American Family Insurance confirmed a cyberattack behind week-long outages

American Family Insurance, the Madison, Wisconsin based insurer, confirmed in a statement reported on October 21, 2023 that a cyberattack was responsible for the outages that had disrupted its systems for about a week, and gave a further statement to Madison media on Wednesday, October 25. The company said its technology teams detected unusual activity in a portion of the network and deliberately took several business systems offline in response.

The shutdown was visible to customers. Policyholders were unable to pay bills or file claims through the website, which directed them to call a toll free number instead. Reporting on the incident also described phone service problems, and internet connectivity was interrupted in at least one building the insurer shares with other tenants.

A company spokesperson said taking systems offline was vital to protect data and resources, and that several components of the enterprise continued to operate without interruption. American Family said it had found no evidence that critical business systems or customer data processing and storage systems had been compromised.

The insurer did not describe the nature of the attack, and no group publicly claimed responsibility. BleepingComputer noted that the pattern, an intrusion over a weekend followed by a broad precautionary shutdown, is common in ransomware cases, but the company never confirmed that ransomware was involved. Restoration of the affected systems was still under way as of October 25, 2023.