Ride the Lightning

Cyberinsurance Giant AXA Hit by Ransomware a Week After Refusing to Cover Ransomware Payments

May 19, 2021

As Graham Cluley reported on May 17, just a week after the French branch of cyberinsurance giant AXA said that it would no longer be writing policies to cover ransomware payments, the company’s operations in Thailand, Malaysia, Hong Kong, and the Philippines were struck by a ransomware attack.

As the Financial Times reported, the Avaddon ransomware gang posted on its website over the weekend that it had stolen 3 terabytes worth of data, including:

• Customers’ personally identifiable information, including scans of passports and ID documents
• Customers’ medical records, hospital bills, and claims

AXA says the compromised data was processed in a unit called Inter Partners Asia based out of Thailand, and that “there is no evidence that any further data was accessed.”

On its Facebook page, AXA Phillippines said that its MyAXA web portal was currently “experiencing technical issues”, and that customers with urgent concerns should phone the company’s customer care hotline.

We do not know what the ransomware demand is or whether AXA is considering paying a ransom.

Some ransomware gangs say that they specifically target firms who have cyberinsurance (more likely to pay of course) before then hitting the insurance company itself.

And some say they hit the insurance company to learn who has how much ransomware coverage.

In this case, I wonder if it wasn’t retribution to discourage other insurers from deciding to no longer write policies covering ransomware.

It’s a strange, strange world we live in Master Jack.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email:  Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson