INDUSTRY FACT FILE · INSURANCE

Threat Landscape: Top Cyber Threats Facing Insurers and Reinsurers

The 18 most relevant cyber threats, attacks and industry challenges for life, general and health insurers and reinsurers in India.

Insurers face a combination of data-driven threats (ransomware and theft of health and personal data), fraud (forged claims and payout diversion) and scams that misuse insurers' brands to defraud policyholders. Reports based on I4C data put cyber-fraud losses across all channels at about ₹19,813 crore in 2025.

IRDAI's 2026 guidelines respond with quarterly governance, independent audits, six-monthly external testing and 6-hour incident reporting.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by insurance segment (Codec Networks assessment).

4.1 Ransomware and health data

Health insurers and their TPAs hold large volumes of medical data and run time-critical cashless claims. Ransomware groups target them for both disruption and extortion.

• Questions to test: Are claims and medical data segmented? Are backups isolated and restorable? Has BCP/DR been tested against a ransomware scenario as IRDAI's 2026 guidelines expect?
• Relevant services: managed SOC, ransomware simulation, segmentation and backup testing, BCP/DR drills, incident response.

4.2 Claims fraud with cyber elements

Organised claims fraud increasingly combines forged digital documents, manipulated bills and help from insiders at hospitals, garages or TPAs.

• Questions to test: Are documents checked for tampering? Are claimants, providers and bank accounts linked analytically? Is partner and insider access monitored?
• Relevant services: claims-fraud analytics, document-forensics checks, insider monitoring, forensic audits.

4.3 Policyholder scams and payout diversion

Fake helplines and 'KYC update' messages trick policyholders into revealing credentials or paying fees; fraudsters then change payout details and redirect surrenders or refunds.

• Questions to test: Are payout-detail changes subject to cooling periods and alerts? Are surrenders verified? Is the brand monitored for fake helplines and sites?
• Relevant services: payout-flow testing, brand monitoring and takedown, policyholder awareness.

4.4 Partners, TPAs and vendors

Brokers, banks, aggregators, TPAs and IT vendors connect to insurers' systems. IRDAI's 2026 guidelines require right-to-audit and sub-outsourcing approval in vendor contracts and supervised privileged access.

• Questions to test: Which partners have access to policyholder data? Are their APIs and portals tested? Do contracts include the required clauses?
• Relevant services: third-party risk management, partner API testing, contract review.

4.5 Detection and the 6-hour clock

The 2026 guidelines require incidents to be reported to CERT-In within six hours of detection, with copies to IRDAI—only achievable with continuous monitoring and rehearsed playbooks.

• Questions to test: Are all critical systems feeding the SOC? Is there a tested escalation path to CERT-In and IRDAI reporting?
• Relevant services: managed SOC, playbooks, tabletop exercises, IR retainer.

• CERT-In and IRDAI: incidents reported to CERT-In within six hours of detection, with copies to IRDAI and other relevant regulators.
• Audit: incidents and remediation are examined in the annual independent audit, whose report goes to IRDAI.
• Governance: the ISRMC reviews incidents and exceptions at least quarterly.
• Privacy: once DPDP breach provisions commence in May 2027, personal data breaches must be intimated to the Data Protection Board, with a detailed report within 72 hours.
• Partners: reinsurers, banks and corporate clients may review the insurer's controls after an incident.

• Are we fully aligned to IRDAI's 2026 guidelines, and when is our next independent audit?
• Has external PT been performed in the last six months by an empanelled auditor?
• Could we report an incident to CERT-In and IRDAI within six hours?
• Which TPAs, hospitals and partners hold our policyholders' data, and when were they assessed?
• Would we stop a fraudulent payout-detail change before a surrender is paid?
• Has BCP/DR been tested against a realistic ransomware scenario this year?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific insurer. IRDAI requirements are summarised from reported sources; confirm against the official circular. I4C figures cover all channels.