Carriers, agencies, and administrators hold policy files, claim notes, and the logins that move premium and pay losses. DarkThreat watches external sources for stolen credentials and leaked files so the security team can act while those systems are still under company control.
An insurance file is useful twice. It identifies a person, and it describes money in motion: a premium, a claim payment, or a policy change. Four patterns show up around that file.
A policy application, a loss run, an adjuster note, and a medical attachment are compact and specific. A property file can include an address, a mortgagee, and a reconstruction estimate. A workers compensation or health claim can include a diagnosis, a wage, and a provider.
A life or annuity file can include a beneficiary and a payment instruction. Once a copy leaves the claims or policy system, it can be offered in a forum or described on a ransomware leak site under the carrier or agency name.
The copy usually starts with a login, not with a dramatic break of the mainframe. An adjuster laptop, a shared claims mailbox, or a portal session saved in a browser is enough. The person who takes the file does not need the whole book. A sample of claim PDFs is enough to prove the intrusion and to pressure the company, and it is enough for someone else to try fraud against the policyholder.
DarkThreat helps by watching for the carrier name, agency names, and program names on leak sites, paste sites, and underground posts. The policy admin system and the claims platform stay under the access controls the company already runs. An external finding is a reason to look there.
Producers sit between the customer and the carrier. They quote, bind, collect premium, and open claims. Their logins reach agency management systems, carrier portals, comparative raters, and ordinary email.
A password stolen from a producer laptop can be replayed against those tools. The same password is often the one used for the mailbox that receives loss notices and payment instructions.
That mailbox is a practical fraud path. A message from a real agency domain can ask a premium finance company to change a draft, or ask an insured to pay a lookalike account. The carrier may never see the message if the agency domain is the one that was taken. A watch limited to the carrier primary website misses the agency domain, the wholesaler domain, and the portal hostname where the producer actually works.
DarkThreat helps when those domains and portal hostnames are on the watch list. It does not sit inside the agency management system. Resetting the producer account, checking recent binds, and warning the insured are actions the carrier or the agency takes on its own systems. Remote access used by producers is covered in leaked VPN credentials.
Much of the work is done by someone else. A third-party administrator handles claims. A managing general agent binds on the carrier paper.
A call center, a print vendor, a medical bill reviewer, or a premium finance company holds nonpublic information or a login the carrier issued. Section 4 of the NAIC Insurance Data Security Model Law treats third-party service providers as part of the licensee information security program, and 23 NYCRR 500.11 requires a written third-party service provider security policy for NYDFS covered entities. The operational fact is simpler: the file can leave through a company that is not the name on the policy.
What you can register with a dark web watch is narrower than the contract. Portals the carrier operates, and email domains it controls, can go on the list. A hostname that belongs only to the administrator cannot be monitored as if it were the carrier network. The useful step is to record the accounts you issued to that administrator, the program names that would identify a leak, and the notice path in the contract when the administrator sees an event first.
Two registered notes go further on vendor logins: third-party vendor credential monitoring and supply-chain credential leaks.
Ransomware crews do not need to understand underwriting. They need a login, a file share of claim PDFs, and a leak site. Encrypting the agency or the carrier office systems can stop quoting, issuing checks, and answering insureds.
Copying the files first, then posting a sample, adds a second demand: pay, or the claim notes stay public. That sequence is why stolen credentials and leak-site posts belong in the same watch. A credential leak is a documented step toward ransomware, and double extortion is the pattern of stealing files and then posting them.
DarkThreat helps by flagging company credentials in stealer logs and posts that name the carrier or agency on ransomware leak sites. It does not restore a claims system or negotiate a payment. Those decisions stay with the company, its counsel, and its regulators. For how leak sites are used as pressure, see monitoring ransomware leak sites.
Six exposure types a carrier, agency, or administrator security team can investigate from an external alert.
Applications, loss runs, medical notes, and payment records copied out of claims or policy systems and posted or offered outside the company.
Passwords for carrier portals, agency management systems, and producer email that can be replayed against quoting and binding tools.
Credentials and files at a claims administrator, MGA, or outsourced call center that still point back to the carrier book of business.
Leak-site posts that name the carrier or agency and describe stolen claim files, used to pressure payment and to prove the copy exists.
Fake login pages that imitate a carrier or agency site in order to collect another round of customer and staff passwords.
A stolen agency mailbox used to redirect premium payments, change loss payees, or send a fraudulent binder.
This watch is external. DarkThreat looks for identifiers you provide in places stolen data is posted or sold: stealer-log collections, credential lists, forums, paste sites, and ransomware leak sites. It answers questions a security lead at a carrier or an agency can act on.
Did an adjuster, underwriter, or producer password for your domain show up in a stealer log? Did a quoting or claims portal account you operate appear in a credential list? Is the carrier, an agency, or a program name on a ransomware leak site, with claim files or policy lists described?
Is someone offering access to the network, or offering files that match a book of business, in a forum post? Are lookalike domains imitating a policyholder portal in order to collect more passwords?
The same watch will not show activity inside the policy admin system, the claims platform, or the administrator data center. Those stay with the teams that run them. An external finding is a reason to disable the account, review recent policy changes and payments, and start the incident record the applicable statute expects the licensee to keep.
Scope the identifiers with the people who know the book. Information security knows the corporate domains and the VPN. Distribution knows which agency and MGA domains connect to carrier portals.
Claims knows which administrator program names would be sensitive in a public post. DarkThreat helps once those names are on the watch list. It cannot guess a private administrator hostname that nobody registered.
Employee, adjuster, and producer logins for domains you register, including accounts reused from a laptop onto a policy or claims portal.
Usernames for quoting, billing, and claims portals the company operates, so a leaked portal password is visible to the security team.
Domains and program names for administrators and MGAs you can actually register. Access that lives only on their network is a contract topic, not a host you can see inside.
Posts that name the carrier, an agency, or a program, including descriptions of claim files, policy lists, or medical attachments.
Underground posts offering network access or files that match product, agency, or program names you asked DarkThreat to watch.
Published plans include email notifications and web UI access, so a finding can be read without a separate integration project.
The useful version of this work is ordinary security operations. Someone names the identifiers, someone reads the alert, someone resets the account on systems the company already runs, and someone keeps the record.
Start with identifiers you can share. That list usually includes carrier domains, agency domains you control, portal hostnames, and program or agency names that would be meaningful in a leak. An administrator system you do not operate is a contract and a notice clause, not a network to pretend you can see inside.
When a match appears, published plans include email notifications and web UI access, so the security contact can read the finding directly. Triage by role. A password for a producer who can bind is a different hour of work from a password for a marketing alias.
The team resets the account, checks whether that identity changed a policy, a loss payee, or a payment instruction, and looks for a second account from the same person. DarkThreat helps by putting the external finding in front of that team. The reset and the log review happen inside the company environment.
Keep the alert, the time, the account, and the action you took. Stolen logs are copied, so leave the same identifiers on the watch list and look for a repost after the reset. Where 23 NYCRR Part 500, an enacted version of NAIC model 668, or GLBA safeguards apply, that record can support the investigation and notice duties in those texts.
The record helps the people who own the program. DarkThreat does not make the organization compliant with any of them.
Carrier domains, agency domains you control, portal hostnames, and program names that would matter if they appeared in a stolen-data post.
A security contact reviews the finding in the web UI or from the email notification included on published plans.
The carrier or agency resets the account on its own systems and checks whether that identity was used on a portal or mailbox.
Save the alert, the account, and the action taken so it can support an incident record. The record helps. It is not a certification.
These requirements apply to defined licensees, not to every company that sells a policy. DarkThreat supports external exposure awareness inside a program the company already runs. Using DarkThreat does not make an insurer, agency, or administrator compliant.
23 NYCRR Part 500 is the New York Department of Financial Services cybersecurity regulation. It applies to covered entities that operate under a license, registration, charter, certificate, permit, accreditation, or similar authorization under the New York Banking Law, Insurance Law, or Financial Services Law. That includes many New York licensed insurers, agents, and brokers.
It does not, by itself, cover an insurer that is not a NYDFS covered entity. Section 500.19 lists exemptions. The department posts the text at dfs.ny.gov/cybersecurity/23-NYCRR-Part-500.
Section 500.2 requires a cybersecurity program. Section 500.11 requires written policies for information systems and nonpublic information accessible to or held by third-party service providers. Section 500.16 requires incident response and business continuity plans, and it names ransomware as a disruptive event those plans must address.
Section 500.17(a) requires notice to the superintendent as promptly as possible and in no event later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, an affiliate, or a third-party service provider. DarkThreat helps when a stolen credential or a leaked file is the event that starts that work. It does not file the notice, and it does not make a covered entity compliant with Part 500.
NAIC model 668, the Insurance Data Security Model Law, is a model for state legislatures. It is not a statute in a state until that state enacts it, and the enacted text can differ from the model. The model applies, where adopted, to licensees of the state insurance department, including insurers and producers as the state defines them. Section 4 requires a written information security program, including oversight of third-party service providers.
Section 5 requires investigation of a cybersecurity event, including an event in a system maintained by a third-party service provider. Section 6 requires notice to the commissioner as promptly as possible but in no event later than 72 hours from a determination that a cybersecurity event has occurred, when the model criteria are met. One of those criteria, as written in the model, is a reasonable belief that nonpublic information of 250 or more consumers residing in the state is involved and that an additional harm or notice condition is met. The state statute controls.
NAIC publishes an adoption status brief, current as of the date on that brief: Insurance Data Security Model Law implementation. A drafting note in model 668 says the drafters intend that a licensee in compliance with 23 NYCRR 500 is also in compliance with the model. That note does not extend Part 500 to other states, and it does not mean a dark web watch satisfies either text. DarkThreat helps a licensee notice external copies of credentials and files so the investigation in Section 5 can start from a concrete finding.
The Gramm-Leach-Bliley Act treats insurance as a financial activity. 15 U.S.C. 6801 requires financial institutions to respect the privacy of customers and to protect the security and confidentiality of customer nonpublic personal information. 15 U.S.C. 6805 assigns enforcement for persons engaged in providing insurance, under state insurance law, to the applicable state insurance authority. GLBA is relevant to an insurer or producer that is a financial institution holding customer nonpublic personal information. It is not a substitute for Part 500 or for a state data security statute, and it does not apply the same way to every vendor that touches a claim file.
DarkThreat helps by surfacing stolen logins and leaked files that contain that customer information. The safeguards program, the privacy notice, and any customer notice stay with the institution and its state insurance regulator. DarkThreat does not make an institution compliant with GLBA.
Health plans and other health insurers that are HIPAA covered entities also protect protected health information under that statute. Many carriers map enterprise IT to the NIST Cybersecurity Framework and operate an ISO/IEC 27001 information security management system beside the insurance-specific program. DarkThreat helps those efforts with external credential and file-exposure evidence the security team can attach to its own risk record.
The guides below describe those frameworks. They are not a statement that DarkThreat creates a certified management system or a HIPAA compliance program.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Tell us which carrier domains, agency portals, and program names you need watched.
