The insurance sector is going through a period of cyber tension unlike anything it has experienced before. Attacks no longer target only internal systems, but increasingly focus on the service providers that make up the insurer’s digital value chain: SaaS vendors, cloud hosting providers, CRM platforms, third-party payment operators, marketing platforms and managed service providers. As operations shift toward the cloud and business models open up to multiple partners, the attack surface extends far beyond what can realistically be controlled. The conclusion is clear: it is no longer enough to “secure oneself”; organisations must understand and control all of their technological dependencies.
A sector hit by real and repeated attacks
The cyber incidents that have affected the insurance sector since 2021 reveal a clear trajectory, moving from opportunistic cybercrime to structured, systemic and industrial-scale attacks.
The year 2021 marked a first major turning point. The Mutuelle Nationale des Hospitaliers was hit by a ransomware attack that led to a severe paralysis of its services. This incident highlighted the operational vulnerability of insurance organisations to attacks capable of durably disrupting critical business processes. In the years that followed, players such as April, AssurOne, Génération, Coverlife and Verlingue were also impacted, suffering a combination of system outages, data breaches and prolonged operational disruption. MMA, Buchner and other brokerage firms were similarly immobilised by recent ransomware variants incorporating data exfiltration mechanisms, confirming the persistence of this threat across critical insurance value chains.
The year 2024 then represented a systemic shock. The compromises of Viamedis and Almerys, two major third-party payment operators, resulted in the exposure of data belonging to thirty-three million insured individuals. This information circulated on underground forums, brutally revealing the sector’s dependence on a small number of critical service providers and the concentration of risk within the insurance ecosystem. In November 2024, Direct Assurance also suffered an intrusion exploiting an employee’s access, leading to the publication of data including, in particular, 5,800 IBANs. These incidents demonstrated that threats stem as much from human weaknesses as from technical vulnerabilities.
In 2025, the scale and maturity of attacks further increased. In February, the intrusion of Harvest, a central fintech player in wealth management in France, triggered a data breach affecting several actors in the sector. Attackers leveraged a virtual machine hosted by a third-party provider, bypassing EDR, XDR and SIEM security controls, before encrypting systems and exfiltrating tens of gigabytes of internal, professional, HR, financial and technical data. The publisher, which claims more than 4,600 clients, saw the shockwave spread to numerous insurers, including Maif Solutions Financières, Aca France, Eres and CNP Assurances, which was forced to shut down the CNP Alysée platform developed with Harvest for independent wealth managers.
In the same period, in February 2025, the Mutuelle des Motards faced the disclosure of more than 1.3 million profiles originating from a compromised marketing management tool, exposing addresses, phone numbers and email addresses. These attacks confirmed the vulnerability of peripheral digital components often considered non-critical, yet essential to the chain of trust.
Finally, more recently, in November 2025, the massive data breach at Itelis exposed the information of more than five million insured individuals from networks such as Axa, Malakoff Humanis, APRS and AG2R. This incident confirmed that shared service operators can become systemic points of failure for the entire insurance sector.
An attack surface that has moved outside the organisation
The common denominator across these incidents is striking: most no longer originate from an internal failure, but from an element of the ecosystem. A misconfigured CRM, a hijacked OAuth integration, a vulnerable marketing tool, a compromised cloud provider, a targeted third-party payment operator, an exposed financial software component, or even a poorly protected API key.
Insurers must now manage a fragmented information system: a relatively controlled internal core surrounded by a constellation of essential service providers, often interconnected with each other, on which operational continuity depends. The dependency is no longer merely technical; it has become strategic.
European operational resilience requirements, often viewed through a regulatory lens, primarily remind organisations that risk management can no longer be limited to internal controls. They require the contractual framing of critical providers, the assessment of their security posture, an understanding of dependency chains and the anticipation of disruption scenarios. Recent incidents demonstrate that these requirements are not administrative constraints, but conditions for operational survival.
The impossibility of securing everything: why prioritisation is essential
Faced with this complexity, many organisations become trapped in an accumulation mindset: more controls, more tools, more testing, more requirements. In an environment where the attack surface far exceeds what the organisation can realistically manage, this approach quickly reaches its limits.
The EBIOS RM risk analysis methodology introduces a change in perspective. It moves away from the idea that everything must be secured, mapped and anticipated. Instead, it focuses efforts on what truly matters to the business: feared events that, if they were to occur, would undermine service continuity, policyholder trust or prudential integrity.
In this context, sector incidents become valuable lessons. The compromise of a CRM can lead not only to massive data breaches, but also to targeted fraud against policyholders. The paralysis of a wealth management tool can impact several banks and mutual insurers simultaneously. An attack on a third-party payment operator can block the reimbursement chain of an entire country. The compromise of a cloud hosting provider can affect all of its customers in a single operation. The EBIOS RM approach makes it possible to translate these facts into plausible scenarios, measure their business impact and position security priorities where they will be most effective.
From risk management to dependency control: a structural evolution
To make informed decisions, executives need a clear view: which providers are truly critical, what data flows through them, what public vulnerabilities they expose, which incidents affect them, which alerts should be raised automatically, what trends their cyber score reveals, and which contractual commitments must be reviewed.
Third-party risk management becomes a continuous process, fuelled by technical data such as external attack surface monitoring, cyber intelligence including vulnerabilities, exposures and public incidents, contractual information and scenario-based analyses. Mature organisations adopt an integrated approach in which EBIOS RM risk analysis serves as the backbone for prioritisation, decision-making and arbitration. Some externalise this governance, not to abdicate responsibility, but to benefit from continuous expertise capable of monitoring, analysing and challenging critical providers over time.
Toward resilience built on the intelligence of interdependencies
The insurance sector has always demonstrated a strong capacity for adaptation. However, digitalisation, outsourcing and interconnection have permanently altered the nature of risk. Resilience no longer depends solely on the robustness of internal systems, but on precise knowledge of dependencies, anticipation of critical scenarios and the ability to respond to incidents that may impact several organisations simultaneously.
The attacks of the past two years are not anomalies; they constitute the permanent landscape in which insurance organisations must now operate. Understanding threats, prioritising what matters, integrating service providers into the risk management process and continuously managing third-party risk have become strategic levers, on par with solvency and prudential management.
It is in this ability to orchestrate the entire ecosystem that the resilience of the next decade will be decided, for a sector that carries the trust of millions of policyholders.
Share:
