LMF Corporate Member Intelligence

From ransomware and AI-enabled phishing to supply chain compromise, the insurance industry faces a complex and evolving set of cyber risks.

Our Insurance Industry Threat Intelligence Report examines:

• The most prominent cyber threats in 2025 – including Medusa ransomware and identity-based attacks by groups like Scattered Spider
• The real-world impact of recent incidents affecting millions of policyholders
• Practical recommendations for senior leaders, security teams, and staff to strengthen resilience

By combining sector-specific intelligence with actionable guidance, this report supports insurers in protecting sensitive customer data, meeting regulatory obligations, and maintaining operational continuity.

Following our May update on Scattered Spider’s campaign against the retail sector, NCC Group’s Global Threat Intelligence team has identified a broadening of the group’s operations - now extending into aviation and insurance.

While attribution remains ongoing, observed behaviours closely mirror Scattered Spider’s known TTPs, including:

• Sophisticated social engineering
• Impersonation of IT help desks
• Supply chain access via trusted vendors
• Deployment of ransomware including DragonForce

The aviation sector faces elevated risk due to its sensitive data, third-party reliance, and peak summer traffic; all of these are potential leverage points for extortion.

Likewise, insurance providers’ high-value personal data and CNI ties make them prime targets, with observed incidents already affecting major firms across the US.

This July update includes:

• A sample attack chain
• TTPs and IOCs from May–July 2025
• Sector-specific analysis