Insurers Spend Big on Cybersecurity

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, a Moody’s survey of insurers found a commitment to cybersecurity spending, Renault reported a third-party breach in the United Kingdom, a WhatsApp malware campaign in Brazil and Germany skeptical of Chat Control. Two British teens arrested over a ransomware attack on a preschool. Qilin said its hackers stopped Asahi beer production. China-linked hackers weaponized Nezha and an Invoicely data breach exposed 180,000 personal records.

See Also: Why Cyberattackers Love ‘Living Off the Land’

A survey by Moody’s of 102 insurers and asset managers across the globe shows that cybersecurity is consuming a heftier portion of the IT budget. A pay walled report from the ratings agency shows roughly half of respondents spend between 6% and 10% of their IT budget on cybersecurity – roughly a quarter between 6% and 8% and another quarter between 8% and 10%.

More companies since the last survey in 2023 joined the ranks of big spenders, an upward trend “particularly pronounced among life and health insurers and very large companies.” Nearly all insurers and asset managers list cybersecurity as a distinct item in their budgetary process.

More spending doesn’t necessarily equate to better security, a fact underlined by the proliferation of breaches at third-party breaches. A July 2025 breach at Allianz Life Insurance of North America compromised the data of more than one million U.S. customers – a breach made possible by a social engineering attack at a cloud provider (see: Allianz Life Breach Tied to CRM Compromise).

More than nine out of 10 respondents said they have a formal third-party cyber risk program in place, a number that jumps to 97% for companies in the Americas but which is between 79% and 88% in other parts of the world.

Significant regional gaps also exist in cyber insurance coverage, with 90% of respondents in the Americas report buying standalone coverage, a number that drops to 38% of respondents in the Asia-Pacific region and 63% in Europe, the Middle East and Africa.

“Although regional disparities are likely to persist, we expect them to narrow over time as awareness of cyberattacks grows. Evolving regulatory requirements, particularly in Europe, also continue to drive demand for cyber coverage,” the report reads.

French multinational car maker Renault began notifying British customers Oct. 3 that their personal information was compromised in an incident at a third-party provider.

Renault said stolen data included names, phone numbers, email and postal addresses, vehicle identification and registration numbers. No financial information such as credit cards or account numbers were compromised nor was the company’s other systems, according to a Renault spokesperson.

Neither the third-party provider and the number of affected customers are yet known. “The third-party provider has confirmed this is an isolated incident that has been contained, and we are working with it to ensure that all appropriate actions are being taken. We have notified all relevant authorities,” a car manufacturer spokesman said.

Renault employs roughly 98,000 people worldwide, sporting an annual production output of 2.2 million vehicles and annual revenue of roughly $55 billion. It owns subsidiary budget brand Dacia and luxury brand Alpine, whose United Kingdom customers were also affected by the breach.

Hackers are targeting WhatsApp users primarily in Brazil with a campaign that inundates contacts with spam messages and propagates its malware through chat sessions, warns Trend Micro. The cybersecurity company found “Sorvepotel” malware spread primarily by infecting WhatsApp clients on Windows machines. Victims receive a message containing a zip file along with the message “baixa o zip no PC e abre” – i.e., “download the ZIP on PC and open it.”

Once opened on a desktop, the malware hijacks the victim’s WhatsApp web session and automatically forwards the malicious file to all contacts and group chats.

Sorvepotel focuses on speed and mass propagation, exploiting trust between users. Its ability to detect active WhatsApp Web sessions suggests a focus on enterprise targets. The malware ultimately delivers additional payloads aimed at stealing banking information, including Maverick.StageTwo and Maverick.Agent, which can steal credentials and mimic banking sites through fake overlays.

The campaign is largely concentrated in Brazil, with 457 of 477 known infections affecting government agencies and public service entities, as well as manufacturing, education, banking, technology and construction sectors.

Germany appears to be leaning against supporting the European Union’s proposed Chat Control regulation, a draft law that would force communications platforms to scan private messages for child sexual abuse material. End-to-end encrypted apps including Signal and WhatsApp oppose the regulation. Signal has said it will leave the trading bloc market before “building a surveillance machine into Signal.”

German Justice Minister Stefanie Hubig said her “Germany will not agree to such proposals at the EU level.” Jens Spahn, a member of the Bundestag for Germany’s Christian Democratic Union, a pivotal part of the ruling coalition in the country, said his party opposes the bill.

Germany’s vote on the matter could sway the outcome in the Council of the European Union, where Chat Control has the support of countries including France, Spain, Portugal and Denmark. The Danish presidency has made it a priority to pass Chat Control during its turn at the head of the European Union. Should a minimum four trading bloc members that constitute at least 35% of its population coalesce into opposition, the measure would not become law.

Whether the German government is fully committed to voting against Chat Control is yet uncertain, reported Politico. The Ministry of the Interior, which leads Germany’s position on the bill, has not communicated a stance.

The Metropolitan Police Service in London arrested two teenage boys in connection with a ransomware attack and extortion attempt targeting the Kido preschool chain. Officers detained the suspects in the London commuter belt town of Bishop’s Stortford on Tuesday on suspicion of computer misuse and blackmail.

Threat actors demanded 600,000 pounds in bitcoin after stealing sensitive data. Hackers stole information on roughly 8,000 children – including names, addresses, photos and parent contact details – through the preschool’s account on the childcare management app Famly. The app provider said its infrastructure wasn’t compromised (see: Breach Roundup: Hackers Target Kido Preschool Chain, Demand Ransom Over Stolen Children’s Data).

Calling themselves “Radiant,” the attackers reportedly phoned parents to increase pressure and published some stolen images on the darkweb before later claiming to have deleted them.

The ransomware group Qilin claimed responsibility for a Sept. 29 cyberattack on Asahi Group Holdings that halted the Japanese brewery’s lager and pilsner production for days until its Oct. 2 restart.

Qilin said it made off with 27 gigabytes of sensitive data and claims stolen files include employee personal data, financial documents, budgets, contracts and business forecasts.

The disclosure follows Asahi’s admission of a ransomware incident involving an “unauthorized data transfer” and operational disruptions. The attack forced the suspension of order, shipment and customer service operations in Japan.

Qilin emerged as the most active ransomware group of Q3 2025, responsible for 227 attacks, according to ZeroFox. NCC Group reported the gang accounted for 16% of all ransomware incidents in August. Earlier this year, it targeted Shinko Plastics, Nissan Creative Box and Osaki Medical in Japan.

Threat actors with suspected ties to China turned the open-source monitoring tool Nezha into a weapon to distribute the malware Gh0st RAT, compromising more than 100 systems worldwide.

Researchers at Huntress uncovered the attackers using a rare “log poisoning” technique to plant a PHP web shell through a vulnerable phpMyAdmin panel, gaining control of target servers via the AntSword web shell. They deployed Nezha to remotely execute commands and deliver Gh0st RAT.

The campaign, active since at least June, primarily hit systems in Taiwan, Japan, South Korea and Hong Kong, with additional victims in over a dozen countries. Attackers ran their Nezha dashboard in Russian, hinting at operational obfuscation.

The attack chain began with enabling general query logging and injecting a one-line web shell into the log file with a .php extension, allowing remote code execution. Once inside, attackers used PowerShell to disable antivirus protections and install Gh0st RAT through a loader and dropper.

Huntress said the group’s technical sophistication and use of publicly available tools is to lower detection risks and maintain plausible deniability.

Cybersecurity researcher Jeremiah Fowler uncovered a data breach involving Invoicely, a Vienna-based invoicing and billing platform, that exposed nearly 180,000 files containing sensitive personal and financial information. These files, totaling 178,519 records, were found in an unencrypted, non-password-protected database. The exposed data included invoices, images of checks, tax documents and other financial records in formats such as XLSX, CSV, PDF and various image types.

The compromised information encompassed personally identifiable details including names, addresses, phone numbers, tax ID numbers and banking information of service providers, employees and customers worldwide. Additionally, the database contained documents like airline tickets, health insurance receipts and vehicle registration details. While the records appeared to belong to Invoicely, it’s unclear whether the database was managed directly by the company or a third-party contractor.

Following the discovery, Fowler reported the issue to Invoicely via their support system. The company responded by securing the database within hours, preventing further unauthorized access. But Invoicely has not acknowledged the breach publicly or provided a statement.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey and David Perera in Northern Virginia.