Shared Risk, Individual Accountability: Supply Chain Cyber Security in US Insurance

In 2025, two large US insurers disclosed breaches of customer data that did not begin in their own core systems. Allianz Life said attackers had gained access to a third-party, cloud-based customer relationship management system. Farmers Insurance was told by one of its vendors that a database holding Farmers customer information had been accessed. Kroll’s 2026 breach outlook found that nearly seven in ten people affected by the breaches it handled had been exposed through an outside supplier.

Insurers are particularly exposed to this pattern. They hold health, financial and identity information, often in the same customer record. That information passes through many outside providers, a large number of which also serve other insurers. The shared infrastructure even extends to the industry’s regulators. In June 2026, the National Association of Insurance Commissioners, whose systems insurers use to file rates, forms and regulatory reports, confirmed a breach through a flaw in Oracle software that attackers were exploiting before a fix existed.

Regulators have been consistent about where responsibility sits. New York’s Department of Financial Services expects boards and senior management to oversee third-party risk and does not allow ultimate responsibility to pass to a vendor. The NAIC’s draft framework for data and model vendors says that an insurer’s accountability does not transfer to a registered vendor. The risk is increasingly shared across the industry, while the responsibility for managing it stays with each insurer.

This article looks at what that means for security and third-party risk leaders in US insurance. It covers the incidents and threats behind supply chain attacks on insurers, what state and federal regulators expect, where concentration risk builds up across the industry, and how the same risks affect insurers that underwrite cyber coverage. It then sets out practical steps and describes how banks and insurers in the UK have begun to map shared risks together.

‍
Insurers’ growing reliance on outside providers

Outsourcing has always been part of how insurance works, but its scale has grown considerably. Delegated underwriting is one example. AM Best’s annual report put direct premiums written through delegated underwriting authority enterprises at $108.7 billion in 2025, up from $92.3 billion the year before, well ahead of the roughly 5% growth in the wider property and casualty market. Each of those arrangements gives an outside firm access to policyholder data, underwriting systems or both.

Managing general agents are only one part of the picture. A typical insurer depends on outside providers at several levels:

• Technology: cloud infrastructure, core policy administration and claims platforms, customer relationship management software and file transfer tools.
• Operations: third-party administrators, claims administrators, print and mail houses, specialist data services and, for health insurers, pharmacy benefit managers.
• Distribution: brokers, agencies and managing general agents.

New York’s Department of Financial Services identified several of these categories in its October 2025 guidance. It named cloud computing, file transfer, artificial intelligence and financial technology providers as areas where firms’ reliance is growing.

Many of these providers serve dozens of insurers, not one, and that share is rising. AM Best estimated that 57% of US property and casualty premiums written through delegated arrangements in 2024 came from nonexclusive relationships, compared with 33% in 2017. A single administrator, platform or data service can therefore sit inside the operations of a large part of the market.

The chain also continues past the providers an insurer contracts with directly. Those providers depend on hosting companies, software vendors and subcontractors of their own, which the insurer may never have heard of. The 2023 attacks on the MOVEit file transfer software showed how this works in practice:

• Genworth Financial was affected even though it did not use MOVEit itself.
• Its exposure came through PBI Research Services, a vendor that searched death records for Genworth’s life insurance business to meet regulatory obligations, and which did use MOVEit.
• Genworth reported that data on between 2.5 million and 2.7 million policyholders had been stolen.
• PBI connected the attack to other insurers too. Wilton Reassurance reported that around 1.48 million of its customers were affected, including their Social Security numbers.

That single incident involved two layers of the chain. The point of exposure was a specialist provider serving several insurers, and the weakness that attackers exploited sat one step further away, in software the insurers did not run. Most insurers keep a reasonable record of the suppliers they contract with. Far fewer know which of those suppliers share the same underlying providers, or how a failure deep in the chain would reach their own operations and customers.
‍

‍

Recent supplier breaches at US insurers

Several of the most damaging incidents at US insurers since 2025 involved data taken from a platform, vendor or piece of software the insurer depended on, rather than from the insurer’s own core systems.

Customer data held in cloud platforms

The most widely reported example is the 2025 campaign against companies using cloud-based customer relationship management software. Allianz Life said that on July 16, 2025, an attacker used social engineering to access a third-party CRM system and took data on customers, financial professionals and some employees. The company said the incident affected the majority of its 1.4 million customers, and that its internal systems, including its policy administration platform, were not accessed.

Farmers Insurance reported a similar incident. On May 30, 2025, one of Farmers’ third-party vendors alerted Farmers to suspicious activity involving an unauthorized actor accessing one of the vendor’s databases containing Farmers customer information. Its filings with the Maine Attorney General put the combined total affected at 1,111,386 people. Farmers did not name the vendor, but BleepingComputer has learned that the data was stolen in the widespread Salesforce data theft attacks that have impacted numerous organizations this year.
‍

These attacks did not depend on a flaw in the software. Security researchers described attackers calling employees while posing as IT support and persuading them to approve a connection to a legitimate data export tool, which was then used to download records in bulk. Insurers now keep much of their most valuable customer data in cloud platforms they do not operate. Access to those platforms can be obtained by deceiving the insurer’s own staff, without any intrusion into the insurer’s network.

Widely used software at a vendor or affiliate

Older incidents are still producing regulatory consequences. In April 2026, New York’s Department of Financial Services fined Delta Dental Insurance Company and Delta Dental of New York $2.25 million. According to the consent order, the breach involved the MOVEit software used by an affiliate to transfer files containing customer information on behalf of the group. The case shows that an affiliate providing shared services counts as a supplier for this purpose. It also shows that enforcement can follow years after the original incident.

Smaller specialist vendors

Some of the largest exposures involve companies that most policyholders have never heard of. In August 2026, a revenue cycle software provider called Unlimited exposed health insurance and medical data on nearly 3.8 million people, including insurance policy numbers and claims information. The breach was posted to the federal health breach portal almost nine months after it took place.

Shared industry infrastructure

The NAIC confirmed a breach of its Oracle PeopleSoft systems in June 2026. The same campaign reached several other organizations, including the dental insurer DentaQuest. Chapter 5 looks at what this case shows about concentration across the industry.

What these incidents have in common

The methods varied:

• social engineering to reach data in cloud platforms;
• flaws in widely used file transfer and business software; and
• weaknesses at small specialist vendors.

In each case, the attack avoided the controls that insurers invest in most heavily: their own perimeter, endpoints and core systems. Because the same providers serve many organizations, one compromised provider can also lead to breaches at several insurers at once, and to claims from many cyber policyholders. Chapter 6 returns to the second of these effects.
‍

Threats facing insurers in 2026

Three developments have raised the level of supply chain risk for insurers over the past year:

• faster discovery and exploitation of software flaws;
• criminal groups that target platforms used by many companies at once; and
• cyber activity linked to the war with Iran.

Faster discovery and exploitation of software flaws

In May 2026, New York’s Department of Financial Services issued two industry letters on what it called a heightened threat environment. The first concerned frontier AI models and their ability to increase the scale and speed at which vulnerabilities can be found and exploited. The accompanying guidance set out measures firms should consider. These ranged from faster patching of known exploited vulnerabilities to contacting critical third-party service providers to confirm they were aware of the risks and ready to respond to disruption. Lawyers at Norton Rose Fulbright noted that for insurers, this includes third-party administrators, managing general agents, pharmacy benefit managers and claims administrators.

The practical concern is how much time insurers have to respond. When attackers exploit a flaw before the vendor has released a fix, every customer of that software is exposed at once. The Oracle PeopleSoft campaign is one example. According to Google’s threat researchers, the campaign ran from May 27 to June 9, 2026, before Oracle had issued an advisory or patch, and has been attributed to the group known as ShinyHunters.

Criminal groups that focus on shared platforms

ShinyHunters has also been linked to the 2025 attacks on customer relationship management platforms described in chapter 2. Its activity over the past two years follows a consistent approach. Instead of attacking organizations one at a time, it looks for a platform or product that many organizations use and then takes data from as many of them as it can. For insurers, the risk a vendor poses therefore depends partly on how widely that vendor is used, because widely used platforms are more attractive to groups operating this way.

The war with Iran

The war that began on February 28, 2026 has brought Iranian state-backed groups and aligned hacktivists into play. Within days, Reuters reported that financial services firms were on heightened alert for cyberattacks. On March 16, FINRA issued a cybersecurity alert urging member firms to be aware of heightened risks to their environments.

Commercial suppliers with no direct connection to the conflict have been affected. On March 11, an Iran-linked group called Handala claimed responsibility for an attack on Stryker, the Michigan-based medical technology company, which caused a global outage across its systems. Reports said employees’ laptops and phones were wiped. Stryker is a major supplier to hospitals, so the attack also affected organizations that depend on it.

The most serious predictions have not yet been borne out for the financial sector. In its March alert, FINRA said that as of March 16, 2026, FINRA is not aware of any significant Iran-related cyberattacks against the financial services industry, while noting reporting that Iranian groups were actively targeting US financial institutions. The risk remains elevated and adds to the other pressures described above.

Together, these developments reduce the time insurers have to work out which suppliers are affected by a new threat, and they increase the number of suppliers that might be.
‍

Regulatory expectations for third-party oversight

Insurance in the United States is regulated mainly by the states, so a carrier operating nationally answers to many regulators at once. Their rules differ in detail, but on third-party oversight they take the same basic position. An insurer can outsource a service, but it remains responsible for protecting the data and systems involved.

New York

New York’s cybersecurity regulation, known as Part 500, has required regulated firms to maintain written policies for their third-party service providers since 2017. The Department of Financial Services’ October 2025 guidance explains how those policies should apply at each stage of a supplier relationship: due diligence, contract terms, ongoing monitoring and termination. The department said the guidance clarifies existing requirements rather than adding new ones. It also made clear that boards and senior management are expected to take an active part in overseeing third-party risk.

The department has backed this up with enforcement:

• In October 2025, it collected more than $19 million from eight auto insurers whose online quoting tools exposed customer data. It found that Farmers and Infinity failed to timely report their respective cybersecurity events. ny
• In 2026, it fined Delta Dental over the MOVEit breach at its affiliate.
• Also in 2026, it fined a money transmitter whose patching procedures covered only a small number of the third-party applications it used.

Firms regulated in New York should expect examiners to look closely at third-party controls after any incident.

The NAIC model law and differences between states

Outside New York, the main framework is the NAIC’s Insurance Data Security Model Law, which states adopt through their own legislation. It requires licensees to exercise due diligence in selecting third-party service providers and to require those providers to implement appropriate security measures. It also requires notice to the insurance commissioner within 72 hours of determining that a cybersecurity event has occurred.

The model law has been adopted in more than twenty states, though not uniformly. Notification deadlines are one example: it is 3 business days in Ohio and Delaware, and 10 days in Michigan. Regulators have recognized the problem. An NAIC working group is developing a central reporting portal because the current notification process varies so much between jurisdictions. For now, a single supplier incident can start different reporting clocks in different states.

Oversight of data and model vendors

The NAIC is also preparing to deal with some vendors directly. Its Third-Party Data and Models Working Group has drafted a framework for vendors whose data and models insurers use, currently limited to property and casualty pricing and underwriting.

• Registration became voluntary in the July 2026 draft.
• A regulator may still bar insurers from using a vendor’s data or models if the vendor does not provide information on request.
• The insurer’s position is unchanged: its accountability does not transfer to a registered vendor.

Federal rules

Several federal rules apply alongside state law, depending on an insurer’s structure and lines of business:

• Critical infrastructure incident reporting. The Cybersecurity and Infrastructure Security Agency’s final rule under the Cyber Incident Reporting for Critical Infrastructure Act went to the White House for review in October 2026. The proposed version would require covered entities to report significant incidents within 72 hours and ransom payments within 24 hours. Which insurers it covers will depend on the final text.
• SEC Regulation S-P. Insurers with broker-dealer, investment adviser or fund affiliates are affected by the SEC’s amended Regulation S-P. Those affiliates must have procedures to make sure their service providers notify them of a breach within 72 hours.
• HIPAA. Health insurers remain subject to HIPAA’s existing requirements for their business associates. A proposed overhaul of the HIPAA Security Rule would tighten those requirements, with final action currently projected for July 2027.

What these rules have in common

These rules differ in scope, deadlines and enforcement, but they place the obligation in the same place. Whether an incident starts at a cloud platform, an administrator or a supplier’s software vendor, the insurer is expected to have chosen the provider carefully, agreed clear contract terms, monitored the relationship and reported promptly. Our separate guide to US insurance regulation covers the state-by-state detail.
‍

Concentration risk across the industry

Concentration risk arises when many activities depend on the same provider, so that a single failure affects all of them at once. For insurers, it takes two forms, and each calls for a different response.

Concentration risk within an insurer’s own supply chain

An insurer may use several suppliers for its most important services and believe its risk is spread. If those suppliers all rely on the same hosting company, software product or subcontractor, one incident further down the chain can disrupt them together. The same applies to contingency plans. A backup provider gives little protection if it depends on the same underlying provider as the primary one.

An insurer can find this kind of concentration if it knows who its important suppliers depend on. In most cases, that means asking suppliers directly and keeping their answers up to date.

Systemic concentration risk

The second form arises when many insurers rely on the same provider, as in the PBI Research Services case described in chapter 1. The growth of nonexclusive delegated underwriting means more managing general agents now work with several carriers at once, so the pattern is likely to become more common.

This form of concentration is much harder to see. An insurer’s contracts show which providers it uses, but they say nothing about which providers its competitors use. Several insurers can each review their suppliers carefully and still not know that they all depend on the same administrator or software vendor.

The industry’s shared infrastructure

The clearest recent example involves the regulator rather than a commercial vendor. Insurers use NAIC systems to submit rates, forms and regulatory reports to every state. After the June 2026 breach, the group responsible claimed to have taken around 264,000 insurer regulatory filing documents dating from 2017 to 2024. The incident also disrupted the systems insurers depend on. The NAIC later extended filing deadlines by the length of an outage that began on June 17.

The same flaw in the same widely used product reached the industry’s regulator and individual carriers within a few weeks. No insurer could have prevented that through its own vendor reviews, because none of them chose the NAIC’s software.

Which concentrations risk matters most

Not every shared provider is a serious risk. The Bank of England makes this point in its supervisory statement on critical third parties, noting that concentration does not by itself create systemic risk. In practice, the dependencies that deserve most attention are those that many organizations rely on, that are hard to replace quickly, and that do not appear on anyone’s supplier map. A large cloud provider is concentrated but well known and closely scrutinized. A small vendor that supports claims handling at a dozen carriers may pose the greater risk because nobody is looking at it.

Who is in a position to see this risk

In the European Union and the United Kingdom, financial regulators now collect structured data on firms’ suppliers and use it to identify providers that many institutions depend on. US insurance regulators do not currently collect this kind of data across the industry, although the NAIC’s proposed vendor registry is a limited step in that direction. For now, an individual insurer can map concentration within its own supply chain but has no reliable way to see concentration across the market. Chapter 9 looks at how insurers might close that gap by working together. Our separate article on concentration risk in insurance covers these shared dependencies in more detail.
‍

Supply chain risk in cyber underwriting

Insurers that write cyber coverage face supply chain risk from two directions. As companies, they depend on outside providers for their own operations. As underwriters, they insure thousands of businesses that rely on many of the same cloud platforms, software products and service providers. A single incident at a widely used supplier can affect an insurer’s operations and its cyber portfolio at the same time.

How one supplier incident becomes many claims

Kroll’s 2026 breach outlook described the effect on claims directly. Its global cyber insurance lead said that a single supplier breach can lead to dozens or even hundreds of claims from businesses whose only connection is that they use the same provider. When several policyholders are affected by the same incident, claims teams also have to coordinate incident response and breach notifications across them.
‍

Traditional underwriting assumes that losses at different policyholders are largely independent. Shared suppliers weaken that assumption. If a large group of insureds use the same payroll provider, file transfer tool or customer relationship management platform, their losses are correlated, even though they work in different industries and may never have dealt with one another.

How the market sees aggregation risk

Pricing in the US cyber market has been falling. According to Marsh’s latest index, US cyber rates fell by 2% in the second quarter of 2026, matching the decline in the previous quarter. The same report listed third-party software and vendor risks among insurers’ leading concerns.

Specialist carriers and modelers have raised similar points:

• Coalition. In December 2025, the company’s reinsurance unit said the market would need to account for correlations arising from shared software, common vulnerabilities and concentrated cloud use. Another Coalition executive argued that the industry’s focus on single-vendor outages had drawn attention away from the larger risk of many customers being affected by the same event.
• Moody’s. It noted that 2025 did not produce a truly systemic event, but did show how concentration in shared providers can drive losses across many insureds at once. Its example was the coordinated attacks on the UK retailers Marks & Spencer, Co-op and Harrods. The UK’s Cyber Monitoring Centre classified these as a single systemic event, with an estimated impact of between £270 million and £440 million.

The shared dependencies that matter for an insurer’s own security therefore also matter for how it prices and manages its cyber portfolio.

Applying the same standard internally

Cyber underwriters now regularly ask applicants how they manage their vendors. An insurer that asks those questions should be able to answer them about itself. Norton Rose Fulbright made this point after New York’s May 2026 guidance. It observed that an insurer recommending strong third-party controls to its insureds, without having engaged its own administrators and managing general agents, could face difficult questions from regulators and from sophisticated policyholders.

There is a practical benefit too. An insurer that understands its own supplier dependencies, and how they change over time, is better placed to understand the dependencies in the risks it underwrites.

War exclusions and state-linked attacks

The war with Iran has raised a further question for cyber underwriters. State-backed groups often target suppliers and shared platforms, as chapter 3 describes. Whether losses from those attacks are covered depends on how war exclusions are worded and applied. A risk adviser quoted by an industry association in March 2026 noted that most cyber policies contain such exclusions and that attacks attributed to state or state-sponsored actors may not be covered.

How these clauses apply when a state-linked attack reaches a policyholder through one of its suppliers has not yet been tested. Insurers, brokers and policyholders have good reason to clarify it before a major event does. Our separate article on supply chain risk in cyber underwriting looks at these issues in more detail.
‍

The limits of annual vendor questionnaires

Most third-party risk programs in insurance are built around periodic assessments. A supplier completes a security questionnaire when it is onboarded and again at renewal or on an annual cycle, and critical suppliers may also provide audit reports or certifications. This remains a necessary part of due diligence, but the incidents described earlier show where it falls short.

Confidence and evidence

Security leaders tend to be confident about how they would cope with an incident at a critical supplier. In a 2026 survey by SecurityScorecard, 86% of security and risk leaders said they were concerned about supply chain risk. Even so, 90% believed their business could continue operating smoothly if a vendor suffered a cyber incident. The survey covered organizations across industries and countries rather than insurers alone, and it was produced by a vendor. It still suggests a gap between how prepared organizations feel and the evidence they have to support that view.

Over the same period, suppliers have become a larger part of the problem. Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in breaches has doubled to 30%.

What a questionnaire can and cannot show

A questionnaire records what a supplier says about its controls on the day it completes the form. Before the next review, the supplier may:

• adopt new software;
• add a subcontractor;
• lose key security staff; or
• be affected by a newly discovered flaw in a product it relies on.

Unless something prompts an earlier review, the insurer may not hear about any of these changes for months.

Questionnaires have three further limits:

• They rely on the supplier’s own account. Well-run programs check evidence, but most still depend heavily on self-reported answers.
• They duplicate effort on both sides. Each insurer typically uses its own format, so a supplier serving many carriers answers similar questions many times, and the quality of its answers tends to suffer.
• They rarely show who the supplier itself depends on. That leaves the concentration risks described in chapter 5 out of view.

What external scanning adds

Many insurers now supplement questionnaires with external scanning tools, which check a supplier’s internet-facing systems for exposed services, misconfigurations and known vulnerabilities. These tools run continuously and need no input from the supplier, which makes them useful between reviews. They can only see what is visible from outside, though. They cannot show how a supplier manages access, trains staff, tests backups or oversees its own suppliers. Their findings also need checking, because scanners sometimes attribute assets to the wrong company or report problems that do not exist.

Monitoring at the right frequency

The aim is to keep the information from questionnaires current, not to replace them. The National Institute of Standards and Technology’s definition of continuous monitoring does not require real-time oversight of every control. It describes assessing controls and risks often enough to support risk-based security decisions. New York’s guidance takes a similar approach, expecting firms to assess service providers periodically and according to the risk they pose.

In practice, this means matching the level of monitoring to the importance of each supplier, and agreeing in advance which events should prompt a review outside the normal cycle. Typical examples include:

• a supplier reporting an incident;
• a flaw being disclosed in software the supplier uses; or
• a significant change to the supplier’s controls or subcontractors.

A program that cannot respond to these events until the next scheduled assessment is still operating on an annual cycle, whatever its policies say.
‍

Building a stronger third-party program

Most of the steps below reflect what New York’s Department of Financial Services set out in its October 2025 guidance, which follows a supplier relationship from due diligence through contracting and monitoring to termination. The guidance applies formally to firms regulated in New York. It is also a useful reference for insurers in other states, because the NAIC model law asks for similar due diligence without describing it in the same detail.

Rank suppliers by what they can access and what they support

Not every supplier needs the same level of scrutiny. The New York guidance asks firms to weigh the risk a provider poses against how necessary it is, and to consider how much access it will have to systems and data. For an insurer, the highest tier usually includes providers that hold policyholder or claims data, connect to core systems, or support services that would stop operations if they failed. That typically means third-party administrators, managing general agents, claims administrators, core platform vendors and cloud providers. A clear ranking lets a small team focus its time where it matters most.

Find out who your critical suppliers depend on

For suppliers in the highest tier, insurers should ask which providers they rely on to deliver their service, including the software products involved. New York’s guidance points in this direction. Its due diligence considerations include how a provider oversees its own subcontractors. Its suggested contract terms would require a vendor to disclose subcontractors with access to the insurer’s systems or data and allow the insurer to reject some of them.

This information becomes valuable as soon as a new threat appears. An insurer that knows which suppliers use a particular file transfer tool or business application can check on them within hours of a flaw being disclosed. One without that information has to contact every supplier and wait.

Agree in advance how you will be told about incidents

Contracts with important suppliers should set out how quickly an incident must be reported and to whom. The New York guidance lists prompt cybersecurity incident notification to the covered entity among its recommended baseline contract terms. These terms matter for insurers because their own reporting deadlines may depend on them: mondaq

• Under the NAIC model law, a licensee remains responsible for reporting incidents that occur at its service providers.
• Insurers with securities affiliates also face the 72-hour service provider notice requirement in Regulation S-P.

Contract terms are only part of the answer. An insurer should also know the names of the people in each critical supplier’s security team, and those people should know whom to contact at the insurer. In many organizations, supplier contact runs through procurement staff or account managers, who are rarely the right people to call in the first hours of an incident.

Include suppliers in incident response and continuity planning

New York’s guidance asks firms to build third-party risk into their incident response and business continuity plans. It also asks them to review periodically how their providers handle vulnerability management and patching. In practice, this means deciding in advance how the insurer would keep paying claims or servicing policies if a key administrator or platform became unavailable, and testing those plans with the suppliers involved. Tabletop exercises that include third-party administrators, managing general agents and claims administrators often expose problems that internal exercises miss, such as unclear escalation routes or different assumptions about who notifies whom.

Keep information current between formal reviews

As chapter 7 describes, an annual assessment leaves long gaps. Insurers should agree with critical suppliers which changes must be reported between reviews, such as:

• a new subcontractor;
• a significant incident; or
• a change in hosting or key controls.

They should also decide which outside events will lead to an earlier check, such as a flaw disclosed in widely used software. External scanning can help identify issues between reviews, provided its findings are checked before anyone acts on them.

Report to the board in terms it can use

New York’s regulation expects boards to understand cybersecurity well enough to oversee it properly. For third-party risk, board reporting tends to work best when it covers four things:

• the status of the most critical suppliers;
• known concentrations, where several important services depend on the same provider;
• open issues with suppliers and how long they have been open; and
• the insurer’s readiness to respond to a supplier incident.

Counts of completed questionnaires say little about any of these.

Plan for the end of each relationship

The New York guidance stresses that a supplier’s access to systems, including service accounts and application interfaces, should be revoked promptly when a contract ends. Insurers should also confirm that their data has been returned or destroyed. Accounts and connections left active after a relationship has ended are a common and avoidable weakness.

What an individual insurer cannot do alone

These steps give an insurer a much clearer view of its own supply chain, including the concentrations within it. They do not show which providers the wider industry depends on, or which of an insurer’s suppliers are also critical to its peers.
‍

Collaboration between insurers

Some supply chain risks can only be identified by comparing information across several organizations. Chapter 5 described how a provider can be critical to many insurers without any of them knowing. Finding those providers requires insurers to share at least some of what they know about their suppliers.

Where collaboration already happens

Insurers already exchange some security information. Threat intelligence teams at large carriers have shared information for years through industry bodies such as the Financial Services Information Sharing and Analysis Center. That sharing focuses mainly on attackers, their methods and the technical signs of compromise.

Third-party risk teams have generally not worked this way. Each insurer assesses its suppliers separately, with its own questionnaire and its own judgment. A supplier serving several carriers answers similar questions several times, and each insurer holds part of a picture that none of them can see in full.

What insurers could do together

Collaboration on supplier risk does not require insurers to share commercial information about themselves. It can take several forms:

• Comparing dependencies. Insurers can compare which providers sit behind their critical services and identify those that many carriers rely on.
• Sharing assessment work. A supplier can complete one assessment and share it with each of its insurance customers, saving time on both sides.
• Coordinating during incidents. When a widely used product is compromised, insurers that know they share affected suppliers can coordinate their questions instead of each sending separate requests during the supplier’s busiest hours.
• Approaching unresponsive suppliers together. A request from several carriers carries more weight with a supplier than a request from one.

The legal and practical obstacles

Insurers considering this kind of collaboration raise reasonable concerns.

Competition law. Insurers compete with one another, and lawyers advise caution over what is shared. After the federal information sharing law lapsed in 2025, one law firm advised companies to make sure that anything exchanged was not competitively sensitive, such as pricing, future plans or output levels. Information about which suppliers an insurer uses and how secure they are is generally different from pricing or strategy. Collaborating insurers should still agree clear rules on what is shared, with legal advice where needed.

Legal protection for sharing. The Cybersecurity Information Sharing Act of 2015 gives companies liability protection and an antitrust exemption when they share cyber threat indicators and defensive measures. Its status has been uncertain for more than a year:

• It expired on October 1, 2025, during the government shutdown.
• It was restored in November 2025.
• It has since been extended in short steps, most recently to December 11, 2026.

The law covers threat information rather than supplier assessments as such. Its repeated lapses have nonetheless made some legal teams more cautious about security information sharing in general. One industry commentator observed that short renewals do little to repair the trust that information sharing depends on.

Confidentiality. Suppliers may be reluctant to have details of their security controls passed between customers. This works best when the supplier controls what it shares and with whom.

Learning from other markets

These obstacles are not unique to the United States. In the United Kingdom, groups of banks and insurers have begun to compare their supply chains and share supplier assessment work within their own competition and data protection rules. Their experience shows what this kind of collaboration can reveal and where its limits lie.
‍

How UK banks and insurers work together on Risk Ledger

UK financial institutions face many of the same issues described in this article, and their regulators have gone further in requiring firms to show they understand their supply chains. The Prudential Regulation Authority and the Financial Conduct Authority expect banks and insurers to identify and manage the suppliers behind their most important services. From March 2027, firms will need to report serious operational incidents within 24 hours and submit an annual register of the suppliers that support each important business service.

Some of these institutions have chosen to work together on Risk Ledger, a platform built on the idea that supply chain security works better as a shared effort than as many separate ones. Their experience is relevant to US insurers because the underlying problems are the same: shared suppliers, limited visibility beyond direct relationships, and regulators who hold each firm responsible regardless.

One assessment, shared with every customer

On Risk Ledger, each supplier completes a single security profile against a standardized assessment framework. The framework covers twelve areas of security and is mapped to widely used standards, including ISO 27001 and the NIST Cybersecurity Framework. The supplier then shares that profile with each connected customer instead of filling in a separate questionnaire for each one. The supplier owns the profile and decides who can see it.

This reduces the workload on both sides. Suppliers maintain one set of answers, and customers receive information in a consistent format they can compare across their supplier base. When one customer asks a supplier to clarify an answer or provide evidence, the updated profile is visible to every customer connected to that supplier. Several security teams end up reviewing the same supplier against the same framework, which makes it more likely that a weakness missed by one reviewer will be noticed by another.

Keeping information current

Suppliers complete a full reassessment every six months. Between reassessments, connected customers receive weekly updates when a supplier reports a change to its controls, and every change is recorded for the life of the relationship. This follows the approach described in chapter 7: a fixed minimum frequency, combined with updates when something changes.

Suppliers can also use free external scanning of their internet-facing systems. They confirm which assets belong to them and choose whether to share the results with customers. Findings are treated as prompts for investigation rather than final judgments. Any remediation is discussed in the same conversation thread used for assessment questions.

Seeing beyond direct suppliers

Suppliers on Risk Ledger also manage their own suppliers on the platform and list the providers that are critical to the services they deliver. Each customer’s view therefore extends past its direct suppliers to their suppliers and further down the chain, without the customer having to gather that information itself. This gives the visibility recommended in chapter 8, built up across the network instead of through separate requests from each customer.

Communities of peers

Firms in the same sector can form a community on the platform. Members agree to combine their supply chain maps, which shows the providers several members depend on but none could identify alone. They can also:

• share their reviews of common suppliers and the risks they have raised; and
• approach a shared supplier together when it is slow to respond.

Each member decides what it contributes, and a supplier’s information is shared only on the terms the supplier has agreed.

What one UK community found

A community of eight UK financial institutions gives an example of what this kind of comparison can show. Starting from 98 direct supplier relationships across the group, the combined maps identified:

• 776 fourth-party suppliers;
• 92 potential concentration risks, 62 of them at the fourth-party level or further down the chain, where no individual member had previously been able to see them; and
• fourteen direct suppliers each connected to at least half of the institutions in the group.

These are Risk Ledger’s own figures and have not been independently validated. They also describe concentration within that group of eight, not across the UK financial sector as a whole. They do show something an individual firm cannot find on its own: a large share of the dependencies that matter sit beyond the suppliers each firm contracts with directly. Our paper on UK operational resilience and third-party risk in banking describes this work in more detail.

Responding to new threats

When a major vulnerability or outage affects widely used software or services, Risk Ledger publishes it to the network, usually within a day. Suppliers are asked whether they are affected and to update their status as they investigate and fix the problem. Each customer can see which of its suppliers have responded and which may be affected, including suppliers further down the chain.

During the CrowdStrike outage in July 2024, Risk Ledger informed more than 7,000 organizations, and nearly 2,000 suppliers responded within 48 hours. These are again our own figures. Because the request is sent once through the platform, each supplier answers it a single time instead of fielding the same question from every customer during its own response.

What this means for US insurers

The UK experience addresses several of the issues raised earlier in this article:

• Assessment effort. A shared, standardized assessment reduces the duplicated effort described in chapter 7.
• Visibility. Seeing beyond direct suppliers supports the concentration analysis described in chapters 5 and 8.
• Incident response. Faster answers from suppliers early in an incident help insurers meet the notification deadlines described in chapter 4.
• Underwriting. For insurers that write cyber coverage, a clearer view of shared dependencies is also relevant to the aggregation risks described in chapter 6.

The limits of this approach

A network map contains only what its participants contribute. A supplier that has not joined, or has not listed its own suppliers, leaves a gap. A community’s combined view covers its members, not the whole industry. Supplier responses during an incident can take days rather than hours and still need to be checked. Insurers will continue to test directly the controls that matter most to them. None of this replaces an insurer’s own judgment or its regulatory obligations, which remain with the insurer.
‍

Conclusion

The breaches at Allianz Life and Farmers that opened this article did not begin in the insurers’ own core systems, yet both companies had to notify customers and regulators, deal with the consequences and answer for what happened. Every insurer is in a similar position. The suppliers, platforms and software it depends on are increasingly shared with the rest of the industry, while responsibility for protecting its customers and systems remains its own.

Insurers can respond in two ways:

• Within their own programs. They can rank suppliers by what they can access, find out who their critical suppliers depend on, agree incident notification terms and security contacts in advance, and keep their information current between formal reviews.
• Together. They can compare dependencies, share assessment work and coordinate during incidents. This is the only practical way to see concentration across the industry, and the UK experience suggests it can be done within the limits of competition and confidentiality rules.

For security and risk leaders preparing for their next board or committee discussion, three questions offer a useful test of where their program stands:

1. If a flaw were disclosed tomorrow in a widely used piece of business software, how long would it take us to know which of our critical suppliers are affected, including the suppliers they rely on?
2. Which of our critical services depend, directly or further down the chain, on the same provider, and what would happen if that provider failed?
3. For each of our most important suppliers, do we know who to call in their security team, and do they know who to call in ours?
   ‍

Frequently asked questions

Does the NAIC Insurance Data Security Model Law apply to third-party vendors?
The model law applies to licensees, meaning insurers and other entities licensed by state insurance departments, rather than directly to their vendors. Licensees must exercise due diligence in selecting service providers and require them to put appropriate security measures in place. The model law also sets rules for reporting incidents that occur at service providers, so a vendor’s breach can create reporting obligations for the insurer.

What does New York require of insurers’ third-party service providers?
New York’s cybersecurity regulation requires regulated insurers to maintain written policies covering their service providers. The Department of Financial Services’ October 2025 guidance explains how to apply those policies at each stage of a supplier relationship. It recommends contract terms covering access controls such as multifactor authentication, encryption, and prompt notification of incidents. It also suggests requiring vendors to disclose subcontractors with access to the insurer’s systems or data.

How quickly must insurers report a cybersecurity incident?
It depends on the state and the type of entity. The NAIC model law sets a 72-hour deadline for notifying the insurance commissioner, but some states differ. Ohio and Delaware allow three business days, and Michigan allows ten days. New York has its own 72-hour requirement, and additional federal rules may apply to insurers with securities affiliates or health insurance business.

What is concentration risk in insurance supply chains?
Concentration risk arises when many activities depend on the same provider, so that one failure affects all of them at once. It can occur within a single insurer, for example when several of its important suppliers rely on the same hosting company or software. It can also occur across the industry, when many insurers depend on the same administrator, platform or vendor. The second kind is harder to see, because no insurer can see which suppliers its competitors use.

How often should insurers reassess their critical vendors?
No single frequency suits every supplier, and regulators generally expect a risk-based approach rather than a fixed schedule. A common practice is a full assessment at least once a year for critical suppliers. This is combined with agreed triggers for an earlier review, such as a supplier incident, a significant change to its controls or subcontractors, or a newly disclosed flaw in software the supplier uses.
‍

Sources

Regulators and official sources

• New York State Department of Financial Services, guidance on third-party service providers, October 2025
• New York State Department of Financial Services, letter on frontier AI models, May 2026
• New York State Department of Financial Services, guidance on a heightened threat environment, May 2026
• New York State Department of Financial Services, penalties against eight auto insurers, October 2025
• New York State Department of Financial Services, Delta Dental consent order, April 2026
• New York State Department of Financial Services, Order Express penalty, August 2026
• National Association of Insurance Commissioners, model law adoption map, October 2026
• National Association of Insurance Commissioners, proposal for a central incident reporting portal
• National Association of Insurance Commissioners, Third-Party Data and Models Working Group
• FINRA, alert on heightened threats from Iranian cyber actors, March 2026
• Bank of England Prudential Regulation Authority, supervisory statement SS6/24, November 2024
• National Institute of Standards and Technology, definition of continuous monitoring
• Congressional Research Service, report on the Cybersecurity Information Sharing Act of 2015, updated September 2026

Industry research

• AM Best, report on delegated underwriting authority enterprises, 2026
• Verizon, 2025 Data Breach Investigations Report
• Kroll, Data Breach Outlook 2026, as reported by Help Net Security
• SecurityScorecard, 2026 third-party risk report
• Moody’s, cyber concentration risk modeling
• Coalition, 2026 cyber outlook, as reported by Reinsurance News
• Marsh, Global Insurance Market Index, as reported by Insurance Business
• Risk Ledger, UK operational resilience and third-party risk in banking, October 2026

Legal commentary

• Norton Rose Fulbright, commentary on New York’s heightened threat guidance, June 2026
• Norton Rose Fulbright, commentary on New York’s third-party guidance, October 2025
• Steptoe, update on the federal incident reporting rule
• Kroll, summary of the Regulation S-P amendments
• McDermott Will & Schulte, update on the HIPAA Security Rule

News reporting

• BleepingComputer, Allianz Life breach, July 2025
• BleepingComputer, Farmers Insurance breach, August 2025
• SecurityWeek, NAIC breach, 2026
• Insurance Business, NAIC deadline extensions, 2026
• Insurance Business, Unlimited breach, 2026
• GovInfoSecurity, Oracle PeopleSoft campaign, 2026
• Insurance Journal (Reuters), financial services on alert during the war with Iran, March 2026
• MDDI, attack on Stryker, March 2026
• Cybersecurity Dive, MOVEit breach at Genworth, June 2023
• Help Net Security, MOVEit breach at PBI Research Services, June 2023

‍