Help protect client data with these cybersecurity best practices

Insurance agents are trusted to field questions, assess risks, explain coverage options to individuals and businesses and place insurance coverage on behalf of their clients. As part of their work, insurance agents often collect and store policyholder information such as Social Security numbers, financial information, addresses, birthdates and other sensitive information. 

Given the value and sensitive nature of this data, insurance agencies are a common target for cybercriminals. In fact, according to Nationwide’s 2026 cybersecurity survey, 59% of agents said their agency has experienced a cyberattack (up 10 points since 2024). Among those, 39% say a client of theirs experienced a threat that was powered by or generated using AI, up 10 points since 2024.¹ Like any other business, insurance agencies involved in cyberattacks face significant and potentially irreversible consequences. This article provides actionable steps agencies can take to protect themselves and their clients against cyberattacks. 

Types of cyberattacks

Cybercriminals target insurance agencies through a range of methods, from tricking employees into handing over credentials to overwhelming systems with traffic. The most common attack types agents encounter include the following:  

• Phishing: One of the most common cyberattacks. Our survey showed, among independent agents who’ve experienced a cyberattack, 39% cite phishing as one of the threats they faced. With traditional phishing attacks, criminals send fraudulent, malicious emails to as many people as possible, often customized with logos or fake email accounts to improve legitimacy. Phishers frequently pretend to be trusted sources, and the message will likely try to fool victims into clicking a link, opening a document, installing software or entering their username and password.  

• Credential stuffing / password attacks: These attacks occur when a malicious party takes a stolen username and password and tries it on various websites, sometimes purchased from the dark web. Password attacks are now the most commonly reported threat type among agents: 33% of independent agents who’ve experienced a cyberattack say it involved a password attack, according to our research. 

• Unpatched vulnerabilities: Computer software can have security issues stemming from bugs, bad code and similar problems. Software companies often provide updates to patch known vulnerabilities, but before a patch is issued or applied, hackers can exploit them. 

• Distributed denial of service (DDoS): A DDoS attack floods a targeted server, network or service with internet traffic, overloading system resources and causing disruption. Among agents who’ve experienced a cyberattack, 23% report a DDoS attack. 

• Malware: Once cybercriminals gain access to a system, they can deploy malware, including viruses, worms, Trojan horses, spyware, adware and rootkits. Malware programs are constantly evolving, making detection and prevention more difficult. The survey found 36% of independent agents who’ve experienced a cyberattack report a malware attack. 

• Ransomware: Ransomware is particularly devastating type of malware that infects a computer and either prevents it from working or blocks access to systems until the user pays a ransom. 22% of independent agents who’ve experienced a cyberattack report a ransomware attack. 

Artificial intelligence (AI) is also changing the shape of the threat itself. Our research found 90% of independent agents agree AI-enabled cyberattacks have grown more sophisticated over the past 12 months, and 87% feel that AI is making it easier for attackers to identify vulnerabilities. Among agents who’ve experienced a cyberattack, 29% report an AI-generated impersonation or fraud attempt, and 31% report an AI-assisted phishing or social engineering attack. 

Cybersecurity best practices

When it comes to protecting your own and client data and IT systems, cybersecurity protocols must be carefully scrutinized. Doing so instills confidence that data is safe when it’s handled by the insurance agency. In particular, insurance agencies should consider the following cybersecurity strategies:

1. Encryption

Through encryption, information is encoded in such a way that it is scrambled and can only be read by someone who has the proper encryption key. When handling data or selecting a software vendor, it’s important to consider how encryption will be used to safeguard sensitive information. 

When data is properly encrypted within a system, cybercriminals can’t read it even when they intercept it in an attack. In particular, agencies should rely on encryption to protect client and other sensitive data stored in agency management systems (AMS) and other similar platforms.

2. Multi-factor authentication (MFA)

MFA adds another layer of protection to your agency management system and other sensitive platforms by requiring an additional step to verify a user’s identity beyond a password. This could be a one-time code sent to a phone, a fingerprint scan or an authentication app. Research from Microsoft shows MFA can block more than 99.2% of account compromise attacks.² 

Despite its effectiveness, adoption still has room to grow. Only 42% of independent agents report they are requiring multi-factor authentication to prevent future cyberattacks on their business. 

3. Secure device management and patching vulnerabilities

Insurance agents need to be cautious when it comes to the use of personal computers and mobile devices. Any device that can access agency applications should be password protected, and if a device is lost or stolen, agencies should have the ability to wipe data remotely. It’s also important to have trusted antivirus and antispyware programs installed on company devices, set to scan regularly for unwanted and harmful programs. 

It’s critical for insurance agencies to update company software as soon as new updates are released, enabling automatic updates where available and coordinating with IT or software vendors to keep security patches current for agency management systems and client-facing portals. Despite this, only 45% of independent agents report they have updated their cybersecurity software to prevent future cyberattacks on their business. 

4. Data backup

Cyberattacks like ransomware can lock you out of your own data, sometimes permanently. A secure, regularly tested backup system can mean the difference between a minor disruption and a full-blown crisis. Store backups separately from your main network, and test them periodically to confirm data integrity. 

Backups are becoming a bigger part of how agencies respond to attacks: 40% of independent agents who experienced a cyberattack say they’ve since started backing up data under stricter protocols. 

5. Vendor management

When working with a third-party vendor, it’s critical to vet their cybersecurity practices. At a minimum, insurance agencies should confirm that the vendor can send and receive data securely, and ask for a System and Organization Controls (SOC2) report. 

SOC2 reports are independent audits based on standards set by the American Institute of Certified Public Accountants (AICPA), assessing how an organization manages customer data across security, availability, processing integrity, confidentiality and privacy. In short, SOC2 reports verify whether a third party follows best practices related to financial processes, security and privacy. 

Insurance agencies will also want to confirm that the third parties they work with have cyber insurance in place, since many insurers require a cyber assessment before placing coverage. Vendors may be able to provide a copy of this assessment on request, or a security questionnaire if one isn’t available. 

6. Email safety

Cybercriminals often use email to carry out phishing scams or distribute malware and ransomware. Insurance agents should be mindful of incoming emails and avoid clicking links or attachments from untrusted sources, staying especially cautious of messages that: 

• Come from unrecognized senders 

• Ask to confirm personal or financial information 

• Aren’t personalized 

• Are vague 

• Include threatening, frightening or persuasive language 

AI has made these messages harder to spot. According to Nationwide’s 2026 survey, 31% of independent agents who experienced a cyberattack say it involved AI-assisted phishing or social engineering, as generative AI helps criminals write more convincing, personalized messages at scale. Report potential phishing emails to the proper company employee, such as a senior member of the IT department. 

When it comes to the threats agents face, Vikas Chopra, Associate Vice President of Technology Risk Management at Nationwide reminds agents, because they routinely exchange sensitive documents, process payments, and communicate through digital channels, they are also attractive targets for impersonation and fraud.  

“Phishing, business email compromise, identity theft, stolen credentials, and AI-assisted impersonation remain key concerns. These attacks often exploit trust, urgency, or routine business processes. Cybercriminals often target trust before they target technology. Extra attention should be paid to verifying unusual requests, protecting client information, and confirming changes involving payments, banking details, or account access through a trusted second channel.” 

7. Password management

Ongoing password management can help prevent attackers from compromising an organization’s password-protected information. Require strong, unique passwords, and change them regularly. Consider using a password manager to generate and store complex passwords securely, and avoid reusing passwords across platforms, especially for accounts tied to client or financial data. Long passphrases are becoming increasingly popular and may be a good option for an organization. 

Password attacks remain the single most commonly reported threat type: 33% of independent agents who’ve experienced a cyberattack say it involved one, according to the survey. 

8. Employee training

Even the most robust and expensive data protection solutions can be compromised if an employee clicks a malicious link or downloads fraudulent software. It’s critical for organizations to thoroughly train staff on common cyber threats and how to respond. Employees should also know the cybersecurity policies and how to report suspicious activity. 

When it comes to how agents should approach cybersecurity, Bobbie Goldie, Vice President of Commercial E&S/S Cyber at Nationwide reminds agents to follow what they advise to clients.  

“Business owners need to know which tools employees are using and set clear expectations around what information can be shared and how AI-generated work should be reviewed.” 

9. AI security

Employees are increasingly using AI tools, sometimes without agency oversight, to draft communications, summarize documents or speed up routine tasks. That convenience comes with new risks. AI tools can expose client data if sensitive information is entered into a public chatbot, and cybercriminals are using generative AI to write more convincing phishing emails, create deepfake audio or video, and impersonate clients, carriers or colleagues. 

Independent agents are paying attention to this shift: From our research, 73% say they’re moderately or extremely concerned about AI increasing the speed, scale and sophistication of cyberattacks, and 62% say they need more information and resources on how to protect their clients from AI-enabled threats. 

A few practices can help agencies use AI responsibly: 

• Never enter client data, policy details or financial information into a public or unapproved AI tool. Treat an AI chat prompt the way you’d treat an email to a stranger. 

• Verify before you trust. If a call, email or video seems slightly off, even from a familiar voice or name, confirm the request through a second communication channel before acting on it. Only 26% of agents have established this kind of verification process, despite the rise in AI-generated impersonation. 

• Don’t assume AI-generated content is accurate. Chatbots can produce confident, convincing and completely wrong answers. Fact-check anything AI-generated before sharing it with clients or using it to make a decision. 

• Loop in IT or a designated point of contact before adopting a new AI tool for agency use, so it can be vetted for data security. 

How Nationwide helps agencies protect against cyber threats

Nationwide monitors dark web and underground sources for potential cyber threats involving Nationwide and its brands. This monitoring may identify information associated with agents or policyholders that could indicate potential compromise. Relevant findings are escalated through Nationwide’s cyber fraud team for review and appropriate follow-up.