The India Cyber Threat Report 2026 by Seqrite highlights a rise in fake domain registrations and cloned customer portals targeting insurance companies to harvest policyholder data. The report, based on telemetry from over 8 million endpoints in India, shows a significant increase in brand impersonation campaigns aimed at banks, fintech platforms, and insurers. Attackers are creating fake renewal or claim-verification pages that request personal data, policy numbers, OTPs, and payment credentials.

The broader malware landscape is dominated by Trojans and file infectors, accounting for nearly 70% of all malware activity. Many of these serve as entry points for credential theft and remote access, leading to financial fraud or ransomware deployment. While ransomware incidents represent a small percentage of detections, they cause significant operational disruption, especially for insurers with digital claims and customer databases.

The report also notes that 91% of detections came from on-premise environments, revealing vulnerabilities in legacy infrastructure. Additionally, cloud-linked identity abuse and OAuth token misuse are emerging tactics to bypass traditional security measures. As insurers expand digital onboarding, self-service portals, and API integrations, the exposure of sensitive customer data and medical records increases fraud risk and regulatory concerns.

Join the community of 2M+ industry professionals.

Subscribe to Newsletter to get latest insights & analysis in your inbox.

All about ETCISO industry right on your smartphone!