✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Insurance
Breach intelligence, attack campaigns, and threat reports targeting the Insurance sector.
Explore Other Sectors
Insurance Threat Reports
Deepfake Injection Attacks: A Growing Threat to Identity Verification in 2025
In 2025, the financial sector faced a significant surge in deepfake and injection attacks targeting identity verification processes. Fraudsters utilized AI-generated media to impersonate individuals during onboarding and authentication, leading to unauthorized access and substantial financial losses. Notably, a multinational firm in Singapore was nearly defrauded of $500,000 when attackers used deepfake video avatars to impersonate company executives during a Zoom call. ([regulaforensics.com](https://regulaforensics.com/blog/identity-verification-incidents-2025/?utm_source=openai)) This incident underscores the escalating threat posed by deepfake technologies in compromising identity verification systems. The increasing sophistication and accessibility of AI tools have enabled attackers to bypass traditional security measures, highlighting the urgent need for enhanced detection and prevention strategies.
4 months ago
Kill Chain
Recorded Future and CYBERA Join Forces to Tackle Escalating Money Mule Fraud
In February 2026, Recorded Future announced an expansion of its payment fraud prevention capabilities through a partnership with CYBERA, a leader in detecting and verifying data on scam-linked bank accounts. This collaboration introduces Money Mule Intelligence, a tool designed to help fraud teams identify accounts used by criminals to extract and move stolen funds. The initiative addresses the escalating threat of Authorized Push Payment (APP) fraud, which is projected to reach nearly $15 billion in the U.S. by 2028, up from $8.3 billion in 2024. The rise in APP fraud is driven by factors such as AI-generated deepfakes, personalized scam scripts, and instant payment systems that outpace traditional fraud controls. Money mule accounts serve as critical infrastructure for these scams, enabling the conversion of stolen payments into untraceable cash or cryptocurrency. The sophistication of mule operations has increased, with criminals employing 'mule herders' who manage numerous accounts and use AI to simulate normal transaction behavior, making detection challenging. Regulators are responding by shifting liability to banks, emphasizing the need for proactive detection and disruption of mule accounts to prevent fraud and comply with emerging reimbursement requirements.
5 months ago
Kill Chain
Understanding TOAD Attacks: Bypassing Email Security Through Social Engineering
In early 2025, cybercriminals escalated the use of Telephone-Oriented Attack Delivery (TOAD) techniques to bypass traditional email security measures. These attacks involve sending emails that appear to be from legitimate services, such as Microsoft Entra, Zoom, or Hulu+, containing fake invoices or alerts with a phone number for recipients to call. Upon calling, victims are connected to fraudulent call centers where they are manipulated into downloading remote access software, granting attackers control over their systems. This method effectively circumvents email filters by excluding malicious links or attachments, relying instead on social engineering tactics to exploit human trust. ([cybernews.com](https://cybernews.com/security/new-toad-phishing-campaign-targets-microsoft-entra-invitees-with-fake-invoices/?utm_source=openai)) The prevalence of TOAD attacks underscores a significant shift in phishing strategies, emphasizing the need for organizations to enhance their security awareness training and adopt multi-layered defense mechanisms. As these attacks exploit trusted communication channels and human psychology, traditional technical defenses alone are insufficient, highlighting the urgency for comprehensive security approaches that address both technological and human factors. ([phishcloud.com](https://phishcloud.com/toad-phishing-attack-prevention/?utm_source=openai))
5 months ago
Kill Chain
UAC-0050's Expansion: European Financial Institution Targeted with RMS Malware
In February 2026, the Russia-aligned threat actor UAC-0050, also known as Mercenary Akula, targeted a European financial institution involved in regional development and reconstruction initiatives. The attack began with a spear-phishing email that spoofed a Ukrainian judicial domain, directing the recipient—a senior legal and policy advisor—to download a malicious archive file. This file initiated a multi-layered infection chain, ultimately deploying the Remote Manipulator System (RMS), a legitimate remote desktop software, granting the attackers persistent and stealthy access to the victim's system. This incident underscores a significant shift in UAC-0050's operations, expanding their focus beyond Ukraine to entities supporting the nation. The use of legitimate remote access tools like RMS highlights the evolving tactics of threat actors to evade detection. Organizations, especially those involved in sensitive geopolitical areas, must remain vigilant against such sophisticated social engineering attacks.
5 months ago
Kill Chain
CEO Deepfake Scam 2019: A Wake-Up Call for Corporate Security
In March 2019, a UK-based energy firm's CEO was deceived by a deepfake audio impersonation of his German parent company's chief executive. The fraudster, using AI-generated voice technology, instructed the CEO to transfer €220,000 (approximately $243,000) to a Hungarian supplier's account. Believing the request was legitimate, the CEO complied. Subsequent attempts for additional transfers raised suspicions, leading to the discovery of the scam. The initial funds were moved from Hungary to Mexico and then dispersed to other locations, making recovery challenging. ([forbes.com](https://www.forbes.com/sites/jessedamiani/2019/09/03/a-voice-deepfake-was-used-to-scam-a-ceo-out-of-243000/?utm_source=openai)) This incident underscores the escalating threat of AI-driven deepfake technologies in corporate fraud. As these tools become more sophisticated and accessible, organizations face increased risks of impersonation attacks targeting financial transactions and sensitive information. The event highlights the urgent need for enhanced security measures and employee training to detect and prevent such advanced social engineering tactics.
5 months ago
Kill Chain
Security Flaws in Android Mental Health Apps Put Millions at Risk
In February 2026, security researchers identified significant vulnerabilities in several Android mental health applications, collectively downloaded over 14.7 million times from Google Play. These apps, designed to assist users with conditions such as depression and anxiety, were found to contain a total of 1,575 security flaws, including 54 high-severity and 538 medium-severity issues. Exploiting these vulnerabilities could allow attackers to intercept sensitive user data, including therapy session transcripts and personal health information, thereby compromising user privacy and confidentiality. This incident underscores the critical need for rigorous security measures in applications handling sensitive health data. The discovery highlights the potential risks associated with inadequate app security, emphasizing the importance of regular security assessments and compliance with data protection regulations to safeguard user information.
5 months ago
Kill Chain
PayPal's 2025 Data Breach: A Cautionary Tale in Financial Data Security
In 2025, PayPal experienced a significant data breach due to a code change in its Working Capital application, which inadvertently exposed sensitive customer information, including Social Security numbers and dates of birth, for nearly six months. The breach was discovered on December 12, 2025, but had been active since July 1, 2025. Approximately 100 customers were affected by this incident. ([cybernews.com](https://cybernews.com/security/paypal-six-month-breach-ssn-working-capital-app/?utm_source=openai)) This incident underscores the critical importance of rigorous code review processes and robust access controls in financial applications. The prolonged exposure period highlights the necessity for continuous monitoring and rapid response mechanisms to detect and mitigate unauthorized access to sensitive data.
5 months ago
Kill Chain
Change Healthcare's 2024 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
In February 2024, Change Healthcare, a subsidiary of UnitedHealth Group, suffered a significant ransomware attack orchestrated by the Russian group ALPHV (BlackCat). The attackers exploited a server lacking multifactor authentication, gaining unauthorized access and encrypting critical systems. This breach disrupted essential healthcare operations nationwide, including insurance eligibility verification, prescription processing, and claims management, affecting approximately 190 million individuals. The incident underscored the vulnerabilities in third-party service providers within the healthcare sector, prompting the Department of Health and Human Services to intensify efforts in identifying and mitigating such risks. The attack's magnitude and impact have led to increased regulatory scrutiny and a reevaluation of cybersecurity practices across the industry.
5 months ago
Kill Chain
Operation DoppelBrand: Unveiling GS7's Credential Harvesting Tactics
Between December 2025 and January 2026, the GS7 cyberthreat group executed Operation DoppelBrand, a sophisticated phishing campaign targeting Fortune 500 companies, primarily in the financial sector. By creating near-identical replicas of corporate login portals, GS7 successfully harvested employee credentials, enabling unauthorized remote access to sensitive systems. The group registered over 150 malicious domains, utilizing services like NameCheap and Cloudflare to obscure their infrastructure, and exfiltrated stolen data via Telegram bots. This campaign underscores the evolving tactics of cybercriminals in credential harvesting and the critical need for robust cybersecurity measures. The incident highlights the increasing prevalence of brand impersonation in phishing attacks, emphasizing the necessity for organizations to implement advanced detection mechanisms and employee training to mitigate such threats.
5 months ago
Kill Chain
Europol Arrests 34 Black Axe Members in Massive 2026 Organized Cyber-Fraud Takedown
In January 2026, Europol and Spanish authorities arrested 34 suspected members of the Black Axe organized crime syndicate in Spain, dismantling a major transnational cyber-fraud operation. The group, originating from Nigeria but operating internationally, orchestrated a series of sophisticated cyber-enabled crimes, including business email compromise, romance and inheritance scams, credit card and tax fraud, and extensive money laundering. Law enforcement seized over €185,000 ($216,000) in assets and disrupted fraud estimated at more than €5.9 million ($6.9M), highlighting Black Axe's role in global financial crime and cyber-enabled offenses. This incident underscores the growing intersection of traditional organized crime with advanced cyber-fraud tactics, as law enforcement faces increasingly complex, multi-jurisdictional threats. The reliance on cyber-enabled fraud techniques by such syndicates reflects an urgent need for organizations to adapt their security posture to address sophisticated, persistent, and highly organized threats.
6 months ago
Kill Chain
Illinois DHS Exposes 700,000+ Residents in Years-long Data Misconfiguration
In September 2025, the Illinois Department of Human Services (IDHS) discovered a data exposure incident affecting nearly 700,000 residents, when maps containing sensitive information were found to be publicly accessible due to misconfigured privacy settings on a mapping website. The breach, which lasted for several years, involved the exposure of addresses, case numbers, demographic details, and medical assistance plan information for Medicaid and Medicare recipients (without names), as well as additional data including names for a smaller group of rehabilitation services clients. Upon discovery, IDHS promptly secured the exposed maps, reviewed affected materials, and implemented safeguards to prevent recurrence. This incident highlights the persistent risk of misconfiguration-based data exposures in public sector organizations, especially with increasing reliance on digital tools for data visualization and resource management. As regulatory scrutiny and public concern over privacy intensify, organizations must prioritize robust controls over platforms managing sensitive information.
6 months ago
Kill Chain
Ransomware at Sedgwick Government Solutions: What the 2026 TridentLocker Breach Reveals
In January 2026, Sedgwick confirmed a security incident at its subsidiary, Sedgwick Government Solutions, a contractor serving over 20 U.S. federal agencies including CISA, DHS, and the U.S. Coast Guard. The breach was perpetrated by the TridentLocker ransomware group, which claimed to have stolen 3.39 GB of sensitive documents and subsequently leaked data on its Tor site. The attackers gained access via an isolated file transfer system; however, Sedgwick asserts no evidence of compromise to core claims servers or operational disruption. External cybersecurity experts and law enforcement were immediately engaged, and affected systems were properly segmented from the wider parent company network. This incident highlights the increased targeting of government contractors by ransomware operators and underscores the importance of network segmentation, prompt incident response, and continuous monitoring. The breach reflects growing regulatory and client demands for transparent reporting and robust data protection as ransomware groups escalate their tactics.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports