How Darknet Data Can Inform Cyber Insurance Risk Assessments
Summary
The article explains cyber insurance coverage and industry roles, and describes how darknet exposure data can help insurers assess applicants, model risk and monitor policyholders. It cites ransomware-related incidents involving insurance organizations.
Key points
- Cyber policies may cover incident response, legal costs, extortion payments, customer notification, identity restoration and business interruption, subject to policy terms.
- First-party coverage addresses the policyholder’s own systems and data; third-party coverage addresses liability tied to exposed customer or vendor data.
- The article says underwriters increasingly request ransomware questionnaires and evidence of business continuity and incident response plans.
- Darknet exposure data—including exposed employee email addresses, infrastructure details, executive mentions and stolen data—may inform underwriting and ongoing risk monitoring.
- The article reports that Avaddon compromised an Axa Group division in Malaysia in 2021 and reportedly exfiltrated more than 3 TB of claims data and medical records.
- It also cites a REvil-linked claim targeting an Ohio insurance broker and a free Industrial Spy offer involving Indian third-party administrator MDINDIA.
Article Details
- Topic
- Cyber liability insurance and the use of darknet intelligence for underwriting and risk monitoring, including examples of insurance-related organizations targeted by ransomware actors.
Threat Actors
Countries
IndiaOne of the “free” offers on Industrial Spy includes a prominent Third-Party Administrator in India, MDINDIA.MalaysiaIn 2021, Avaddon compromised a division of the global insurance carrier, Axa Group in Malaysia and reportedly exfiltrated over 3TB of claims data and medical records of their policy holders.