Insuring others means securing yourself first

In 2021, AXA’s Asia division suffered a ransomware attack targeting its offices in Thailand, Malaysia, Hong Kong, and the Philippines. Hackers claimed to have stolen sensitive medical, identification, and contractual data. Under GDPR, China’s PIPL, and California’s CCPA, insurers must notify breaches promptly and ensure strict data protection for health, financial, and biometric records.

In 2020, Wells Fargo paid $3 billion USD to settle U.S. claims related to the unauthorized opening of millions of bank and insurance accounts. Sales incentives had encouraged unethical practices by employees. This case accelerated the implementation

With AI increasingly used to price and underwrite policies, insurers face legal and ethical challenges around indirect discrimination (age, gender, health conditions). Investigations in California and France have begun examining unfair rate differentials, particularly in auto and health insurance.

Although not always central actors, insurers are often entangled in complex structures involving sanctioned entities or high-risk jurisdictions.

In 2019, UniCredit paid $1.3 billion USD to resolve U.S. sanctions violations including transactions involving clients in Iran and Sudan even though the primary business was banking, not insurance.