Threat actors are stealing information by taking advantage of the application design and code of websites that provide instant quotes for auto insurance rates, the New York Department of Financial Services (NYDFS) reported in March. This personal information theft was first announced on Feb. 16 and is ongoing, they said.

Read on to learn about what these techniques entail and how this campaign continues to evolve.

Two Tactics of Personal Information Theft

NYDFS received reports of two new attack techniques. In the first, threat actors used web debugging tools to steal private personal information. They were able to grab it as it traveled from a data service provider to the instant quote website.

Those tools enabled the attackers to do two things. First, they could inspect web pages and sessions on those websites, as well as monitor data service providers’ application programming interface (API) calls for customer data. Next, attackers could carry out the personal information theft in XML and/or JSON file formats. These included a requester’s driver’s license number along with the state that issued it.

As for the second tactic, threat actors used credential stuffing to gain access to insurance agents’ accounts. They used those accounts to enter the web portals of instant quote websites. From there, they made API calls to data service providers. This way, they gained access to New Yorkers’ driver’s license numbers and other nonpublic information.

Part of a Broader Financial Services Cybersecurity Threat

According to an alert released by the department in mid-February, auto insurers first noticed the personal information theft around the beginning of the year when they observed a large number of abandoned auto insurance quotes.

The attackers had entered a person’s name, date of birth and address into the required fields on an instant quote website. From there, they received an instant quote that contained partial or redacted personal information, including the driver’s license number. The attackers stole the number without proceeding any further with the quote.

In some cases, the attackers used ‘vishing’ to trick insurance agents into providing sensitive information over the phone. Other times, they used eChecks or stolen payment card numbers to purchase insurance policies in other people’s names. From there, they could view the policyholders’ driver’s license numbers and commit other personal information theft.

This also enabled the attackers to commit identity theft. For at least some of the cases reported to NYDFS, the attackers conducted benefits fraud, submitting fake claims for pandemic and/or unemployment benefits.

How to Defend Against Personal Information Theft

This attack campaign highlights the need for financial services groups and other entities to protect their customers from personal information theft. One of the ways they can do this is by improving access controls for insurance agent portals. They can implement the principle of least privilege to limit which network assets their insurance agents can access, for example. When combined with network segmentation, this security measure can help prevent attackers from moving to parts of the network that contain users’ sensitive information.

Businesses should also make sure their insurance agents and employees are familiar with scams. A security awareness training program can educate the workforce about credential stuffing attacks, vishing attempts and some of the other techniques used in personal information theft.

More from News

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

Costa Rica State of Emergency Declared After Ransomware Attacks

In late April, after weeks of major ransomware attacks, Costa Rica declared a state of emergency. Newly-elected President Rodrigo Chaves took this measure, usually reserved to deal with natural disasters, to free up the government to react more decisively to the incident. The Russian-based Conti gang has claimed they launched the attack. Meanwhile, the U.S. Department of State offered a $10 million reward for information that leads to finding anyone holding a key leadership role in the Conti gang. The…

Ransomware-as-a-Service Transforms Gangs Into Businesses

Malware-as-a-Service is getting easier and easier to access, according to a recent threat report. Self-named the ‘Eternity Project’, this cyber threat group offers services from a Tor website and on their Telegram channel. They sell a wide variety of malware in an organized fashion, including stealer, clipper, worm, miner, ransomware and distributed-denial-of-service bot services. This alarms many security professionals. With Eternity, even inexperienced cyber criminals can target victims with a customized threat offering. Eternity sells malware for $90 to $490.…

UK Health System Email Accounts Hijacked to Steal Microsoft Logins

Last summer, I noticed password reset notices in my email account that I didn’t send. I quickly realized that I was the victim of an account takeover. This happens when someone illegally gains access to your account, typically through compromised credentials. I changed my email password right away and learned that my passwords to other accounts had already been changed. To make cleanup even more fun, I found out that the attackers had created new accounts using my credentials. Account…