✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Insurance
Breach intelligence, attack campaigns, and threat reports targeting the Insurance sector.
Explore Other Sectors
Insurance Threat Reports
Herodotus Trojan Outsmarts Android Defenses with Human-Like Behavior
In October 2025, cybersecurity researchers uncovered a new Android banking trojan, dubbed Herodotus, actively targeting financial institutions and users in Italy and Brazil. The malware stands out by performing sophisticated device takeover (DTO) attacks while mimicking genuine human behavior—specifically attempting to bypass behavioral biometrics and anti-fraud detection. Herodotus infects devices via malicious apps or phishing, granting attackers near-complete control, which they use to exfiltrate sensitive financial and authentication data by simulating legitimate user interaction. The Herodotus incident underscores a troubling advancement in mobile malware—attackers are increasingly leveraging techniques that closely imitate human behavior to elude cutting-edge security controls. This signals a growing risk for banking apps and enterprises relying on behavioral biometrics, and highlights the urgent need for multilayered zero trust strategies and improved east-west visibility in mobile ecosystems.
6 months ago
Kill Chain
Sotheby’s 2025 Data Breach: Employee Financial Data Compromised
In July 2025, Sotheby's, the renowned international auction house, identified a significant cybersecurity breach in which an unknown threat actor exfiltrated sensitive employee information, including full names, Social Security numbers, and financial account details. The breach was discovered on July 24, 2025, and an internal investigation with data protection experts and law enforcement extended over two months to confirm the nature and scope of compromised data. Sotheby’s responded by notifying impacted employees and offering a year of free identity protection and credit monitoring services. No ransomware group claimed responsibility, and the number of affected individuals remains undisclosed. This incident underscores ongoing risks facing financial and high-value service sectors, especially from sophisticated attacks targeting personnel data for monetization and fraud. Organizations with sensitive employee or client financial data must act promptly as regulatory scrutiny tightens and attacks on high-net-worth entities continue to escalate.
6 months ago
Kill Chain
Prosper 2024 Data Breach: What Happened and What's Next for Financial Data Security
In early 2024, Prosper, a leading US-based financial services platform, suffered a significant data breach that compromised the personal information of over 17.6 million users. Attackers reportedly exploited vulnerabilities in Prosper's online systems, gaining unauthorized access to names, addresses, dates of birth, phone numbers, and bank account details. The breach was confirmed after the stolen data appeared in cybercrime forums and data breach repositories, prompting Prosper to notify affected users and regulatory bodies. Although no evidence of financial fraud was immediately reported, the exposed data increases risks such as identity theft and targeted social engineering. This incident underscores the pressing need for robust data protection in the financial sector due to the continued targeting of financial institutions by cybercriminals. It highlights industry-wide challenges with sensitive data security and the growing regulatory focus on rapid breach disclosure and consumer protection.
6 months ago
Kill Chain
Storm-1175 Exploits GoAnywhere Zero-Day to Orchestrate Ransomware Attacks in 2024
In September 2024, Microsoft Threat Intelligence announced that Storm-1175, a financially motivated ransomware affiliate, exploited a critical zero-day vulnerability (CVE-2025-10035) in Fortra's GoAnywhere MFT file transfer solution. Attackers gained remote code execution, established persistence via remote monitoring tools and web shells, performed lateral movement using legitimate Windows utilities, and exfiltrated data with Rclone before deploying Medusa ransomware in targeted organizations. Impacted sectors included transportation, education, retail, insurance, and manufacturing. The initial compromises began on September 11, days before the vulnerability was publicly disclosed or patched, giving attackers a significant advantage and facilitating stealthy, high-impact breaches due to delayed vendor transparency. This incident highlights the escalating sophistication of ransomware operations leveraging zero-day exploits and legitimate IT tools to evade detection, resulting in substantial business disruption and data loss. Growing regulatory scrutiny and industry concern underscore the urgent need for rapid threat intelligence sharing, proactive zero trust measures, and improved vendor communication in light of similar recent attacks.
6 months ago
Kill Chain
Allianz Life Data Breach 2025: Cloud CRM Attack Exposes 1.5 Million
In July 2025, Allianz Life, a major American insurance provider, suffered a significant data breach after threat actors—suspected to be part of the ShinyHunters extortion group—gained unauthorized access to a third-party cloud-based CRM system. The breach exposed sensitive personal information including names, addresses, dates of birth, and Social Security numbers for nearly 1.5 million individuals, encompassing customers, financial professionals, and employees. The incident was publicly disclosed shortly after it occurred, with Allianz confirming that Allianz SE, its global parent company, was not impacted. In response, Allianz initiated notifications to affected parties and regulatory authorities and is offering two years of free identity theft monitoring. This incident highlights the persistent risks posed by supply chain and third-party service vulnerabilities, especially as attackers increasingly target trusted cloud-based platforms such as Salesforce. The breach underscores the necessity for vigilant monitoring, rigorous access controls, and enhanced segmentation within cloud ecosystems for all organizations handling sensitive data.
6 months ago
Kill Chain
Klopatra Android Banking Trojan Orchestrates VNC-Based Fraud in Spain and Italy
In August 2025, the Klopatra Android banking trojan was discovered by Cleafy, an Italian fraud prevention firm, after it compromised more than 3,000 smartphones—primarily in Spain and Italy. This sophisticated malware leveraged a hidden Virtual Network Computing (VNC) module that enabled threat actors to stealthily control infected devices remotely, bypassing traditional security measures and enabling real-time fraudulent activities. The attackers employed social engineering and malicious app delivery techniques to distribute the trojan, ultimately enabling the theft of sensitive banking credentials and direct manipulation of banking apps on compromised phones. The Klopatra campaign reflects the evolution of mobile threats in Europe, combining advanced remote access with banking-focused exfiltration. Its success underlines an urgent need for rigorous mobile device security as banking trojans rapidly adopt more covert control and anti-detection techniques.
6 months ago
Kill Chain
Interpol's 2024 Crackdown: $439 Million Seized from Global Cybercrime Networks
In 2024, Interpol coordinated a global operation targeting cybercrime rings responsible for large-scale financial crimes. Over a period of five months, law enforcement agencies from 61 countries worked together to investigate and disrupt online scams that included business email compromise (BEC), investment fraud, romance scams, and e-commerce fraud. The operation resulted in the seizure of more than $439 million in cash and cryptocurrency, exposing elaborate money laundering networks and identifying approximately 1,300 suspects linked to cyber-enabled financial crime groups. Thousands of victims worldwide were impacted by these schemes. This incident highlights the growing sophistication and international reach of financially motivated cybercrime, as well as the increasingly effective law enforcement collaborations to disrupt illicit networks. The operation reflects a heightened urgency for organizations to strengthen controls against online fraud and cyber-enabled theft, as attackers continually evolve their tactics.
6 months ago
Kill Chain
Synthetic Identity Fraud Surges: US Finance Faces $3.3B in Damages (2024)
In 2024, US financial institutions, particularly those in the automotive lending sector, experienced a significant surge in synthetic identity fraud, resulting in estimated damages of $3.3 billion. Cybercriminals leveraged data amassed from previous breaches to construct convincing synthetic profiles used to obtain loans and open accounts, often nurturing these fraudulent identities with legitimate activity to evade detection. Both individual and business identities were targeted, with institutions facing growing pressure to enhance detection capabilities amid an ongoing arms race with sophisticated attackers employing AI and cloud tools. This increase in synthetic identity fraud reflects an evolving threat landscape, where attackers capitalize on remote-first processes and richer data sources to outpace traditional defenses. The accelerating adoption of digital banking and lending has heightened urgency for adaptive, real-time security controls and improved identity verification as financial firms confront complex, persistent fraud schemes.
6 months ago
Kill Chain
Scattered Spider Returns: New Wave of Social Engineering Attacks on Financial Services
In late 2025, cybersecurity researchers at ReliaQuest linked a new wave of attacks in the financial services sector to the notorious cybercrime collective Scattered Spider, despite previous claims that the group had disbanded. These attacks featured advanced social engineering tactics, the registration of lookalike domains, and exploitation of internal access paths to facilitate credential compromise and lateral movement inside targeted organizations. Impact resulted in unauthorized access to sensitive financial data, disruption of key operations, and raised concerns about the sector’s preparedness for sophisticated, identity-driven threats. The re-emergence of Scattered Spider underscores a resurgence of high-profile, financially motivated cybercrime against critical industries. The campaign highlights the evolving threat landscape—where even 'retired' threat groups rapidly adapt their tactics—reinforcing the urgency of east-west security monitoring, identity protections, and robust zero trust strategies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports