Skyward Specialty suffers data breach with documents appearing on dark web

By Chris Munro

April 15 - (The Insurer) - Skyward Specialty Insurance Group has written to customers and regulators that it suffered a data breach with certain documents having been made accessible on the dark web.

Houston, Texas-based Skyward Specialty explained in a letter sent to clients and state regulators dated April 8 that it was recently alerted that a database where it stored certain documents was publicly discoverable.

“Skyward Specialty determined that this was made possible due to a miscalibration in the database settings,” the company said.

While the carrier confirmed it has remediated that miscalibration, on April 5 it was alerted that certain documents that had been publicly discoverable in the database had been made accessible on the dark web.

“Our investigation into the incident is ongoing and will provide updates when relevant information is available,” the Andrew Robinson-led carrier said.

It is unclear precisely what information was compromised, and how many clients are affected.

According to the National Association of Attorneys General, data breaches can be defined “as the unlawful and unauthorized acquisition of personal information that compromises the security, confidentiality, or integrity of personal information."

What is regarded personal information depends on individual state law.

However, such information usually includes an individual’s first and last name along with at least one or more of that person’s social security number; driver’s license number or state-issued ID card number; and a bank account number, credit or debit card number, combined with any security code, access code, PIN or password needed to access an account.

It could also include medical history or health information, biometric information, email address and password or tax ID number.

In the letter, titled Notification of Potential Data Incident, Skyward Specialty said that “pursuant to its requirements under applicable insurance sector regulations," the company had written regarding a potential data incident that it had recently become aware of.

“While Skyward Specialty is notifying you of this incident, Skyward Specialty does not waive any rights or defenses related to the incident,” the company said.

At the time of publication, Skyward Specialty had not responded to a request for comment.