerable populations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/man-sent-to-prison-for-selling-data-of-7-millions-elderly-americans/amp/?utm_source=openai))
1 month ago
Kill Chain
Silent Ransom Group's In-Person Data Theft Tactics Target Law Firms
In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), a Russia-linked extortion gang targeting U.S. law firms. SRG employs sophisticated social engineering tactics, including impersonating IT support staff via phone calls and phishing emails to gain remote access. When these methods fail, they escalate to in-person visits, where operatives physically infiltrate offices, connect external storage devices to computers, and exfiltrate sensitive client data. This data is then used to extort firms, with threats to publish or sell the information if ransoms are not paid. ([techtimes.com](https://www.techtimes.com/articles/317293/20260527/silent-ransom-group-sends-operatives-law-firm-offices-38-firms-already-leaked.htm?utm_source=openai)) This incident underscores a concerning evolution in cybercriminal tactics, blending traditional cyber attacks with physical intrusion. The legal sector's sensitive data makes it a prime target, highlighting the urgent need for robust security protocols, employee training, and vigilance against both digital and physical social engineering threats.
1 month ago
Kill Chain
Surge in Cyber-Enabled Cargo Theft: A 2025 Analysis
In 2025, cargo theft losses in the United States and Canada surged by 60%, reaching an estimated $725 million. This increase is attributed to cybercriminals employing sophisticated tactics such as phishing, impersonation, and system compromises to hijack goods during transit. By infiltrating supply chain systems, these actors rerouted shipments, leading to significant financial and operational disruptions for businesses. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai)) The FBI's April 30, 2026, public service announcement underscores the evolving nature of cargo theft, emphasizing the integration of cyber techniques into traditional theft methods. This trend highlights the urgent need for enhanced cybersecurity measures within the transportation and logistics sectors to mitigate the risks posed by these advanced threats. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai))
2 months ago
Kill Chain
Fraudsters Exploit Credit Union Verification Processes in 2026
In May 2026, cybersecurity researchers uncovered a sophisticated fraud scheme targeting small to mid-sized credit unions. Threat actors utilized stolen personal data to impersonate legitimate borrowers, navigating through credit checks and identity verification processes without triggering security alerts. This methodical approach exploited perceived weaknesses in the verification systems of smaller financial institutions, leading to unauthorized loan approvals and significant financial losses. This incident underscores a growing trend where cybercriminals focus on process exploitation rather than technical vulnerabilities. The increasing availability of personal data on underground forums, combined with advanced social engineering tactics, poses a heightened risk to financial institutions, especially those with limited fraud prevention resources.
2 months ago
Kill Chain
Insider Betrayal: Ransomware Negotiator Aids BlackCat Attacks
In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to conspiring with the BlackCat/ALPHV ransomware group to extort U.S. companies. Martino exploited his trusted position by providing confidential client information, such as insurance policy limits and negotiation strategies, to the attackers. This insider collaboration enabled the ransomware group to maximize their ransom demands, resulting in over $75 million in payments from victims, including a nonprofit and a financial firm. Authorities have seized more than $10 million in assets from Martino, who faces up to 20 years in prison. This case underscores the critical importance of vetting and monitoring individuals in sensitive cybersecurity roles. The incident highlights the evolving tactics of ransomware groups, including the recruitment of insiders to enhance their extortion efforts. Organizations must remain vigilant against such threats and implement robust internal controls to safeguard against insider collusion.
2 months ago
Kill Chain
FBI Reports 60% Increase in Cyber-Enabled Cargo Thefts in 2025
In 2025, the FBI reported a 60% increase in cyber-enabled cargo thefts across the U.S. and Canada, totaling nearly $725 million in losses. Threat actors infiltrated freight brokers and carriers through phishing emails and fake web links, gaining unauthorized access to systems. They then posted fraudulent listings on online load boards, impersonated legitimate companies, and diverted high-value shipments for resale. The Diesel Vortex group, active since September 2025, targeted freight and logistics operators in the U.S. and Europe, compromising numerous platforms and stealing credentials. This surge underscores the evolving tactics of cybercriminals who exploit digital vulnerabilities to execute physical thefts. The transportation and logistics sectors must enhance cybersecurity measures to protect against such sophisticated attacks.
2 months ago
Kill Chain
Lawmakers Propose Tougher Penalties for Hospital Ransomware Attacks
In April 2026, during a House Homeland Security Committee hearing, lawmakers discussed intensifying penalties for ransomware attacks targeting hospitals. Proposals included classifying such attacks as acts of terrorism and pursuing homicide charges when patient deaths result. These discussions were prompted by a significant rise in healthcare ransomware incidents, which doubled from 238 in 2024 to 460 in 2025, making the healthcare sector the most targeted industry. The hearing highlighted the severe operational disruptions and potential loss of life caused by these cyberattacks, emphasizing the need for stronger deterrents and legal frameworks to address the escalating threat. This incident underscores the growing urgency to enhance cybersecurity measures within the healthcare sector. The increasing frequency and severity of ransomware attacks necessitate immediate action to protect critical infrastructure and patient safety. Legislative initiatives aiming to reclassify these cybercrimes reflect a broader recognition of their potential to cause significant harm, signaling a shift towards more aggressive legal responses to deter future attacks.
3 months ago
Kill Chain
Germany Unmasks Leader of REvil and GandCrab Ransomware Groups
In April 2026, German authorities identified 31-year-old Russian national Daniil Maksimovich Shchukin as 'UNKN,' the alleged leader of the notorious ransomware groups GandCrab and REvil. Between 2019 and 2021, Shchukin and his associate, 43-year-old Anatoly Sergeevitsch Kravchuk, reportedly executed at least 130 cyberattacks in Germany, extorting nearly €2 million and causing over €35 million in economic damages. These groups pioneered the double extortion tactic, demanding ransom for decrypting systems and additional payment to prevent data leaks. This revelation underscores the persistent threat posed by sophisticated ransomware operations and highlights the importance of international collaboration in combating cybercrime. Organizations must remain vigilant, as the identification of such key figures does not eliminate the risk of future attacks employing similar tactics.
3 months ago
Kill Chain
Cybercriminals Exploit Vacant Homes to Intercept Mail and Commit Fraud
In April 2026, cybersecurity analysts uncovered a sophisticated fraud scheme where adversaries exploit vacant residential properties to intercept sensitive mail, facilitating identity theft and financial fraud. Attackers identify unoccupied homes through real estate listings, register for postal services like Informed Delivery to monitor incoming mail, and use change-of-address requests to redirect mail to addresses under their control. This method combines open-source intelligence, legitimate postal services, and fake identities to gain persistent access to victims' correspondence. This incident highlights a growing trend where cybercriminals blend digital tactics with physical-world manipulation, exploiting legitimate services to bypass traditional cybersecurity defenses. The rise in such hybrid cybercrime underscores the need for enhanced vigilance and cross-domain monitoring to detect and prevent these evolving threats.
3 months ago
Kill Chain
Cognizant TriZetto 2024 Data Breach: A Wake-Up Call for Healthcare Cybersecurity
In November 2024, TriZetto Provider Solutions, a subsidiary of Cognizant, experienced a significant data breach that went undetected until October 2, 2025. During this period, unauthorized actors accessed sensitive information of over 3.4 million individuals, including names, addresses, dates of birth, Social Security numbers, and health insurance details. The breach was identified when suspicious activity was detected on a web portal used by healthcare providers to verify patient insurance eligibility. ([techcrunch.com](https://techcrunch.com/2026/03/06/trizetto-confirms-3-4m-peoples-health-and-personal-data-was-stolen-during-breach/?utm_source=openai)) This incident underscores the critical need for robust cybersecurity measures and timely detection mechanisms within the healthcare sector. The prolonged undetected access highlights vulnerabilities that can lead to substantial data exposure, emphasizing the importance of continuous monitoring and rapid response strategies to protect sensitive patient information.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports