Insurance companies have a significant but often overlooked role in the modern data economy. While they rarely attract the same attention as hospitals or social media platforms, insurers routinely hold more complete personal profiles on individuals than almost any other industry—a reality underscored by incidents like the April 2025 Sentinel Security Life Insurance data breach. By centralizing identity, financial, and health information in one place, insurers become especially attractive targets for cybercriminals, and a single security lapse can expose thousands of people at once.
Unlike most businesses, insurance companies hold onto many types of confidential information. Each insurance policy has identifying information (panels of social security numbers, dates of birth, etc.) and payment information (what premiums and claims a person pays, their ability to pay) and health-related information (the extent to which the individual is physically and mentally fit) that are used to assess an individual’s risk and thus the corresponding coverage. Individually, these categories have some value, but together these various categories create a digital identity that is much more challenging for an individual to replace or hide than any evidence of other businesses.
One of the reasons that insurance data is often targeted by cybercriminals is because the damage caused by a cyber breach often goes on for a long time. A victim can cancel their credit card to avoid future credit card fraud, and change their account login to protect themselves, but either way they will still be able to access their accounts and pay their bills. Medical records, government-issued identification, and insurance accounts can never be changed. As a result, if your insurance information has been compromised, you will have to keep an eye on it indefinitely and may have to deal with the consequences. In many cases, the cost to individuals and organizations from security breaches in the insurance industry is high, because the length of time during which the information is available for use may be many years.
The reality of regulatory and operational requirements creates additional exposure. Regulations mandate that insurers maintain records for many years (sometimes as long as 30 years) after a policy's expiration. This accumulation of data results in huge amounts of data stored on outdated systems in large production archives. These environments present increased difficulty when it comes to monitoring, tend to be more expensive to upgrade and do not have the multiple layers of protection that are part of today's risk landscape.
Another significant area of risk for insurers is the complexity of operations. Insurance companies frequently utilize multiple sources of distribution such as agencies, vendors, providers and third party administrators, in order to manage claims processing, communication with customers, analytics and regulatory reporting. Each time a third-party provider connects to an insurer's infrastructure, this increases an insurer's attack surface area. Even when an insurer's core system is secure, the external pathway to core systems may create an unintentional vulnerability that will be difficult for an insurer to detect on an ongoing basis.
Cyber criminals have identified that the complexity of insurance operations leads to greater likelihood of success. The data available through insurance policies are valuable beyond fraudulently acquiring money. Stolen data may be utilized to facilitate long term exploitation of victims, to establish multiple fake accounts, to submit fraudulent medical claims, to facilitate an email phishing scheme, or could be combined with data obtained from other sources to create very accurate identity profiles of individuals. In the underground economy, the value of insurance related data is often significantly greater than other types of personal and financial data, due to depth, accuracy, and reliability.
Another issue faced by insurers is the element of trust. Insurers have conditioned their customers to provide them with sensitive consumer data based upon their expectations that the information will be handled in a secure manner. If an insurer's security investments cannot remain ahead of the increased volume and sensitive nature of the data they possess, that same trust can also become a potential liability.
Furthermore, as an insurer continues to add new digital capabilities, especially through automation of the underwriting and claims process, they find themselves storing far more personal data now than ever before, while at the same time, security infrastructures have not been evolving at this same rate.
The lesson here is not merely limited to the insurance industry. Any organization that collects and holds sensitive identity, financial, and health-related information has an obligation to protect that information with the highest level of care. For the insurance industry in particular, stewardship not only means compliance with regulatory requirements, but stewardship also means understanding that the data will be stored and will represent the life history of a customer, as opposed to just being a transaction.
As the cyber threat landscape continues to change, insurance companies occupy a unique and important position as intermediaries between their customers and both their customers' privacy and security, and the general public trust. Thus, the effectiveness with which insurance companies can protect the private information of their clients will influence how much risk they incur in the future, and, equally, what level of confidence their customers will have in their services.
