May 5, 2021 By David Bisson 2 min read

Threat actors are stealing information by taking advantage of the application design and code of websites that provide instant quotes for auto insurance rates, the New York Department of Financial Services (NYDFS) reported in March. This personal information theft was first announced on Feb. 16 and is ongoing, they said.

Read on to learn about what these techniques entail and how this campaign continues to evolve.

Two Tactics of Personal Information Theft

NYDFS received reports of two new attack techniques. In the first, threat actors used web debugging tools to steal private personal information. They were able to grab it as it traveled from a data service provider to the instant quote website.

Those tools enabled the attackers to do two things. First, they could inspect web pages and sessions on those websites, as well as monitor data service providers’ application programming interface (API) calls for customer data. Next, attackers could carry out the personal information theft in XML and/or JSON file formats. These included a requester’s driver’s license number along with the state that issued it.

As for the second tactic, threat actors used credential stuffing to gain access to insurance agents’ accounts. They used those accounts to enter the web portals of instant quote websites. From there, they made API calls to data service providers. This way, they gained access to New Yorkers’ driver’s license numbers and other nonpublic information.

Part of a Broader Financial Services Cybersecurity Threat

According to an alert released by the department in mid-February, auto insurers first noticed the personal information theft around the beginning of the year when they observed a large number of abandoned auto insurance quotes.

The attackers had entered a person’s name, date of birth and address into the required fields on an instant quote website. From there, they received an instant quote that contained partial or redacted personal information, including the driver’s license number. The attackers stole the number without proceeding any further with the quote.

In some cases, the attackers used ‘vishing’ to trick insurance agents into providing sensitive information over the phone. Other times, they used eChecks or stolen payment card numbers to purchase insurance policies in other people’s names. From there, they could view the policyholders’ driver’s license numbers and commit other personal information theft.

This also enabled the attackers to commit identity theft. For at least some of the cases reported to NYDFS, the attackers conducted benefits fraud, submitting fake claims for pandemic and/or unemployment benefits.

How to Defend Against Personal Information Theft

This attack campaign highlights the need for financial services groups and other entities to protect their customers from personal information theft. One of the ways they can do this is by improving access controls for insurance agent portals. They can implement the principle of least privilege to limit which network assets their insurance agents can access, for example. When combined with network segmentation, this security measure can help prevent attackers from moving to parts of the network that contain users’ sensitive information.

Businesses should also make sure their insurance agents and employees are familiar with scams. A security awareness training program can educate the workforce about credential stuffing attacks, vishing attempts and some of the other techniques used in personal information theft.

More from News

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

DOJ’s crackdown: A brief look at hacker group takedowns

3 min read - The Department of Justice (DOJ) is ramping up efforts focused on disrupting cyber criminal organizations operating within and outside of United States borders. The dismantling of Volt Typhoon, a prolific hacker collective, marked a turning point in the DOJ's offensive against cyber crime syndicates. The group was notorious for its brazen cryptocurrency scams and heists. Through coordinated global law enforcement efforts, individuals linked to the organization were apprehended, assets were frozen and critical infrastructure was seized. The success of the…

Will watermarking save the 2024 election from a deepfake debacle?

3 min read - It seems like only months ago deepfakes were still just a curiosity. Now, deepfakes are a real and present danger. And in an election year, the influence of AI-manipulated content could be disastrous. During a recent Washington Post Live event, Anne Neuberger, deputy national security adviser for cyber and emerging technologies at the White House, commented on the rising risk of deepfakes. Incidents have already occurred, such as the recent fake-Biden robocall meant to discourage voters ahead of the New…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today