In November 2024, New York Attorney General Letitia James and the Department of Financial Services announced an $11.3 million settlement with GEICO and Travelers. The insurers had failed to implement adequate data security, allowing attackers to access policyholder information through their online quoting tools.
The investigation revealed that both companies had weak authentication controls. Attackers exploited these weaknesses to harvest driver's license numbers, dates of birth, and other personal information. The breach affected tens of thousands of New Yorkers.
A month later, Noblr auto insurance paid $500,000 for similar failures. In March 2025, the same Attorney General sued Allstate for exposing more than 165,000 New Yorkers' information. Root Insurance paid $975,000 for its own data protection failures.
These aren't isolated incidents. They're a pattern of enforcement that signals regulators have lost patience with insurance companies that fail to protect policyholder data. And this enforcement wave comes precisely as insurers face pressure to adopt AI tools that create new data exposure risks.
The short version: If you need to redact sensitive documents before they reach AI systems, PaperVeil handles that layer. The rest of this article explains where it fits in the broader governance architecture.
The Insurance Data Landscape
Insurance companies hold information that makes them prime targets.
Personal identification data forms the foundation of every policy. Names, addresses, dates of birth, Social Security numbers, driver's license numbers. This information enables identity theft and fraud when exposed.
Financial information includes bank accounts for premium payments, credit card numbers, payment histories, and claims disbursement details. Access to this data enables direct financial theft.
Health information in life, health, disability, and long-term care policies contains diagnoses, treatment histories, prescription records, and medical provider information. This data carries HIPAA implications and exposes insurers to healthcare privacy regulations.
Property information in homeowners and commercial policies details assets, values, security systems, and occupancy patterns. Criminals use this information to identify high-value targets.
Claims histories reveal accident details, injury descriptions, legal disputes, and settlement amounts. This information exposes policyholders to discrimination and exploitation.
Behavioral data from telematics, wearables, and IoT devices increasingly feeds underwriting and claims processing. Driving patterns, health metrics, and activity data create detailed personal profiles.
The combination makes insurance data uniquely valuable to attackers and uniquely sensitive for policyholders.
The AI Adoption Pressure
Despite security risks, insurers face compelling reasons to adopt AI.
Claims processing efficiency improves dramatically with AI assistance. Document review, damage assessment, and fraud detection all benefit from AI capabilities. Faster claims processing reduces costs and improves customer satisfaction.
Underwriting automation allows insurers to process applications faster and more consistently. AI can analyze risk factors across thousands of data points, improving pricing accuracy while reducing manual review time.
Customer service expectations have shifted. Policyholders expect instant responses, personalized recommendations, and 24/7 availability. AI-powered chatbots and virtual assistants deliver these capabilities.
Fraud detection relies increasingly on pattern recognition that AI excels at. Identifying suspicious claims before payout saves insurers billions annually.
Competitive pressure compounds these drivers. When competitors announce AI initiatives, others must respond or risk market position erosion.
The business case for AI adoption is strong. The question is whether insurers can capture these benefits without creating new exposures.
Risk Matrix: Data Types and Exposure Levels
Understanding which data requires which protections enables appropriate security investment.
Critical Risk (Maximum protection required):
- Social Security numbers
- Bank account and routing numbers
- Complete health records
- Credit card numbers
- Claims involving litigation
High Risk (Strong controls required):
- Driver's license numbers
- Dates of birth combined with names
- Medical diagnoses and treatments
- Financial account balances
- Settlement amounts
Moderate Risk (Standard protection):
- Policy numbers and coverage details
- Premium payment histories
- Property valuations
- Agent communications
- General correspondence
Lower Risk (Basic protection):
- Published rate information
- General product descriptions
- Marketing materials
- Public regulatory filings
Critical and high-risk data should never reach external AI systems without redaction. Moderate-risk data may be processed through enterprise AI with appropriate controls. Lower-risk data can use standard enterprise tools.
The AI Exposure Problem
Consumer AI tools create specific risks for insurance data.
Training data concerns: Consumer versions of ChatGPT, Claude, and Gemini may train on your inputs. Policyholder health information, financial details, and personal data could influence model responses to other users.
Data retention: AI providers retain conversation data for varying periods. A claims adjuster who uploads a medical record to ChatGPT creates a copy that may persist for months on external servers.
Breach multiplication: The Landmark Admin breach in 2024 demonstrated how third-party service providers multiply exposure. Over 800,000 individuals had their information compromised through a single administrator serving multiple insurers. AI providers are another category of third party.
Regulatory complexity: Insurance data falls under multiple regulatory frameworks simultaneously. A single policyholder's information may be subject to GLBA, state insurance regulations, HIPAA (for health data), CCPA, and NYDFS cybersecurity requirements. AI usage must comply with all applicable frameworks.
Security Architecture for Insurance AI
Protecting policyholder data while enabling AI benefits requires deliberate architectural choices.
Tier 1: Private AI Infrastructure
For the most sensitive processing, AI runs entirely within insurer-controlled environments.
- Private model deployments on insurer infrastructure
- No data transmission to external providers
- Complete audit trails and access controls
- Highest cost but maximum control
This approach suits health insurers processing medical records, disability claims involving detailed health histories, and any processing involving litigation-sensitive materials.
Tier 2: Enterprise AI with Pre-Processing
For most insurance workflows, enterprise AI tiers combined with data sanitization provide adequate protection.
- Enterprise agreements with contractual data protections
- Automatic identification and redaction of sensitive data before AI processing
- AI works with sanitized documents
- Audit trails documenting what was processed
A claims document might have policyholder names, SSNs, and account numbers removed before AI analyzes the claim description and supporting documentation. The AI assists with the analytical work. The identifying information never leaves the insurer's environment.
Tier 3: Segmented Processing
For non-sensitive operations, standard enterprise AI with clear policies suffices.
- General research and regulatory analysis
- Marketing content development
- Training material creation
- Policy language review for public products
Clear boundaries between data tiers prevent accidental exposure of sensitive information through channels intended for non-sensitive work.
Implementation for Insurance Companies
Step 1: Map Your Data
Create a comprehensive inventory of data types processed across the organization:
- What data exists in which systems
- Which roles access which data types
- How data flows between systems
- What third parties receive what information
This inventory forms the foundation for AI security policies.
Step 2: Classify by Sensitivity
Apply consistent classification to all data types:
- Restricted: Health records, SSNs, financial account details
- Confidential: Policy details, claims histories, contact information
- Internal: Operational data, general correspondence
- Public: Published materials, regulatory filings
Map each classification to permitted AI usage.
Step 3: Configure Enterprise AI
Establish enterprise relationships with AI providers that include:
- Contractual commitments against training on your data
- Data handling aligned with insurance regulatory requirements
- Audit rights and compliance certifications
- Incident notification obligations
- BAA execution for any health data processing
Consumer AI subscriptions cannot provide these protections.
Step 4: Implement Data Sanitization
Before confidential or restricted data reaches any AI system, remove identifying information:
- Policyholder names and identifiers
- Social Security numbers and driver's licenses
- Account numbers and financial details
- Specific dates that enable identification
- Addresses and contact information
The sanitized document retains the substance needed for AI analysis while protecting policyholder identity.
Step 5: Establish Monitoring
Implement controls that detect policy violations:
- DLP systems monitoring data egress to AI services
- Logging of all AI system interactions
- Regular audits of AI usage patterns
- Alerts for anomalous data transmission
Detection enables correction before breaches occur.
Compliance Mapping
Insurance data security intersects multiple regulatory frameworks.
Gramm-Leach-Bliley Act (GLBA): Requires financial institutions, including insurers, to explain information-sharing practices and protect sensitive data. The Safeguards Rule mandates specific security program elements. Violations can reach $100,000 per violation.
NYDFS Cybersecurity Regulation (23 NYCRR 500): New York's groundbreaking regulation requires covered entities to maintain cybersecurity programs, conduct risk assessments, and report incidents. The $11.3 million GEICO/Travelers settlement demonstrates enforcement severity.
State Insurance Regulations: The NAIC Insurance Data Security Model Law, adopted in over 20 states, establishes baseline cybersecurity requirements for insurers. Requirements include written security programs, risk assessments, and incident response plans.
HIPAA: Health insurers and any insurer processing protected health information must comply with HIPAA Privacy and Security Rules. Business Associate Agreements are required for third parties handling PHI.
State Privacy Laws: CCPA, CPRA, and emerging state privacy laws apply to policyholder personal information. These laws grant consumers rights to access, delete, and opt out of data sales.
PCI DSS: Insurers processing payment card data must comply with Payment Card Industry Data Security Standards. Non-compliance can result in fines of $5,000 to $100,000 monthly.
The common requirement across all frameworks: reasonable security measures appropriate to data sensitivity. AI adoption without corresponding security controls fails this standard.
The Third-Party Risk Dimension
The Landmark Admin breach exposed a critical vulnerability in insurance data security. A single third-party administrator was compromised, affecting over 800,000 individuals across multiple insurance companies. The resulting $6 million settlement didn't fully cover the actual costs to affected policyholders.
AI providers represent another category of third-party risk:
- They process your data on their infrastructure
- Their security practices become your exposure
- Their breaches affect your policyholders
- Their compliance gaps create your regulatory risk
Enterprise AI agreements should address these risks explicitly. Consumer AI terms do not.
Building Sustainable Security
The GEICO, Travelers, Root, Noblr, and Allstate enforcement actions share a common theme: regulators found security programs inadequate for the data being protected. These weren't sophisticated attacks exploiting zero-day vulnerabilities. They were basic security failures that proper programs would have prevented.
As AI adoption accelerates, the attack surface expands. Every new AI integration creates potential exposure. Every employee with AI access can become an inadvertent data leak vector. Every third-party AI provider adds to your risk profile.
Sustainable security requires:
Continuous assessment: Quarterly reviews of AI usage, data flows, and security controls Vendor management: Ongoing evaluation of AI provider security practices Training: Regular education on appropriate AI use and data classification Incident preparation: Documented response plans for AI-related security events Regulatory monitoring: Tracking evolving requirements across jurisdictions
The enforcement trend is clear. Regulators expect insurers to protect policyholder data regardless of what technologies they adopt. AI doesn't create an exception. It creates an obligation.
PaperVeil removes policyholder-identifying information from documents before AI processing. Automatic detection of SSNs, policy numbers, health information, and financial data. Enterprise-grade redaction with audit trails. The security layer that lets insurers use AI without compromising policyholder trust.