Top insurer CNA disconnects systems after cyberattack

It could be a "nightmare scenario" for CNA and others if hackers get ahold of policyholder information.

CNA, one of the U.S.’s top providers of cybersecurity insurance, is struggling with a cyberattack that prompted it to disconnect its systems from its network.

Its website hasn’t been working for the last couple days, and at press time displayed the message, “The attack caused a network disruption and impacted certain CNA systems, including corporate email.”

The Chicago-based firm reported more than $10 billion in revenue in 2020, and is in the top 15 U.S. property and casualty insurers and top 10 U.S. providers of cyber insurance, according to recent measurements.

If the attack proves to include policyholder data, a cyber insurance industry expert warned, it could enable particularly devastating further incidents that hackers could use as leverage in extortion attempts. If that’s the case, CNA said, it will keep customers updated.

The company said it discovered the intrusion on March 21, adding that it is working with forensics experts to determine the scope of the incident and has alerted law enforcement for an investigation. A spokesperson did not respond to requests for information about the nature of the hack.

“The nightmare scenario” would be if hackers got ahold of policyholder data, said Coalition CEO Joshua Motta, whose company provides cyber risk management tools and cyber insurance.

“The ramifications of a ransomware attack or threat actor activity against CNA and insurance company networks — much less an insurance company that is one of the larger providers of cyber insurance — is that the threat actors are now maybe aware of which companies have applied for insurance with CNA, which have actually purchased that insurance, what coverage they have, including coverage for cyber extortion or ransomware, as well as the limits and deductibles of those policies,” he said.

Hackers could use that data to put ransomware victims in a bad position to negotiate an end to their networks being held hostage, Motta said.

Some studies have warned about the growing cyber risk to insurance providers, but Motta estimates they are at best “no better, no worse prepared” for attacks.

Industry ransomware victims last year include Chubb and Arthur J. Gallagher & Co.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure