Insurance company CNA Financial Corp. has suffered a cybersecurity attack and the company’s offline as of late Wednesday.

The exact form of the attack is unknown. The company said on its website that it had been targeted by a “sophisticated cybersecurity attack.” The attack is said by the company to have caused “network disruption and impacted certain CNA systems, including corporate email.”

“Upon learning of the incident, we immediately engaged a team of third-party forensic experts to investigate and determine the full scope of this incident, which is ongoing,” the company said. “We have alerted law enforcement and will be cooperating with them as they conduct their own investigation.”

The likeliest culprit is a ransomware attack. While not saying it was REvil, Bleeping Computer reported that the REvil ransomware gang stated in a recent interview that insurance companies are valuable targets.

“Yes, this is one of the tastiest morsels,” a spokesperson for REvil said. “Especially to hack the insurers first — to get their customer base and work in a targeted way from there. And after you go through the list, then hit the insurer themselves.”

If it was REvil, the attack on CNA is yet another notch on its hacking list. The ransomware gang was last in the news March 21 for successfully targeting hardware and electronics firm Acer Inc. and demanding a $50 million ransom. Previous REvil victims include celebrity law firm Grubman Shire Meiselas & Sacks in May and foreign exchange provider Travelex in late December 2019.

But insurance companies are an especially tempting target, Saryu Nayyar, chief executive officer of unified security and risk analytics company Gurucul Solutions Pvt Ltd. A.G., told SiliconANGLE.

“If an attacker can extract a list of clients who have cyberattack insurance, those clients in turn become inviting targets themselves,” Nayyar explained. “Since they have insurance, they are seen as more likely to pay off a ransom. It’s a win-win for the attackers and a lose-lose for everyone else.”

Image: CNA