Insurance — decades of personal and financial data, one regulator watching all of it.

The threat, specifically

Insurers accumulate risk the way policies accumulate riders: a policy-administration system built a decade ago, a claims portal bolted on for digital-first customers, a distribution layer of agent and broker integrations each with their own authentication assumptions. Every one of those systems holds personal and financial data with a multi-decade retention tail — a policyholder's medical history or KYC documents don't age out of value to an attacker the way a session token does. Meanwhile, fake policy-sales domains and impersonation pages that mimic a real insurer's branding are a well-worn fraud pattern, built to collect premium payments that never reach a real policy.