America Faces Billion-Dollar Threat From New Cyberattack

Newsweek

4 hours ago

Based on facts, either observed and verified firsthand by the reporter, or reported and verified from knowledgeable sources.
Newsweek AI is in beta. Translations may contain inaccuracies—please refer to the original content.
The group behind the cyberattacks that rattled American and British retail companies earlier this year has turned its attention toward the insurance sector, and experts warn that the financial fallout could be in the billions.
On Monday, John Hultquist, the chief analyst of the Google Threat Intelligence Group, warned that "multiple intrusions" had been observed, including those targeting insurance companies, and issued a "high alert" warning for the sector. He added that these attacks "bear the hallmarks" of Scattered Spider. This prolific hacker collective has gained notoriety in recent years for its impersonation tactics and the use of "ransomware," a type of software that compromises victims' computer systems until an extortion payment is made.
The group, also known as UNC3944, is believed to be behind the attacks earlier this year, which targeted U.K. chains Marks & Spencer and Co-Op, as well as U.S. retailers.
Hultquist said in a post on X, formerly Twitter, that Scattered Spider has "a habit of working their way through a sector," and that insurance firms should now "be on the lookout for social engineering schemes targeting their call centers."
The warning coincided with reports from two American insurance firms, Erie Insurance and Philadelphia Insurance Companies, of anomalies in their systems; however, neither has confirmed a suspect or motive. The latter's website is still down as its team works "around the clock to fully resume business operations," while Erie on Tuesday said there was no longer any indication "of ongoing threat actor activity."
Charles Carmakal, chief technology officer of Google Cloud's Mandiant Cybersecurity Consulting, confirmed to Newsweek that there were already more than one U.S.-based victim in the insurance sector, and that the latest wave of attacks started "approximately 1.5 weeks ago."
Illustrative image.
Illustrative image.
GDA illustration via AP Images
However, should the attacks spread to the broader insurance sector, valued in the trillions and considered a cornerstone of the entire U.S. economy, experts believe the reputational and financial toll could far exceed that of the earlier attacks.
"When insurers bleed, the economy feels the pain," said cybersecurity expert and former White House Chief Information Officer Theresa Payton. "Scattered Spider could turn a sector safeguard into a financial sinkhole."
Payton told Newsweek that a Scattered Spider attack could disrupt insurers' ability to access accounts, process claims, or make payments, and that a sector-wide attack could "cost hundreds of millions, possibly billions," given the "vast troves" of sensitive data that insurance companies hold, which could be exploited.
James E. Lee, president of the Identity Theft Resource Center (ITRC), similarly estimated the potential impact of "a large-scale series of attacks" in the billions of dollars, given the costs associated with the small number of successful attacks on the retail sector. Marks & Spencer, the primary target of these attacks, estimated that these would result in a £300 million ($403 million) hit to this year's profits.
This is in addition to the harm caused to those who rely on uninterrupted insurance payouts, and the "widespread erosion" of customer trust, with resulting "regulatory scrutiny," Payton said, would befall the industry.
Both experts also noted that the insurance industry's vast size and complexity make it an ideal target for Scattered Spider's signature playbook, particularly the use of employee impersonation to gain access to computer systems.
"Everyone is a target," said Payton, "however, the insurance sector is a prime candidate for Scattered Spider due to its data-rich environment, decentralized IT systems, and reliance on third-party vendors." She added that the use of "social engineering tactics" could exploit human vulnerabilities in call centers, and that insurers hoards of data from personal and information to health records "are lucrative for extortion or dark web sales."
However, beyond the outsize risks posed to the insurance industry, Payton told Newsweek that another "hidden threat" was emerging, which could "supercharge" the social engineering tactics of groups such as Scattered Spider.
"With generative AI, attackers no longer need fluent English or clunky translations; they can craft bespoke phishing emails or impersonate a high-ranking U.S. official from D.C., mimicking their voice or likeness in real-time interactive calls or video chats," she said.
"This technology, widely accessible, amplifies their ability to deceive employees and bypass digital defenses."
A countermeasure to this, Payton argues, is for companies to "go analogue."
"Use in-person verification or a deepfake-combating passphrase—unique, unguessable, and not derived from social media, public records, or breached data—to thwart these hyper-realistic scams."