Threat actors are stealing information by taking advantage of the application design and code of websites that provide instant quotes for auto insurance rates, the New York Department of Financial Services (NYDFS) reported in March. This personal information theft was first announced on Feb. 16 and is ongoing, they said.

Read on to learn about what these techniques entail and how this campaign continues to evolve.

Two Tactics of Personal Information Theft

NYDFS received reports of two new attack techniques. In the first, threat actors used web debugging tools to steal private personal information. They were able to grab it as it traveled from a data service provider to the instant quote website.

Those tools enabled the attackers to do two things. First, they could inspect web pages and sessions on those websites, as well as monitor data service providers’ application programming interface (API) calls for customer data. Next, attackers could carry out the personal information theft in XML and/or JSON file formats. These included a requester’s driver’s license number along with the state that issued it.

As for the second tactic, threat actors used credential stuffing to gain access to insurance agents’ accounts. They used those accounts to enter the web portals of instant quote websites. From there, they made API calls to data service providers. This way, they gained access to New Yorkers’ driver’s license numbers and other nonpublic information.

Part of a Broader Financial Services Cybersecurity Threat

According to an alert released by the department in mid-February, auto insurers first noticed the personal information theft around the beginning of the year when they observed a large number of abandoned auto insurance quotes.

The attackers had entered a person’s name, date of birth and address into the required fields on an instant quote website. From there, they received an instant quote that contained partial or redacted personal information, including the driver’s license number. The attackers stole the number without proceeding any further with the quote.

In some cases, the attackers used ‘vishing’ to trick insurance agents into providing sensitive information over the phone. Other times, they used eChecks or stolen payment card numbers to purchase insurance policies in other people’s names. From there, they could view the policyholders’ driver’s license numbers and commit other personal information theft.

This also enabled the attackers to commit identity theft. For at least some of the cases reported to NYDFS, the attackers conducted benefits fraud, submitting fake claims for pandemic and/or unemployment benefits.

How to Defend Against Personal Information Theft

This attack campaign highlights the need for financial services groups and other entities to protect their customers from personal information theft. One of the ways they can do this is by improving access controls for insurance agent portals. They can implement the principle of least privilege to limit which network assets their insurance agents can access, for example. When combined with network segmentation, this security measure can help prevent attackers from moving to parts of the network that contain users’ sensitive information.

Businesses should also make sure their insurance agents and employees are familiar with scams. A security awareness training program can educate the workforce about credential stuffing attacks, vishing attempts and some of the other techniques used in personal information theft.