Insurance Information Bureau of India hit by ransomware, refused $250,000 demand

The Insurance Information Bureau of India, the sector's central repository for insurance data and analytics, was hit by a ransomware attack that encrypted around 30 of its servers and left its data inaccessible.

Reporting placed the attack on April 2, 2023. Investigators found that the accounts of the organization's system administrator and database administrator had been compromised, along with 11 other accounts and several devices used by IIB staff, giving the attackers the access needed to deploy the ransomware.

The attackers demanded the equivalent of $250,000 in bitcoin in exchange for unlocking the encrypted data. IIB did not pay. The organization restored from backups and said day to day operations were maintained.

IIB initially kept the incident confidential before filing a complaint with the Cyberabad police in Hyderabad, where it is based. Police attributed the intrusion to a group operating from Russia. No ransomware brand publicly claimed the attack. As of the end of May 2023 the police investigation remained open and officials were still assessing which encrypted records held confidential information.