US- based insurance company Arthur J. Gallagher (AJG) said it was hit by a ransomware attack on Saturday. It is one of the largest insurance companies in the world with more than 33,300 employees. The company provides insurance services to customers in more than 150 countries.
The company shut down its systems to prevent the attack
Arthur J. Gallagher said it detected the ransomware attack on September 26, 2020. The attack affected only a few systems.
"We took all of our systems offline as a precautionary measure, initiated an investigation, engaged external security , and implemented plans to minimize disruption to our customers," the company said.
Two days later, the insurance company began to reactivate systems .
“Although we are in the early stages of assessing the incident, based on the information known to date, we do not believe that the incident will have a material impact on our business, operations or financial condition“.
According to Bleeping Computer, Troy Mursch, lead researcher at cybersecurity firm Bad Packets, said that AJG had two F5 BIG-IP serversvulnerable to the CVE-2020-5902 vulnerability.
Simple ransomware attack or even data breach?
Arthur J. Gallagher did not say whether the ransomware attack resulted in the loss of customer or employee data, but most ransomware gangs routinely steal data from their victims.
Since the insurance company receives information such as medical records, blood tests, financial information, and, in some cases, tax returns, a data could cause a lot of problems.
AJG states in its privacy policy that it collects the following data from customers:
- personal information (e.g. name, date of birth);
- contact information (e.g. phone number, email address, postal address or mobile number)
- government- issued identification information (e.g., social security and national insurance numbers, passport details);
- health data (e.g. health certificates).
- banking details (e.g. payment details, account numbers and classification codes).
- driver's license details
- internet connection information (e.g. username, password, answers to security questions).
- other information we receive from you through applications and questionnaires (e.g. occupation, current employer).
At least 22 ransomware gangs steal sensitive files from victims before encrypting them, so the chances of a data breach are very high.
