Two of the largest U.S.-based insurance providers — Farmers Insurance and Aflac Inc. — recently confirmed significant cyber incidents involving data exfiltration. Farmers disclosed that a May attack on a third-party vendor compromised the information of more than 1.1 million individuals. Around the same time, Aflac reported a HIPAA breach tied to a sophisticated cybercrime campaign, with investigations still underway. 

These events are part of a broader trend: attackers are moving fast to exploit weak links across the insurance sector. For insurers that hold vast amounts of sensitive personal and health data, the stakes are high — regulatory scrutiny, reputational damage, and financial risk. 

So what can other insurance companies learn from these breaches? And more importantly, how can they get ahead of similar attacks? 

What the Breaches Reveal About Insurance Sector Risks 

• Third-Party Vendors as Attack Vectors
  Farmers’ breach was traced to a third-party vendor database. Even when your own systems are sound, vendors can open doors attackers are quick to find. 

• Coordinated Campaigns Across the Sector
  Aflac disclosed that it was part of a targeted campaign against insurers, echoing incidents at Erie Insurance and Philadelphia Insurance Companies’ Tokio Marine America unit during the same timeframe. 

• Data Exfiltration Over Ransomware
  These attacks didn’t shut down systems — they quietly extracted data. That trend is growing, as cybercriminals find data theft more profitable and harder to trace than disruptive ransomware. 

• Regulatory & Compliance Fallout
  Both insurers were required to file with regulators, triggering HIPAA and state-level reporting obligations. For insurers, a breach doesn’t just impact operations — it creates a compliance firestorm. 

Why Insurance Companies Are High-Value Targets 

• Sensitive Policyholder Data: Names, addresses, dates of birth, Social Security fragments, and health information are gold mines for identity theft and fraud. 

• Complex Vendor Ecosystems: Multiple third-party platforms, from CRMs to health data processors, expand the attack surface. 

• Critical Services: Insurance is central to healthcare, property, and financial stability — disruptions ripple widely. 

Insurers can’t afford to view cybersecurity as just IT hygiene. It’s a strategic risk to operations, compliance, and customer trust. 

Best Practices to Stay Ahead of Breaches 

The Farmers and Aflac breaches underscore what insurers must do to strengthen defenses: 

1. Elevate Vendor Risk Oversight
   Conduct regular Vendor Risk Management reviews. Don’t rely on questionnaires — test how vendors actually secure data and monitor their environments. 

1. Test Defenses Before Attackers Do
   Regular Penetration Testing simulates real-world data exfiltration scenarios. Insurance-specific red teaming can reveal how attackers could move through vendor or identity systems. 

1. Prioritize Risk, Not Noise
   Alert fatigue is a constant challenge. Vulnerability Risk Management connects exposures to business impact, helping insurers fix what truly reduces breach likelihood. 

1. Strengthen Compliance Without Treating It as the Finish Line
   Meeting HIPAA or state requirements is essential — but compliance alone isn’t security. Our Regulatory Compliance services help insurers demonstrate adherence and build resilience beyond the audit. 

1. Embed Cybersecurity at the Leadership Level
   Cyber risk is not just an IT issue — it belongs in the boardroom. Our vCISO Services give insurers executive-level guidance to align cyber investments with business strategy. 

How Carson & SAINT Helps Insurers Reduce Risk 

Carson & SAINT has been securing critical industries since 1998. For insurers, our expertise includes: 

• Third-Party Risk Assessments that uncover hidden vendor exposures. 

• Penetration Testing tailored to data exfiltration and social engineering scenarios. 

• SAINT VRM to cut through alert noise and focus on risks that matter most. 

• Compliance & vCISO support to align security with both regulations and long-term resilience. 

We don’t just help insurers pass audits — we help them protect policyholder trust, safeguard operations, and stay ahead of evolving threats. 

Don’t Wait 

The Farmers and Aflac breaches are another reminder: your risk doesn’t stop at your perimeter. Vendor ecosystems, legacy systems, and compliance obligations all expand your exposure. 

Don’t wait until attackers find the gaps. Let’s review your exposure and strengthen your defenses before your name makes the breach reports. 

Contact us today to schedule an introductory call.