Unpublished ratings information from a major American bond rating firm has been stolen by cybercriminals during an attack on an insurance industry association.
Kroll Bond Rating Agency data was exported from systems operated by the National Association of Insurance Commissioners during a cybersecurity incident.
The KBRA, a New York-based credit rating agency, reported that NAIC became aware of a cybersecurity breach affecting its systems on June 11. NAIC publicly disclosed the incident on June 18. On June 26, NAIC told KBRA that KBRA data had been affected.
The affected information had been sent to NAIC through KBRA’s regulatory data feed. NAIC requires KBRA and other credit rating agencies to provide those feeds for NAIC designation purposes. Those designations are used in insurance regulation to classify investments held by insurers.
On June 26, NAIC told KBRA that “unpublished KBRA ratings information submitted through our regulatory data feed had been exported during the incident.”
The affected data included unpublished ratings information and related identifiers. It did not include transaction names, issuer names or issuer information.
NAIC also told KBRA that “the compromised information involved in the incident had been uploaded to a site used to distribute data obtained through cyber incidents.”
The breach did not involve KBRA’s own systems.
“This incident did not involve unauthorized access to KBRA’s systems or a compromise of KBRA’s cybersecurity controls,” the statement states.
The unauthorized access took place inside NAIC’s systems after KBRA had securely sent the information for regulatory reporting.
KBRA has suspended its regulatory data feed to NAIC. The suspension will remain in place while KBRA waits for the cybersecurity issues identified by NAIC to be resolved and for more information on safeguards to prevent a similar incident.
