Insurance breaches rarely look like the movies. There is no zero-day and no genius attacker, just a leaked password, a portal that trusts it, and an internal API that never checks who is calling.
Understanding that pattern is the first step to breaking it. This guide walks the real anatomy of an insurance breach, the entry points attackers actually use, and how a penetration test that mirrors their path catches each one before it becomes a notification letter. For the regulatory side, start with our insurance penetration testing guide.
What CodeAnt AI solves here: CodeAnt AI runs continuous, code-aware penetration testing across portals, APIs, cloud, and external surface, then chains findings into a proven path to policyholder data. Pricing is outcome-based, so you pay for confirmed critical exposure rather than researcher hours.
Why Insurance Companies Get Breached So Often
Insurance sits on concentrated, high-value data, which makes it a standing target. Policyholder files pair identity, financial, and health information in one place, and health lines add protected health information on top.
The scale is on record. HHS estimates the 2024 Change Healthcare ransomware attack, a UnitedHealth Group subsidiary, affected close to 190 million people, one of the largest health-data breaches in US history.
It was the visible peak of a steady trend rather than an outlier.
The costs are consistent too. IBM's widely cited figure puts the average breach at 4.88 million dollars, and financial-sector incidents typically run higher.
For a regulated insurer, the exposure under NYDFS and the NAIC model law arrives on top of that.
Insurance Attack Surface: Portals, APIs, Vendors, And Cloud
Breaches enter through a small number of predictable doors. Naming them is how you scope a test that reflects real risk rather than a generic checklist.
Agent and broker portals
Portals are the front door, and they fail at authentication. A broker or agent portal exposes policyholder data to thousands of external users, and once a credential leaks, weak or missing multi-factor authentication is all that stands between the attacker and the data.
Reporting on recent insurance incidents ties them repeatedly to the same techniques, compromised credentials, MFA fatigue, and help-desk impersonation, rather than novel exploits. The portal does exactly what it was built to do, for the wrong person.
Policy and claims APIs
Behind every portal sits an API, and APIs fail at authorization. The most damaging pattern is broken object level authorization, where an endpoint returns a policy or claim without confirming the requester owns it.
The risk is not theoretical. A 2024 insurance-sector breach was traced to a misconfigured API endpoint that lacked authentication, exposing client data directly to anyone who found it.
Our API penetration testing guide covers how these are found and proven.
Third-party and vendor integrations
This is now the dominant vector, and it is the hardest to see. An insurer runs on integrations with clearinghouses, benefits administrators, analytics providers, and document services, and each holds policyholder data outside the insurer's own perimeter.
The cascade is the problem. The Change Healthcare attack disrupted claims processing across the US health system through a single subsidiary, and the 2025 Allianz Life breach reached most of its US customers through a third-party cloud service.
Attackers no longer need to breach the insurer when they can breach the ecosystem around it.
Cloud storage and misconfiguration
Policy documents, claims attachments, and medical records land in cloud object storage, and misconfiguration exposes them without touching the application. An open bucket or an over-permissioned role is a direct path to the data.
Cloud incidents in insurance increasingly begin with social engineering that yields access to a cloud console, then pivot to whatever the compromised identity can read. The cloud penetration testing guide covers this layer in depth.
Leaked and reused credentials
Underneath most of the above sits the initial access, a credential that was phished, reused from another breach, or left in a public repository. It is the match that lights everything else.
Credentials for insurer systems circulate on the open internet before they are used, which means the exposure is often visible in advance to anyone looking for it. Most insurers are not looking.
Anatomy Of An Insurance Data Breach From Portal To Claims API
Put the entry points in sequence and the mechanics become clear. A real breach is a chain, not a single event, and every link is individually unremarkable.
It usually begins with a leaked credential for a broker portal. The portal lacks strong multi-factor authentication, so the credential works, and the attacker is now an authenticated user.
From inside, an internal API becomes reachable, one that assumes anything calling it is trusted and never checks authorization. That API reads from the claims database, so the attacker enumerates records, and what began as one password ends as a reportable breach of millions.
No single flaw in that chain looks catastrophic in isolation. That is precisely why scanners miss it and why proving the chain matters more than listing the parts.
How Insurers Can Prevent Data Breaches With Continuous Testing
Phase 1
Passive Recon
Maps your full attack surface, subdomains, open ports, exposed configs, and known CVEs, without touching your systems.
Passive Recon
App Intelligence
500+ Agents
Attack Chains
Evidence
The test starts where the attacker starts, with exposed broker portals and credentials already circulating online, then follows each reachable path toward claims and policy data. Findings are chained into one proven path to exfiltrated data, revalidated by researchers, and shipped with a working exploit and a retest, which our walkthrough of how AI penetration testing traces a data leak end to end shows in full.
Finding a leaked broker credential before it is used turns the first link of the breach chain into a closed door.
Why Code-Aware Penetration Testing Finds Insurance API Risks
Code-aware testing reads the handlers and data access code behind each portal, which is how it finds the internal API that reaches the claims database with no authentication. Our breakdown of black box, white box, and gray box testing covers where each mode fits.
Why Annual Penetration Testing Misses Insurance Breach Paths
An annual pentest is a photograph, and insurer systems are a film. The portal that was secure at the January test gets a new integration in March, a new claims endpoint in June, and a misconfigured storage bucket in September.
Every one of those changes is a chance to introduce the exact gap a breach chain needs. A test that ran before them cannot have seen them, and the next annual test is months away.
Continuous testing closes that window by re-examining the surface as it changes. Each new endpoint, integration, and configuration gets validated as it ships, which is the only cadence that matches how breaches actually enter.
How CodeAnt AI Helps Insurers Prevent Portal, API, And Cloud Breaches
CodeAnt tests an insurer the way an attacker would, continuously. External reconnaissance maps the exposed portals and leaked credentials, code-aware analysis finds the authorization gaps in the APIs behind them, and cloud testing catches the misconfigurations underneath.
It runs all three vantage points as one system, outside-in reconnaissance, inside-out code and cloud modeling, and gray box attacks that use internal knowledge from the perimeter. Findings arrive as a proven chain with a working exploit, not a list of disconnected weaknesses.
Because testing runs on every change, the broker portal integration added last week gets tested this week, not at next year's engagement. You can see the format in the sample pentest report, and the pentesting page covers the offensive side.
The commercial model matches the risk. You pay for confirmed critical exposure rather than researcher hours, which means the test is paid only when it finds something real.
Individual Breach Breakdowns
Each of these insurer incidents has its own teardown covering the entry point, the chain and the controls that would have stopped it.
Aflac (2025): Attackers linked to Scattered Spider used social engineering to reach data on 22.65 million customers, beneficiaries and employees.
Farmers Insurance (2025): A vendor's Salesforce database was breached through voice phishing, exposing 1.1 million policyholders. Personal lines carriers can test these vendor and CRM paths through penetration testing for auto and home insurers.
Fidelity National Financial (2023): Ransomware took title and escrow services offline for a week and exposed data on about 1.3 million consumers. Read the Fidelity National Financial ransomware attack.
Delta Dental (2023): A zero-day in the MOVEit Transfer tool exposed data on nearly 7 million dental plan members. Read the Delta Dental MOVEit breach.
Anthem (2015): One spear-phishing email led to the theft of records on 78.8 million health plan members. Read the Anthem spear-phishing breach.
Stop Insurance Breaches By Testing The Full Attack Chain
Insurance companies rarely get breached through one dramatic flaw. The damage usually comes from a chain: a leaked credential, a portal without strong MFA, an internal API that trusts the caller, a claims database that returns records without ownership checks, or a vendor integration that expands the blast radius. Each weakness may look manageable in isolation. Together, they can become a reportable policyholder data breach.
That is why insurance cybersecurity testing needs to mirror real attacker movement. Start with the breach paths that matter most: broker portals, leaked credentials, claims APIs, third-party integrations, and cloud storage. Test them as a connected chain, prove whether policyholder data is actually reachable, and use continuous, code-aware penetration testing to catch the next exposure before it becomes a notification letter.
Launch a free black box scan for one URL to see your exposed surface the way an attacker maps it, then book a walkthrough to see continuous, code-aware testing chained through to a proven data leak. For the compliance groundwork, start with our guide to penetration testing for insurance companies.
