Identity for Insurance

The job identity does in insurance

Insurance combines a regulated-data governance problem with a consumer and intermediary identity problem. Carriers verify customers, onboard agents, brokers and third-party administrators (TPAs), prevent application and claims fraud, and prove to regulators that access to health, financial and identity data is controlled and audited. The intermediary network and outsourced service providers are a distinctive, often under-governed part of the attack surface.

Insurance accounts for 3 of the 123 incidents in the Identity Breach Database (2.4%): Medibank in 2022, then Aflac and Allianz Life within five weeks of each other in 2025. The two that report a count reached about 32.35 million people between them. In all 3 the failed control was authentication, and all 3 abused a human account.

The identity threat picture, from the incident record

A contractor's saved password on a VPN without MFA. An IT service desk operator at a Medibank contractor had saved his Medibank usernames and passwords in a browser profile on his personal computer. The OAIC alleges an attacker used those credentials to log into Medibank's GlobalProtect VPN, which did not require MFA, and took data on about 9.7 million current and former customers, later published on the dark web. The consequences show how long an identity failure stays on the books: Medibank reported A$46.4 million and A$39.8 million of non-recurring cybercrime costs in FY23 and FY24, APRA applied a A$250 million capital adequacy adjustment from 1 July 2023, Australia, the US and the UK sanctioned the attacker in January 2024, and the OAIC began civil penalty proceedings in June 2024.

Social engineering in a campaign against the sector. Aflac's 8-K said it found unauthorized access on 12 June 2025 and contained it within hours, without ransomware, and attributed it to a cybercrime group running a campaign against the insurance industry; press reports of its statement said the intruders used social engineering. In December 2025 Aflac said about 22.65 million people were involved, with Social Security numbers and health information among the data. A month later, Allianz Life said a threat actor used social engineering on 16 July 2025 to take personal data from a third-party, cloud-based CRM, affecting the majority of its roughly 1.4 million US customers. The CRM pattern matches the cross-industry UNC6040 Salesforce vishing campaign, though Allianz Life did not name its CRM vendor or the attacker.

MFA status. MFA was absent on the abused account at Medibank and unknown in the other 2. Neither 2025 record carries a regulatory outcome yet; Medibank's arrived over the following two years.

The regulatory floor

• US: GLBA makes state insurance regulators responsible for enforcing and implementing safeguarding standards for insurers (15 U.S.C. 6805; the FTC's GLBA Safeguards Rule, with its MFA requirement, covers non-bank institutions outside their reach and is a useful benchmark), and the NAIC Insurance Data Security Model Law sets state-level security program and breach notice requirements. Carriers licensed in New York fall under NYDFS Part 500: MFA for every user since 1 November 2025, annual access reviews, privileged account limits, a PAM solution for Class A companies, and an annual compliance certification due next on 15 April 2027. Health plans are covered entities under HIPAA; see identity controls for HIPAA.
• California: CCPA/CPRA cybersecurity audits, which assess MFA, access controls and privileged accounts, are first due 1 April 2028 for businesses over $100 million in revenue.
• EU: insurers are financial entities under DORA, with strong authentication, least privilege and privileged access monitoring as explicit duties and the next register of information on ICT third parties due 31 March 2027. See identity controls for DORA. Under the EU AI Act, high-risk Annex III obligations, covering AI used for risk assessment and pricing of natural persons in life and health insurance as well as remote biometric identification, apply from 2 December 2027.
• Australia: APRA CPS 234 binds general, life and private health insurers, including control of information assets managed by third parties, and the Privacy Act 1988 underpins the OAIC's Medibank action.

The identity controls that matter most

1. MFA on every remote access login, with no exceptions for contractors. Medibank's VPN accepted a password alone. Enforce MFA at the VPN or replace it with ZTNA that checks identity and device on every session. See MFA rollout.
2. Managed devices only for privileged and contractor access. Credentials synced into a personal browser are one infostealer away from exposure. Require managed, compliant devices through conditional access and use a password manager or vault for anything privileged.
3. Phishing-resistant MFA and verified resets for staff, agents and service desks. The 2025 campaign worked by talking people out of access. Phishing-resistant MFA removes codes a caller can ask for, and reset verification should not be satisfiable with personal details. See vishing.
4. CRM and SaaS tenants governed like core systems. Restrict which connected apps can authorize, alert on bulk exports, and review who can query customer records. See consent phishing and OAuth consent phishing.
5. Time-bound, certified access for brokers, TPAs and contractors. Access certification, segregation of duties and just-in-time access keep intermediary access from drifting. See the identity governance program guide.
6. Verification and fraud signals at onboarding and claims. Identity verification with liveness, plus device and behavioral signals, counters synthetic identities and deepfake-driven claims fraud.

Vendor categories and named vendors

• Customer and agent identity: Ping Identity for enterprise federation of agents and brokers, Auth0 for policyholder portals. See best CIAM for enterprises.
• Verification and fraud: Persona and Socure at onboarding and claims.
• Governance: SailPoint or Saviynt for certification and segregation of duties; see best compliant IGA platforms.
• Phishing-resistant MFA and recovery: HYPR or Yubico; see best phishing-resistant MFA.
• Privileged and contractor access: CyberArk (Idira) for vaulting and session recording, and zero trust access such as Zscaler in place of exposed VPNs.
• SaaS and CRM security: Obsidian Security for connected-app and export monitoring.

Background on requirements is in identity for insurance.

Common pitfalls

• VPN or remote access exceptions for contractors and service desk staff.
• Treating the CRM as a sales tool rather than a store of regulated customer data.
• Broker and TPA access granted broadly and never reviewed.
• Treating fraud and verification as separate from CIAM, so signals are missing at decision time.

Where it is heading

NYDFS universal MFA and DORA push insurers toward enforced baselines for authentication and third-party access, the AI Act brings biometric and pricing systems under high-risk rules from December 2027, and the 2025 campaign makes help desk and CRM identity a sector-wide priority.

Frequently asked questions

How was Medibank breached?

According to the OAIC, an attacker used Medibank credentials that a contractor's IT service desk operator had saved in a personal browser, and logged into a VPN that did not require MFA. Data on about 9.7 million people was taken.

What happened to insurers in 2025?

Aflac and Allianz Life both disclosed social engineering intrusions within five weeks of each other. Aflac described a cybercrime campaign against the insurance industry; Allianz Life's data came from a third-party cloud CRM.

Does NYDFS Part 500 require MFA for insurers?

Yes, for DFS-licensed insurers. Section 500.12 has required MFA for any individual accessing the covered entity's information systems since 1 November 2025, unless the CISO approves an equivalent control in writing.