DarkOwl Highlights Insurance Data Exposures, Ransomware Claims and Fraud Materials on the Dark Web
Summary
DarkOwl describes ransomware-related insurance data exposures, leaked customer and credential records, and dark-web offers of insurance documents that could support fraud. Some incidents and data origins are claims, not independently confirmed.
Key points
- DarkOwl says more than 100,000 documents linked to ransomware activity in its Vision platform contain the term “Insurance.”
- Ransomware groups have reportedly posted insurance-related documents from victims, including claimed insurance-claim details in data attributed to Go-Ahead Group.
- BlackBasta and Ransom House leak-site posts reportedly included data attributed to insurance-sector organizations; Ransom House claimed to have stolen 1.4 TB from Delaware Life Insurance Company.
- A Telegram post reportedly offered data purportedly from Farm Bureau Insurance–Tennessee, including customer contact, vehicle, and birth-date information.
- DarkOwl found nearly 700 records containing statefarm[.]com in a credential-stuffing dataset reportedly assembled from infostealer logs; it says the records may belong to employees.
- The article describes dark-web and Telegram offers of insurance documents that could be used for fraud, including purported car-insurance documents.
- Examples of exposed insurance-related information also appeared in a South African government tender-service leak at etenders[.]gov[.]za.
Article Details
- Event Type
- Reported ransomware-related data disclosures affecting organizations connected to insurance, alongside leaks of insurance-related information and offers to sell counterfeit insurance documents.
- Impact
- Reported disclosures exposed or purportedly exposed insurance claims, confidential documents, health records, pricing information, and personal and customer data. Ransom House claimed to have stolen 1.4 TB from Delaware Life Insurance Company. A credential-stuffing dataset reportedly contained nearly 700 records associated with statefarm.com, potentially exposing employee accounts. The article also describes dark-web and Telegram offers of insurance documents that could facilitate fraud.
Threat Actors
0megaNamed as a ransomware group that has published victim documents containing insurance information.BlackBastaRansomware group reported to have published information and data relating to insurance marketing firm LeClair.Cl0pRansomware group described as publishing victim data, including information about a university's use of an insurance company to negotiate.Dunghill LeakLeak group that published information and sample documents allegedly obtained from Go-Ahead Group.MedusaNamed as a ransomware group that has published victim documents containing insurance information.