Scattered Spider Targeting American Insurance Firms

A hacking collective behind recent cyberattacks on major British retailers has pivoted to target U.S. insurance firms, warned Google.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

John Hultquist, chief analyst at Google Threat Intelligence Group, said Tuesday the company is “aware of multiple intrusions” against insurance companies in the United States that are potentially linked to Scattered Spider.

Scattered Spider, tracked as UNC3944 by Google, is a financially motivated threat group consisting largely of English-speaking adolescents based in the U.S. and the United Kingdom. The group is suspected behind the May cyberattacks of British retailers Marks & Spencer, Co-op and Harrods (see: Retail Sector in Scattered Spider Crosshairs).

“Given this actor’s history of focusing on one sector at a time, the insurance industry should be on high alert, especially for social engineering schemes targeting help desks and call centers,” Hultquist said.

The warning follows service outage disclosures by two major U.S. insurers last week.

Philadelphia Insurance Companies is experiencing network issues affecting its phone, email systems and online systems. The company took its systems offline after its security team detected an unauthorized access on June 8.

Around the same time, Erie Insurance made a similar disclosure.

Scattered Spider first emerged in mid-2022 from a cybercrime forum called “The Community,” or “The Com,” and has since been linked to high-profile attacks on more than 130 companies, including MGM Resorts, Clorox and cryptocurrency exchange Coinbase.

The group primarily relies on social engineering tactics such as SIM-swapping and phishing that often impersonate help desk staff to bypass multi-factor authentication protections.

Despite law enforcement targeting its members, Scattered Spider appears to have expanded its operations across retail and other sectors in the U.S. and Europe, Google said previously. The group’s affiliate model further enables it to regroup and evade detection despite police action.

The rise of English-speaking cybercriminal groups including Scattered Spider can be partly attributed to Western law enforcement crackdown on Russian-speaking cybercrime syndicates such as LockBit, a U.K. cybersecurity official said earlier this month. Police action fragmented Russian-speaking groups and sowed distrust among hackers, emboldening Scattered Spider and other similar groups, said Jeremy Banks, a City of London policeman who serves on the British National Police Chiefs Council’s Cyber Crime Team (see: LockBit Crackdown Fragmented Russian Cybercrime Groups).

It is essential that organizations start with cybersecurity fundamentals to prevent potential Scattered Spider hacks, said Jon Abbott, CEO of ThreatAware.

“Accurate asset inventories, tamper-proof identity verification and hardened service desk processes are all essential,” Abbott said. “Security teams must also monitor for behavioral anomalies, like unexpected access requests or administrative changes, rather than just relying on traditional malware detection.”