Insurance Firm CNA Suffers Widespread Network Distruptions

CNA Financial, one of the largest insurance providers in the U.S., is currently experiencing widespread network disruptions.

The company’s website isn’t working, nor can its phone lines be reached. Employee services have been down for at least 48 hours, said a source close to the company. Sources suggest that the firm has been hit with a cyberattack, potentially a ransomware situation.

On the company’s website, a banner simply reads: “CNA is currently experiencing a network disruption that is impacting some of our systems. We are working to address these issues to minimize the disruption to you.”

According to The Insurer, an insurance industry news outlet, the company’s network may be out for a while:

CNA Financial Corporation’s website and some systems are down amid suggestions the Chicago-headquartered insurer has been hit with a suspected cyber attack with the incident understood to have caused disruption on the underwriting and claims side of its business.

If that is, indeed, what has occurred, one factor that makes this incident potentially more concerning than your average cyberattack is the fact that CNA is one of the larger providers of cyber insurance in the country. Oft touted as a way to protect businesses, in a case like this cyber insurance might have the exact opposite effect.

Joshua Motta, CEO of security firm Coalition, said that a hack like this is a “nightmare scenario” and could involve a hacker getting their hands on cyber insurance policyholder data. That data would give a hacker exact information on how much money policyholders are capable of paying out in the event of a future attack. Usually, ransomware hackers must make educated guesses about how much a company can shell out to get their data back, and a company can always claim that it doesn’t have the money—a crucial bargaining chip for the victim. With CNA’s insurance data, however, that bargaining chip would be gone—and hackers could conduct much more efficient attacks.

Again, this is all speculative—though it certainly would appear something significant has happened to CNA. When reached by phone Tuesday, a company representative couldn’t immediately provide information on what had occurred. We will update this story if more information becomes available.

UPDATE, 8:54 p.m. CNA sent us a statement about the attack. You can read it below in full:

On March 21, 2021, CNA determined that it sustained a sophisticated cybersecurity attack. The attack caused a network disruption and impacted certain CNA systems, including corporate email.

Upon learning of the incident, we immediately engaged a team of third-party forensic experts to investigate and determine the full scope of this incident, which is ongoing. We have alerted law enforcement and will be cooperating with them as they conduct their own investigation.

Out of an abundance of caution, we have disconnected our systems from our network, which continue to function. We’ve notified employees and provided workarounds where possible to ensure they can continue operating and serving the needs of our insureds and policyholders to the best of their ability.

The security of our data and that of our insureds’ and other stakeholders is of the utmost importance to us and we are committed to continuing to serve them as we work to resolve this issue. Should we determine that this incident impacted our insureds’ or policyholders’ data, we’ll notify those parties directly.