INDUSTRY FACT FILE · INSURANCE

Five New Case Studies in Insurance Security

Original 2026 case studies, each written as a blog post, showing how current threats play out under IRDAI's 2026 guidelines and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: Ransomware Before Renewal Season 3.  Case Study 2: The TPA Portal That Shared Too Much 4.  Case Study 3: The Claims Ring and the Forged Bills 5.  Case Study 4: The Policyholder Who Never Asked for a Refund 6.  Case Study 5: The Cloud Bucket of Proposal Forms

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in insurance with the obligations that apply in India as of October 2026—in particular IRDAI's Information and Cyber Security Guidelines, 2026, CERT-In's Directions and the DPDP framework.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Insurer type	Core threat	Regulatory lens	Primary bundles
1. Ransomware Before Renewal Season	Standalone health insurer	Ransomware and medical data theft	IRDAI 2026 (6-hour reporting, BCP/DR); DPDP	B7, B10, B8
2. The TPA Portal That Shared Too Much	General insurer with health portfolio	Partner portal exposing medical records	IRDAI 2026 vendor requirements; DPDP	B2, B9, B6
3. The Claims Ring and the Forged Bills	Health and motor insurer	Organised claims fraud with insider help	IRDAI fraud monitoring; IRDAI 2026	B8, B7, B9
4. The Policyholder Who Never Asked for a Refund	Life insurer	Fake helpline and surrender diversion	IRDAI 2026; CERT-In	B2, B7, B10
5. The Cloud Bucket of Proposal Forms	Life and health insurer	Cloud misconfiguration exposing medical histories	IRDAI 2026 cloud requirements; DPDP	B3, B6, B8

The attackers timed it for the busiest weeks of the year—and the backups were on the same network.

At a glance
Organisation	A standalone health insurer (“Insurer A”) with a national cashless network
Threat	Ransomware encrypting policy and claims systems after data theft
Why it is new	Tests IRDAI's annual BCP/DR testing and 6-hour reporting requirements
Codec Networks services	Managed SOC, ransomware simulation, backup and BCP/DR testing, incident response (Bundles B7, B10, B8)

The scenario

A phishing email compromised a claims executive's workstation. Over several days the attacker escalated privileges and reached claims and policy servers.

Before renewal season, medical records were exfiltrated and systems encrypted. Cashless approvals stopped and hospitals began asking patients to pay upfront.

Insurer A had to restore services, communicate with policyholders and hospitals and report to CERT-In and IRDAI within six hours.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Medical data was not segmented from user networks.
• Backups were reachable from the compromised domain.
• EDR alerts were not investigated out of hours.
• BCP/DR had not been tested against a ransomware scenario.

The impact

Insurer A faced policyholder harm, hospital disputes, regulatory scrutiny and the prospect of DPDP obligations once breach provisions commence.

The regulatory lens

• IRDAI 2026 guidelines: BCP/DR tested at least annually against realistic scenarios; incidents to CERT-In within six hours with copies to IRDAI.
• Data protection: classification and encryption of confidential data; DPDP measures.
• CERT-In Directions: 180-day log retention supporting investigation.

How Codec Networks would help

Need	Codec Networks response	Bundle
Detect early	24x7 SOC with EDR/XDR	B7
Prove recovery	Segmentation, backup isolation, ransomware simulation, BCP/DR drills	B10
Respond and report	IR retainer and reporting support	B8

Key lessons Segment medical data from everything else. Keep backups out of the attacker's reach. Watch alerts around the clock. Test BCP/DR against ransomware, not just outages.

The insurer's systems were secure. The TPA portal returned anyone's claim file.

At a glance
Organisation	A general insurer (“Insurer B”) using a TPA for health claims
Threat	Broken authorisation in a TPA claims portal API
Why it is new	IRDAI 2026 requires right-to-audit and security controls for vendors handling insurer data
Codec Networks services	Partner API testing, vendor assessment, privacy programme (Bundles B2, B9, B6)

The scenario

The TPA's claims portal API returned full claim files—including diagnoses and treatment details—for any claim ID requested by a logged-in user.

An attacker enumerated claim IDs and downloaded thousands of records.

Some policyholders received extortion messages referencing their medical conditions.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No object-level authorisation in the portal API.
• Full medical files returned instead of minimal data.
• No rate limiting or alerts on bulk access.
• The TPA had never been tested by the insurer.

The impact

Insurer B and its TPA faced regulatory reporting, policyholder harm, contract disputes and reputational damage.

The regulatory lens

• IRDAI 2026 guidelines: vendor contracts with right-to-audit clauses; classification and protection of personal data.
• CERT-In Directions: data leaks reported within six hours.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the portal	API authorisation and data-exposure testing	B2
Assure the TPA	Vendor security assessment using right-to-audit	B9
Protect health data	Classification, minimisation and DLP review	B6

Key lessons Test partners' portals, not just your own. Return the minimum medical data needed. Alert on bulk record access. Use your right to audit.

The bills looked genuine because a hospital insider helped make them.

At a glance
Organisation	An insurer (“Insurer C”) paying claims through hospital and garage networks
Threat	Forged digital bills and documents submitted with help from a hospital billing clerk
Why it is new	Digital claims speed up settlement—and organised fraud
Codec Networks services	Claims-fraud analytics, forensic investigation, partner access review (Bundles B8, B7, B9)

The scenario

A group of claimants worked with a hospital billing clerk to produce inflated bills and forged discharge summaries.

Claims passed automated checks and were settled quickly.

Months later, analytics revealed unusual links between claimants, bank accounts and the hospital.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No tamper checks on uploaded documents.
• No link analysis across claimants and providers.
• Partner user access was not monitored.
• Fraud review happened long after payment.

The impact

Insurer C suffered claims losses, launched investigations and reviewed its hospital network arrangements.

The regulatory lens

• IRDAI fraud monitoring expectations: insurers must have frameworks to prevent and detect fraud.
• IRDAI 2026 guidelines: access control and supervision of partner access.
• PMLA and law enforcement: reporting and cooperation where applicable.

How Codec Networks would help

Need	Codec Networks response	Bundle
Find the ring	Link analysis and claims-fraud analytics	B7
Prove it	Forensic investigation and document forensics	B8
Control partners	Partner access and contract review	B9

Key lessons Check documents for tampering automatically. Link claimants, providers and accounts. Monitor partner users' access. Review high-risk claims before payment.

A 'bonus refund' call led to a changed bank account—and a surrender the policyholder never requested.

At a glance
Organisation	A life insurer (“Insurer D”) with an online servicing portal
Threat	Impersonation of the insurer's helpline leading to payout-detail changes and surrender fraud
Why it is new	Payout and surrender changes are high-value targets; brand impersonation is widespread
Codec Networks services	Payout-flow testing, SOC monitoring, brand monitoring and awareness (Bundles B2, B7, B10)

The scenario

Policyholders saw a fake helpline number in search results and social media. Callers promised a 'bonus refund' if they updated KYC.

Fraudsters captured credentials and OTPs, changed bank details on the portal and requested surrenders.

Surrender values were paid to mule accounts before policyholders realised.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No cooling period after bank-detail changes.
• Surrenders were not step-up verified.
• Fake helplines were not monitored or taken down.
• Alerts went only to compromised channels.

The impact

Insurer D compensated policyholders, faced complaints and launched an awareness campaign.

The regulatory lens

• IRDAI 2026 guidelines: security of customer-facing systems and incident reporting.
• CERT-In Directions: phishing and identity-theft incidents reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Fix the flow	Payout-change and surrender flow testing	B2
Spot the fraud	SOC use cases on payout changes and surrenders	B7
Fight impersonation	Brand monitoring, takedown and awareness	B10, B7

Key lessons Add a cooling period after payout changes. Verify surrenders independently. Take down fake helplines fast. Alert policyholders on old channels.

The migration finished on time. One storage policy was left wide open.

At a glance
Organisation	An insurer (“Insurer E”) migrating proposal documents to cloud
Threat	Publicly readable storage holding proposal forms with medical histories
Why it is new	IRDAI 2026 sets specific cloud requirements; DPDP raises the stakes for health data
Codec Networks services	Cloud review, posture monitoring, privacy programme, incident response (Bundles B3, B6, B8)

The scenario

During migration, an engineer applied a permissive policy to a bucket containing scanned proposal forms.

Researchers found the bucket and reported it publicly.

Insurer E had to secure the data, assess exposure and report to CERT-In and IRDAI.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Cloud changes were not reviewed against a baseline.
• No continuous posture monitoring.
• Proposal forms were not encrypted or classified.
• CSP contract terms for exit and data erasure had not been reviewed.

The impact

Insurer E faced regulatory reporting, policyholder harm and reputational damage, and DPDP consequences once breach provisions commence.

The regulatory lens

• IRDAI 2026 guidelines: MeitY-empanelled CSPs with STQC audit status; encryption and classification of confidential data.
• CERT-In Directions: data leaks reported within six hours.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Get cloud right	Cloud review against IRDAI requirements; posture monitoring	B3
Protect the data	Classification and encryption review	B6
Respond fast	IR retainer and reporting support	B8

Key lessons Review every cloud change. Monitor storage for public exposure. Classify and encrypt proposal data. Check CSP empanelment and exit terms.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com