Threat actors are stealing information by taking advantage of the application design and code of websites that provide instant quotes for auto insurance rates, the New York Department of Financial Services (NYDFS) reported in March. This personal information theft was first announced on Feb. 16 and is ongoing, they said.

Read on to learn about what these techniques entail and how this campaign continues to evolve.

Two Tactics of Personal Information Theft

NYDFS received reports of two new attack techniques. In the first, threat actors used web debugging tools to steal private personal information. They were able to grab it as it traveled from a data service provider to the instant quote website.

Those tools enabled the attackers to do two things. First, they could inspect web pages and sessions on those websites, as well as monitor data service providers’ application programming interface (API) calls for customer data. Next, attackers could carry out the personal information theft in XML and/or JSON file formats. These included a requester’s driver’s license number along with the state that issued it.

As for the second tactic, threat actors used credential stuffing to gain access to insurance agents’ accounts. They used those accounts to enter the web portals of instant quote websites. From there, they made API calls to data service providers. This way, they gained access to New Yorkers’ driver’s license numbers and other nonpublic information.

Part of a Broader Financial Services Cybersecurity Threat

According to an alert released by the department in mid-February, auto insurers first noticed the personal information theft around the beginning of the year when they observed a large number of abandoned auto insurance quotes.

The attackers had entered a person’s name, date of birth and address into the required fields on an instant quote website. From there, they received an instant quote that contained partial or redacted personal information, including the driver’s license number. The attackers stole the number without proceeding any further with the quote.

In some cases, the attackers used ‘vishing’ to trick insurance agents into providing sensitive information over the phone. Other times, they used eChecks or stolen payment card numbers to purchase insurance policies in other people’s names. From there, they could view the policyholders’ driver’s license numbers and commit other personal information theft.

This also enabled the attackers to commit identity theft. For at least some of the cases reported to NYDFS, the attackers conducted benefits fraud, submitting fake claims for pandemic and/or unemployment benefits.

How to Defend Against Personal Information Theft

This attack campaign highlights the need for financial services groups and other entities to protect their customers from personal information theft. One of the ways they can do this is by improving access controls for insurance agent portals. They can implement the principle of least privilege to limit which network assets their insurance agents can access, for example. When combined with network segmentation, this security measure can help prevent attackers from moving to parts of the network that contain users’ sensitive information.

Businesses should also make sure their insurance agents and employees are familiar with scams. A security awareness training program can educate the workforce about credential stuffing attacks, vishing attempts and some of the other techniques used in personal information theft.

More from News

Securing critical infrastructure with the carrot and stick

4 min read - It wasn’t long ago that cybersecurity was a fringe topic of interest. Now, headline-making breaches impact large numbers of everyday citizens. Entire cities find themselves under cyberattack. In a short time, cyber has taken an important place in the national discourse. Today, governments, regulatory agencies and companies must work together to confront this growing threat. So how is the federal government bolstering security for critical infrastructure? It looks like they are using a carrot-and-stick approach. Back in March 2022, the…

650,000 cyber jobs are now vacant: How to tackle the risk

4 min read - How far is the United States behind in filing cybersecurity jobs? As per Rep. Andrew Garbarino, R-N.Y., Chairman of the HHS Cybersecurity and Infrastructure Protection Subcommittee, overseas adversaries have a workforce advantage over FBI cyber personnel of 50 to one. His statements were made during a recent subcommittee hearing titled “Growing the National Cybersecurity Talent Pipeline.” Meanwhile, recent CyberSeek data shows over 650,000 cyber jobs to fill nationwide. Given the rising rate of cyberattacks, these numbers are truly alarming. How…

Will data backups save you from ransomware? Think again

4 min read - Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal. A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than…

Should you worry about state-sponsored attacks? Maybe not.

4 min read - More than ever, state-sponsored cyber threats worry security professionals. In fact, nation-state activity alerts increased against critical infrastructure from 20% to 40% from 2021 to 2022, according to a recent Microsoft Digital Defense Report. With the advent of the hybrid war in Ukraine, nation-state actors are launching increasingly sophisticated attacks. But is this the most prominent danger facing companies today? While nation-state-based attacks cannot be ignored, it looks like insider cyber incidents are far more common. In fact, for the…