Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
When a group that works one industry at a time reached U.S. insurers in June 2025, threat intelligence turned into a date. Institutions needed a pre-agreed surge mode: a named trigger, tighter help-desk rules for weeks, and containment planned around compromised identity.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On June 16, 2025, Google’s threat intelligence group said publicly that it was tracking multiple intrusions at U.S. insurance companies with the hallmarks of Scattered Spider, the loosely organized group linked that spring to attacks on British retailers including Marks & Spencer and the Co-op. Several insurers disclosed incidents around the same time. Philadelphia Insurance Companies disconnected systems after detecting unauthorized access on June 9. Erie Insurance reported a cybersecurity event and outage in a securities filing on June 11. On June 20, Aflac disclosed that it had found suspicious activity on its network on June 12 and stopped the intrusion within hours. Researchers noted the group’s habit of concentrating on one sector at a time, often by talking IT help desks into resetting passwords and multifactor authentication.
Most threat intelligence arrives as a stream of indicators and advisories that security teams triage alongside everything else. The June 2025 warnings were different in kind. They described a capable group working through one industry at a time, using techniques it had refined on the last one. For an insurer that had not yet been hit, the warning carried an implicit date. For banks, broker-dealers and wealth managers, it was a rehearsal: the next rotation could be theirs. Turning that kind of warning into action needs three things agreed in advance. They are a trigger that declares a surge, a set of identity controls tightened for the surge window, and a containment plan built around the attack that still gets through.
A trigger that declares a surge
The pattern was visible before June. Scattered Spider had disrupted UK retailers in April and May, and researchers had described its habit of staying in one sector for a period before moving on. Once Google’s warning was public and several insurers disclosed incidents within days of each other, any insurer not yet affected could infer it was in the same target pool.
Many security programs cannot act on that inference because it fits none of their processes. It is not a feed of malicious IP addresses or file hashes that tooling can ingest. It is a judgment about attacker intent. Acting on it requires a named executive, usually the CISO, with authority to declare a surge period, and written criteria for doing so. Reasonable criteria include a credible public warning naming the institution’s sector, confirmed incidents at peers, or an alert through FS-ISAC. The declaration should carry a start date, an end date and a list of pre-approved actions. Without those, the warning gets noted and filed, and the business pushes back on each control change one at a time.
The trigger should also define the peer set. A regional bank may decide that a warning about insurers does not trip its surge, while a warning about credit unions or card issuers does. A wealth manager with a large call center may treat any finance-sector warning about help-desk fraud as relevant. Writing this down removes the debate from the moment of pressure. It also makes the decision auditable afterward: the board and examiners can see what criteria existed, whether they were met and what the institution did next.
Identity controls tightened for the surge window
The group’s methods were well documented by mid-2025. Callers posed as employees, using personal details found online, and persuaded help-desk staff to reset passwords or enroll new authentication devices. SIM swapping and repeated push prompts defeated weaker multifactor methods. Once inside, intruders moved quickly to identity platforms and virtualization consoles, and in some cases deployed ransomware.
That makes the surge list short and concrete. Help desks should stop resetting credentials on the strength of facts an attacker can research, such as an employee ID or a manager’s name. During the surge, resets can require a callback to the number already on file, a video check against a government ID, or manager approval for privileged accounts. Self-service password and device enrollment for administrators can be suspended. Phishing-resistant authentication, such as FIDO2 security keys or device-bound passkeys, should cover administrators and help-desk staff first. Detection rules should alert on new device enrollment for privileged accounts, on password resets followed within minutes by sign-ins from new locations, and on unusual activity in identity and hypervisor consoles.
Each of these adds friction. Locked-out employees wait longer, and the help desk handles angrier calls. That friction is the reason to agree the list in advance and limit it in time. A surge measured in weeks is something business leaders will accept. An open-ended tightening invites exceptions, and one exception granted to a convincing caller on a busy morning undoes the rest. Help-desk metrics also need adjusting for the period, so that staff are not judged on call-handling speed while being asked to slow down.
Containment built around the attack that gets through
Determined social engineering sometimes succeeds against good defenses. Aflac said it stopped its intrusion within hours, yet it still faced a review of what data had been taken. Speed of detection limits damage. It does not remove the need to plan for theft.
Containment plans should assume the identity platform itself is under attacker control. That means break-glass administrator accounts held outside the main directory, an out-of-band channel for the response team if corporate email and chat may be watched, and isolated, tested backups of identity and virtualization infrastructure. It also means deciding in advance who can authorize disabling single sign-on or cutting network connections, because those decisions stop business activity.
Notification planning belongs in the same exercise, because the clocks differ by regulator. Insurers and banks licensed in New York must notify the Department of Financial Services within 72 hours of determining certain cybersecurity events under its Part 500 regulation. Many states have adopted insurance data security laws based on the NAIC model. Public companies must assess materiality for Form 8-K disclosure. Insurers that hold health information may also have HIPAA breach obligations. Counsel should confirm which apply. Drafting the decision tree before a surge saves hours when the clocks start.
With hindsight
The rotation continued. In late June 2025, the FBI warned that the group had turned to airlines, and several carriers disclosed incidents. On July 10, the UK’s National Crime Agency arrested four people in connection with the retail attacks. On July 29, CISA and partner agencies updated their joint advisory on Scattered Spider with newer techniques. Later in 2025, actors from the same broad ecosystem were tied to large-scale data theft from cloud customer relationship platforms.
The insurance intrusions proved costly even where they were contained quickly. In December 2025, Aflac began notifying about 22.65 million people that personal and health information had been taken, according to its breach notification filings as reported by trade press. Aflac attributed the attack only to a sophisticated cybercrime group. Detection within hours did not prevent a very large notification exercise, which supports planning containment and notification around theft, not only around encryption.