Date: Dec 10, 2024
By: Adam Sewall
Insurance companies are in a unique position being responsible to protect PII/PHI/PCI and much, much more. In the news this week are both Geico and Travelers who have been fined a combined total of $11.3 million by the state of NY.
Fines, include a $9.75M settlement with Geico and a $1.55M settlement with Travelers, the result of data breaches impacting over 120,000 New York residents. In both cases, it was determined that lapses in the organizations’ cybersecurity postures contributed to the loss of the stolen data.
This is a clear example of how cybersecurity lapses can lead to real-world consequences for both organizations and the individuals whose data they are entrusted to protect. In both cases attackers exploited known weaknesses — with a lack of Multi-Factor Authentication (MFA) and vulnerabilities in quoting tools these resulted in breaches that could have been mitigated with relatively standard security measures.
So for larger and smaller insurance companies not only does this hit them in the pocketbook but it is certainly preventable. With the advent of more advanced AI tools for attackers, finding these vulnerabilities is easier and attacks are then focused on these exploits.
These are examples of a broader challenge many companies are facing: how to stay ahead of advanced and basic cyber threats while balancing operational and financial priorities. Clearly, the stakes are simply too high to treat cybersecurity as an afterthought. Regulatory/Compliance penalties such as these further emphasize the importance of proactive measures — not only for compliance with laws but safeguarding trust and meeting ethical obligations of managing sensitive data. Enterprise must regularly audit their data to ensure compliance, minimize unnecessary data retention to reduce the risk of exposure.
Core practices such as password management, MFA, encrypting data and deploying a threat detection system are critical. Routine patch management, frequent security audits and ongoing employee training further reduce vulnerabilities. Organizations handling sensitive information need to consider adopting a zero-trust framework and Privileged Access Management (PAM). These strategies can mitigate breaches and prevent unauthorized lateral movement within networks, enhancing overall security posture.
Putting Defense-in-Depth (DiD) is a known method of mitigating such risks. But this can be expensive and complicated – Blatant plug here – Cyberleaf delivers this at a fraction of the cost and with considerable capabilities, often well beyond what is feasible even for large enterprise like Geico and Travelers.
Follow Cyberleaf on LinkedIn and contact us for more information on how to mitigate cyber threats and meet compliance obligations.
