Fifty-nine percent of breaches among the top 150 insurance companies involved third-party attack vectors, exposing critical vulnerabilities in the sector’s supply chain.

These findings, from research released by SecurityScorecard, underscore the systemic risks posed by cyber threats to an industry responsible for safeguarding sensitive financial and personal information.

The insurance industry’s interconnected network of carriers and reinsurers to brokers, claims processors, and specialised IT providers is essential for delivering services to hundreds of millions but also introduces significant cyber risks.

“Insurance companies’ reliance on technology to manage daily operations has outpaced their ability to secure it,” Andrew Correll, senior director of cyber insurability, said. “Cyber risks don’t stop at the first layer of defense — they extend deep into the supply chain, where vulnerabilities are harder to detect and even harder to mitigate. Addressing these risks requires a shift in how the industry prioritizes third-party security.”

Over a fourth (28%) of insurance companies reported breaches – this figure is higher than S&P 500 (21%) and double the breaches reported by the US energy industry (14%).

Of the breaches tracked, 59% involved third-party attack vectors, the highest rate observed so far and more than double the global cross-industry average of 29%. Third-party software and IT caused half of these breaches.

While this is a problem for all sectors, insurance carriers were disproportionately affected by third-party breaches. Although carriers made up about 27% of the total sample, they represented 50% of the companies hit by third-party incidents.

Besides third-party liabilities, more than half (56%) of companies had at least one compromised credential in the past two years, and malware infections and device compromises affected 17% of companies last year.

The lowest-scoring cyber risk factors for the sector are application security, DNS health and network security. DNS health rarely ranks among these factors.

Recommended reading

• 75% of Organisations Hit by Ransomware More Than Once
• Cyber-attacks on the Tech Supply Chain Spiked in 2024
• Over Half of Hacked UK Firms Pay Ransom

Recommendations

Based on this analysis, the SecurityScorecard STRIKE team offers actionable insights for the insurance sector to strengthen its supply chain.

Strengthening third-party risk management for insurance carriers is crucial, as carriers face elevated third-party risks due to dependencies on low-scoring industry segments, including IT vendors and brokers.

Paramount to this is ensuring that vendors have their own effective third party risks management programme, as fourth-party risks from vendors’ suppliers are critical but often missed. Ensuring vendors have this in place to close supply chain gaps and prevent breaches is essential.

Avoiding paying any ransomware demands is also vital, as payment often encourages attacks, risks legal issues, and does not ensure recovery.