INDUSTRY FACT FILE · INSURANCE INTERMEDIARIES

Five New Case Studies in Intermediary Security

Original 2026 case studies, each written as a blog post, showing how current threats play out for intermediaries and insurtechs under IRDAI's 2026 guidelines and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Quote API That Answered Everyone 3.  Case Study 2: The Broker's Premium Account Switch 4.  Case Study 3: The TPA Night Shift Ransomware 5.  Case Study 4: The POSP Logins Sold on Telegram 6.  Case Study 5: The Chatbot That Revealed Policy Details

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed among insurance intermediaries and digital platforms with the obligations that apply in India as of October 2026—in particular IRDAI's Information and Cyber Security Guidelines, 2026, CERT-In's Directions and the DPDP framework.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Intermediary type	Core threat	Regulatory lens	Primary bundles
1. The Quote API That Answered Everyone	Web aggregator	Broken API authorisation and mass data harvesting	IRDAI 2026; CERT-In; DPDP	B2, B7, B6
2. The Broker's Premium Account Switch	Insurance broker	Business email compromise and premium diversion	IRDAI 2026; CERT-In	B10, B7, B8
3. The TPA Night Shift Ransomware	Third-party administrator	Ransomware through an unpatched remote-access gateway	IRDAI 2026; CERT-In; DPDP	B1, B7, B8
4. The POSP Logins Sold on Telegram	Corporate agent with distributor network	Distributor credential theft and data misuse	IRDAI 2026; CERT-In; DPDP	B2, B7, B10
5. The Chatbot That Revealed Policy Details	Digital insurance platform	Prompt injection exposing customer data	IRDAI 2026; DPDP	B11, B2, B6

The login worked perfectly. The API never asked whose quote it was returning.

At a glance
Organisation	A web aggregator (“Platform A”) comparing motor and health insurance
Threat	An API returning any customer's quote history and profile by ID
Why it is new	API flaws are the most common cause of mass data exposure on insurance platforms
Codec Networks services	API security testing, SOC monitoring, data minimisation (Bundles B2, B7, B6)

The scenario

Platform A's mobile app fetched saved quotes through an API that accepted a sequential quote ID.

An attacker created an account, changed the ID and found the API returned other customers' names, phone numbers, vehicle details and health declarations.

Scripts harvested hundreds of thousands of records. Customers soon received targeted scam calls, and insurer partners paused integrations pending a review.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• No object-level authorisation on the quote API.
• Responses included full profiles instead of the minimum data.
• No rate limiting or enumeration alerts.
• APIs were not in the PT scope.

The impact

Platform A faced CERT-In reporting, insurer audits, customer complaints and DPDP exposure once breach provisions commence.

The regulatory lens

• IRDAI 2026 guidelines: six-monthly external PT by a CERT-In empanelled auditor; protection and classification of personal data.
• CERT-In Directions: data leaks reported within six hours.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the API	Object-level authorisation and enumeration testing	B2
Spot the harvest	SOC use cases for bulk and sequential access	B7
Return less	Data minimisation and classification review	B6

Key lessons Check ownership on every API call. Return only the data each screen needs. Alert on enumeration and bulk access. Include every API in the PT scope.

The letter came from the broker's real mailbox. The bank account was the attacker's.

At a glance
Organisation	An insurance broker (“Broker B”) placing group-health cover for corporate clients
Threat	A compromised finance mailbox used to send fraudulent bank-change instructions
Why it is new	Brokers handle large premiums and trusted client communications
Codec Networks services	BEC simulation, email security review, SOC monitoring, incident response (Bundles B10, B7, B8)

The scenario

An executive in Broker B's finance team entered credentials on a fake login page. The attacker set mailbox rules to hide replies and watched renewal correspondence.

Days before a large group-health renewal, the client received a genuine-looking letter from the broker's mailbox with 'updated bank details'.

The premium went to a mule account. The cover was at risk and the client disputed who should bear the loss.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No MFA on the finance mailbox.
• Mailbox rules were not monitored.
• Bank-detail changes were not verified by call-back.
• DMARC was not enforced on the broker's domains.

The impact

Broker B faced a financial dispute, an urgent placement problem, a forensic investigation and damage to a key client relationship.

The regulatory lens

• IRDAI 2026 guidelines: access control, security awareness and incident reporting obligations for intermediaries.
• CERT-In Directions: phishing and identity-theft incidents reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Prepare people	BEC simulation for finance and client teams	B10
Spot the takeover	SOC monitoring of mailbox rules and risky sign-ins	B7
Investigate fast	Forensics, containment and reporting support	B8

Key lessons Enforce MFA on every mailbox. Monitor mailbox rules and forwarding. Verify bank changes by call-back. Enforce DMARC on your domains.

One unpatched gateway stopped cashless approvals for several insurers at once.

At a glance
Organisation	A TPA (“TPA C”) processing health claims for several insurers
Threat	Ransomware entering through a known vulnerability in a remote-access gateway
Why it is new	TPA outages affect hospitals, patients and many insurers at the same time
Codec Networks services	External PT, managed SOC, backup and BCP/DR testing, incident response (Bundles B1, B7, B8, B10)

The scenario

A known vulnerability in TPA C's remote-access gateway remained unpatched for weeks.

Attackers entered, escalated privileges, disabled backups and exfiltrated claims data before encrypting servers overnight.

By morning, hospitals could not get cashless approvals. TPA C had to report to CERT-In within six hours and notify every insurer client.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Internet-facing systems were not tested or patched promptly.
• No 24x7 monitoring of claims servers.
• Backups were reachable from the compromised domain.
• No playbook covered notifying multiple insurers.

The impact

TPA C faced claims backlogs, insurer contract reviews, patient complaints and DPDP exposure once breach provisions commence.

The regulatory lens

• IRDAI 2026 guidelines: six-monthly external PT; encryption and classification of confidential data; vendor and cloud controls.
• CERT-In Directions: incidents reported within six hours; 180-day log retention.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Close the door	Six-monthly external PT and infrastructure VAPT	B1
Watch at night	24x7 SOC with EDR on claims servers	B7
Recover and report	IR retainer, backup testing and BCP/DR drills	B8, B10

Key lessons Patch internet-facing systems first. Monitor claims servers around the clock. Isolate and test backups. Plan notifications for every insurer.

The logins were real. The people using them were not.

At a glance
Organisation	A corporate agent (“Agent D”) with a large distributor and POSP network
Threat	Phished distributor credentials sold and used to download customer data
Why it is new	Distributor portals give many people access to customer data
Codec Networks services	Portal testing, SOC monitoring, brand monitoring and awareness (Bundles B2, B7, B10)

The scenario

Distributors received messages about a 'commission update' with a link to a fake portal. Hundreds entered their credentials.

The credentials were sold in criminal channels. Buyers logged in, downloaded customer lists and used them for mis-selling and scams.

Insurers received complaints from customers who had never dealt with the callers.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No MFA or device binding for distributor logins.
• Bulk downloads were not monitored.
• Inactive distributors kept access.
• Fake portals were not detected or taken down.

The impact

Agent D faced insurer complaints, customer harm, a data-protection review and reputational damage.

The regulatory lens

• IRDAI 2026 guidelines: access control and minimum security frameworks for distributors; incident reporting.
• CERT-In Directions: identity-theft and phishing incidents reported within six hours.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden the portal	Authentication and access control testing	B2
Spot misuse	SOC use cases on downloads and logins	B7
Fight phishing	Brand monitoring, takedown and distributor awareness	B10, B7

Key lessons Protect distributor logins with MFA. Monitor bulk downloads. Remove inactive distributors promptly. Take down fake portals quickly.

The assistant was helpful. Too helpful.

At a glance
Organisation	An insurtech platform (“Platform E”) with an AI policy assistant
Threat	Prompt injection causing an AI assistant to reveal other customers' policy details
Why it is new	AI assistants with database access create new data-leakage paths
Codec Networks services	AI/LLM security testing, API testing, privacy programme (Bundles B11, B2, B6)

The scenario

Platform E launched an AI assistant that could look up policies to answer customer questions.

A user discovered that carefully worded prompts made the assistant query and summarise policies belonging to other customers.

Screenshots spread on social media, and insurer partners requested an urgent review.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• The assistant had broad database access.
• No authorisation check on lookups made by the AI.
• No output filtering for personal data.
• No security testing before launch.

The impact

Platform E disabled the assistant, faced insurer reviews and potential DPDP exposure, and delayed its product roadmap.

The regulatory lens

• IRDAI 2026 guidelines: protection and classification of personal data; security of customer-facing systems.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.
• CERT-In Directions: data leaks reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the AI	Prompt injection and data-leakage testing	B11
Limit access	Least-privilege API and authorisation review	B2
Protect data	Privacy review, output filtering, governance	B6, B11

Key lessons Test AI assistants before launch. Give AI the least data access possible. Enforce authorisation on AI lookups. Filter and monitor AI outputs.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com