Article Details
Scrape Timestamp (UTC): 2023-09-05 14:41:21.433
Original Article Text
Click to Toggle View
Insurer fined $3M for exposing data of 650k clients for two years. The Swedish Authority for Privacy Protection (IMY) has fined insurer Trygg-Hansa $3 million for exposing on its online portal sensitive data belonging to hundreds of thousands of customers. Trygg-Hansa is an insurer for individuals, private companies, and public organizations, and also an asset management and investment consultation firm. IMY initiated an investigation on the firm after receiving a tip from a Moderna Försäkringar (now part of Trygg-Hansa) customer, who had discovered it was possible to access the insurer’s backend by following links available on quotation pages sent to clients. These are sent to all existing or potential customers via SMS or email, containing a unique web address (URL) to a quote page on Trygg-Hansa’s website. IMY confirmed that the backend database was accessible without requiring authentication, and they could browse private documents from other individuals by modifying in the URL the client ID number, which was sequential. About 650,000 customers have been impacted. The information exposed included: To make matters worse, IMY determined that the data was exposed through Trygg-Hansa’s portal to unauthorized parties for more than two years, between October 2018 and February 2021. Such an extensive exposure period increases the likelihood of someone finding the flaw and exploiting it to collect sensitive information. This type of data can then be sold to cybercriminals and used for scamming, phishing, or even extorting the exposed individuals. IMY has been able to confirm at least 202 cases of customers who had their personal information exposed to unauthorized users, but this may be tip of the iceberg. The insurer’s failure to remedy the issues all this time, even after it received reports about the flaw, according to IMY, indicates a severe shortfall in data security and risk mitigation measures for which the regulator decided to impose an administrative penalty of $3M. The full IMY decision on the Trygg-Hansa case is available here.
Daily Brief Summary
Swedish insurer Trygg-Hansa fined $3 million for exposing sensitive data of hundreds of thousands of customers
Investigation initiated after a customer alerted authorities about the accessibility of backend database
Backend database could be accessed without authentication, allowing browsing of private documents of other individuals
Approximately 650,000 customers affected by the data exposure
Data was exposed for more than two years, increasing the risk of exploitation by cybercriminals
At least 202 cases of personal information exposure confirmed, but more cases may exist
Insurer's failure to address the issue despite receiving reports indicates a severe shortfall in data security and risk mitigation measures
Swedish Authority for Privacy Protection imposed an administrative penalty of $3 million on the insurer.