Insurance is in the attackers' sights, and APRA is watching the controls.
Four insurers compromised in weeks. A $250 million APRA capital adequacy increase after Medibank. CPS 230 in force. The regulatory environment and the threat environment moved in the same direction at the same time.
Why Insurance is in the crosshairs
Five shifts shaping the Insurance threat environment — from attacker tradecraft to the regulatory trajectory that is closing the gap between what controls look like on paper and whether they actually work.
Scattered Spider turned to insurance, and the tradecraft is social engineering
Across June and July 2025, Erie Insurance, Philadelphia Insurance, Aflac and Allianz Life all disclosed incidents, as Google Threat Intelligence Group warned of intrusions bearing the hallmarks of Scattered Spider. The tradecraft Google flagged was social engineering of help desks and call centres, not software exploitation. Allianz Life was reached through a third-party cloud CRM.
Insurers concentrate the data attackers want — and intelligence about everyone else's security
Life insurance holds detailed health records. General insurance holds property, asset, and location data. Cyber insurance holds the detailed cybersecurity architecture of the insured parties themselves. Kroll's framing captured the double exposure — concentrated PII plus concentrated intelligence about other targets. Aflac's final figure reached approximately 22.6 million individuals globally — about 13.9 million of them in the United States.
APRA put a capital number on cyber weaknesses
APRA applied a $250 million increase to Medibank's capital adequacy requirement to reflect weaknesses identified in its information security environment. Separately, APRA's tripartite CPS 234 programme covers more than 300 banks, insurers and superannuation trustees; the first tranche found common gaps, including limited assessment of third-party information security capability and inadequate definition and execution of control testing.
CPS 230 adds cyber-adjacent resilience requirements that CPS 234 did not
Since 1 July 2025, APRA-regulated entities must identify critical operations (for insurers, including claims processing and customer enquiries), set tolerance levels for each, and test business continuity plans against severe but plausible scenarios, including disruption at material service providers. A completed material service provider register was due to APRA by 1 October 2025.
FAR extended to insurance and superannuation — the personal exposure is now direct
Since 15 March 2025, the Financial Accountability Regime has applied to insurers and superannuation trustees. Accountable persons, including the one responsible for information management and IT systems, must take reasonable steps within their responsibilities, with disqualification and deferred remuneration on the line.
What experts are saying
Google Threat Intelligence Group is now aware of multiple intrusions in the US which bear all the hallmarks of Scattered Spider activity. We are now seeing incidents in the insurance industry. Given this actor's history of focusing on a sector at a time, the insurance industry should be on high alert, especially for social engineering schemes, which target their help desks and call centers.
The network security of each company — [insurers] are so detailed on the cybersecurity each company has. What a wealth of knowledge to have to know how to attack the next company or industry, or develop tools to go in and attack.
This attack, like many insurance companies are currently experiencing, was caused by a sophisticated cybercrime group… This was part of a cybercrime campaign against the insurance industry.
CPS 230 is in force and FAR now covers insurers
Since 1 July 2025, APRA CPS 230 has required tolerance levels for critical operations and business continuity testing against severe but plausible scenarios. Since 15 March 2025, the Financial Accountability Regime has applied to insurers and superannuation trustees, and accountable persons, including the one responsible for information management and IT systems, face disqualification and deferred-remuneration consequences.
APRA CPS 234 (Information Security) applies to all APRA-regulated insurers — general, life, private health — and superannuation trustees, with group-wide extension and Australian branch coverage for foreign entities. Paragraph 27 requires systematic testing of control effectiveness commensurate with the rate of change of the environment, the criticality of assets, and the threat environment. CPS 230 (Operational Risk Management) came into force on 1 July 2025 and requires tolerance levels for critical operations and business continuity testing against severe but plausible scenarios. The Financial Accountability Regime extended to insurance and superannuation on 15 March 2025, making named accountable persons answerable for their areas of responsibility, with disqualification and deferred-remuneration consequences. The Cyber Security Act 2024 (mandatory ransomware payment reporting) and the Privacy Act / NDB scheme apply in parallel. Some insurers also adopt ISO 27001 and the Essential Eight voluntarily as CPS 234-supporting frameworks.
Source: APRA — CPS 230 Operational Risk Management
Principles-based information security standard applying to all APRA-regulated insurers and superannuation trustees. Paragraph 27 (testing effectiveness of controls) is the direct hook for continuous validation.
A structured framework some insurers use alongside CPS 234, and one their service providers may be asked to hold.
Where NodeZero applies
Not mandatory for insurers, but a common operational baseline.
Where NodeZero applies
Standard service organisation control report for insurtechs, TPAs, claims handlers, and cloud platforms providing services into APRA-regulated entities.
Where NodeZero applies
Insurers hold concentrated PII, payment data, and sensitive health and claims information subject to the Australian Privacy Principles and the NDB scheme.
Where NodeZero applies
Mandatory ransomware payment reporting within 72 hours for insurers, brokers, MGAs, TPAs, and insurtechs over $3M turnover.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
APRA CPS 230 — Operational Risk Management
1 Jul 2025In force since 1 July 2025. Requires tolerance levels for each critical operation (for insurers, including claims processing) covering maximum disruption period, data loss and minimum service levels, and a systematic program testing business continuity plans against severe but plausible scenarios, including an annual exercise. The board approves the plan and tolerance levels. A completed material service provider register was due to APRA by 1 October 2025. Pre-existing service provider contracts had to comply by the earlier of next renewal or 1 July 2026.
Source: APRA — CPS 230Financial Accountability Regime (FAR) — insurance and superannuation
15 Mar 2025Applies to insurers and superannuation trustees from 15 March 2025. Accountable persons must take reasonable steps within their areas of responsibility, which include information management and IT systems. Disqualification and deferred remuneration are the individual consequences.
Source: APRA — Financial Accountability RegimeCyber Security Act 2024
30 May 2025Mandatory ransomware payment reporting within 72 hours for entities over $3M turnover. If an APRA-regulated insurer makes a ransomware payment, the Cyber Security Act report to ASD sits alongside any CPS 234 72-hour notification to APRA.
Source: Cyber Security Act 2024Privacy Act reform — statutory tort and expanded enforcement
2024–2026Introduction of a statutory tort for serious invasions of privacy, expanded OAIC enforcement powers, and new privacy-policy transparency obligations for automated decisions (from December 2026). Insurers — whose models increasingly incorporate algorithmic underwriting and claims decisioning — face a sharper regulatory environment. Both the OAIC and APRA took action following the Medibank incident.
Source: OAIC — Notifiable Data Breaches SchemeNodeZero produces continuous testing evidence for CPS 234 paragraph 27.
CPS 234 and CPS 230 obligations extend well beyond control testing — they cover policy, governance, operational risk and tripartite reporting. NodeZero addresses the control-testing obligation: the systematic testing paragraph 27 requires, run continuously rather than once a year. Drochaid's control-by-control CPS 234 coverage kit shows where that evidence applies.
Find your organisation
See how the changes affect you specifically
General, life & health insurers
APRA-regulated insurers carrying full CPS 234, CPS 230, and FAR obligations — with concentrated PII, health, and claims data exposure.
View details →Superannuation trustees
RSE licensees managing concentrated member data and payment authorities. Targeted through the 2025 credential-stuffing wave, after which APRA told RSE licensees to self-assess their authentication controls against CPS 234 by 31 August 2025.
View details →Brokers, MGAs & insurtech
Not APRA-regulated directly, but embedded in APRA-regulated supply chains under CPS 234 third-party obligations and CPS 230 material service provider requirements.
View details →Why security teams trust NodeZero
References
Everything cited on this page — regulator reports, incident coverage, and official framework documentation.
See what an attacker could reach before your tripartite assessor asks
See what an attacker could reach in your environment, and where NodeZero produces evidence for CPS 234 paragraph 27