INDUSTRY FACT FILE · INSURANCE INTERMEDIARIES

Threat Landscape: Top Cyber Threats Facing Insurance Intermediaries and Insurtechs

The 18 most relevant cyber threats, attacks and industry challenges for brokers, corporate agents, web aggregators, TPAs, repositories and digital insurance platforms in India.

Intermediaries combine valuable data with direct connections into insurers' systems. Attackers target their APIs and portals for mass data theft, their finance teams for premium diversion, their distributor networks for credentials and their claims platforms for ransomware. Reports based on I4C data put cyber-fraud losses across all channels at about ₹19,813 crore in 2025.

IRDAI's 2026 guidelines bring intermediaries under audits by CERT-In empanelled auditors and six-monthly external testing, while insurers increasingly assess intermediaries as third parties.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by intermediary segment (Codec Networks assessment).

4.1 Broken API authorisation

Quote, policy and claims APIs often check that a user is logged in but not that the record belongs to them. A single flaw can expose every customer, and the data often includes health and vehicle details.

• Questions to test: Is object-level authorisation enforced on every API? Are enumeration and bulk access detected and blocked? Do responses return only the data needed?
• Relevant services: API security testing, code review, rate limiting and anomaly detection.

4.2 Premium diversion and BEC

Brokers handle large group-health and commercial premiums. Attackers compromise mailboxes, study payment cycles and send clients 'changed bank details' letters.

• Questions to test: Is MFA enforced on email? Are mailbox rules monitored? Are bank-detail changes verified by call-back on a known number? Is DMARC enforced?
• Relevant services: email security review, BEC simulation, finance-process testing, SOC monitoring.

4.3 Ransomware at TPAs

A TPA outage stops cashless approvals for several insurers at once. Unpatched remote-access systems and reachable backups are common root causes.

• Questions to test: Are internet-facing systems tested every six months? Are backups isolated and restorable? Is there 24x7 monitoring and a playbook covering every insurer client?
• Relevant services: external PT, managed SOC, backup testing, BCP/DR drills, incident response.

4.4 Distributor credentials and impersonation

Distributor and POSP logins are phished and sold, while fake sites and messages use intermediaries' brands to target customers.

• Questions to test: Are distributor logins protected by MFA and device controls? Are downloads monitored? Is the brand monitored for fakes?
• Relevant services: access reviews, anomaly detection, brand monitoring and takedown, awareness.

4.5 Vendors, cloud and the 6-hour clock

Intermediaries rely heavily on cloud, CRM, KYC and messaging vendors. The 2026 guidelines set cloud and vendor requirements, and CERT-In requires reporting within six hours.

• Questions to test: Do vendor contracts include right-to-audit? Are CSPs MeitY-empanelled? Are logs retained for 180 days and monitored?
• Relevant services: vendor risk programme, cloud review, managed SOC, IR retainer.

• CERT-In: incidents reported within six hours of noticing them.
• IRDAI: incidents and remediation are examined in cyber security audits and compliance reports under the 2026 guidelines.
• Insurers: partner contracts typically require prompt notification and may trigger audits or suspension of integrations.
• Privacy: once DPDP breach provisions commence in May 2027, personal data breaches must be intimated to the Data Protection Board, with a detailed report within 72 hours.
• Clients and banks: corporate clients and bank partners may review controls after an incident.

• When was our last cyber audit by a CERT-In empanelled auditor, and are all findings closed?
• Has external PT been performed in the last six months?
• Could any of our APIs return another customer's data?
• Could we report an incident to CERT-In within six hours and notify every insurer partner?
• Would a 'changed bank details' email to a client be caught before payment?
• Which vendors hold our customers' data, and do our contracts allow us to audit them?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific intermediary. IRDAI requirements are summarised from reported sources; confirm against the official circular. I4C figures cover all channels.