Overview

• Google Threat Intelligence Group has issued a high alert after detecting multiple intrusions in the US insurance sector that match Scattered Spider’s tactics.
• Erie Insurance reported a network outage beginning June 8 after spotting unusual activity on June 7 and is conducting forensic analysis with leading cybersecurity experts.
• Philadelphia Insurance Companies identified unauthorized access on June 9, disconnected affected systems to contain the breach and has notified law enforcement for an ongoing investigation.
• Scattered Spider employs sophisticated social engineering methods—phishing, SIM-swapping and MFA fatigue—for initial access and has been observed deploying ransomware variants like RansomHub, Qilin and DragonForce.
• Google recommends insurers achieve full infrastructure visibility, enforce phishing-resistant multi-factor authentication and train help-desk staff to verify callers and spot impersonation attempts.