Incident BriefingsCNA Financial security incident

CNA Financial security incident

Phoenix Locker/Evil Corp; phishing/fake browser update. Major US insurer's own systems encrypted.

Last modified

Summary

  • Environment: Insurance
  • Operational impact: Major US insurer's own systems encrypted
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2021, CNA Financial experienced an incident in its insurance environment. The retained source describes the attack path as follows: Phoenix Locker/Evil Corp; phishing/fake browser update. [1]

The documented consequence was: Major US insurer’s own systems encrypted. [1]

Impact

  • Documented impact: Major US insurer’s own systems encrypted. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Phoenix Locker/Evil Corp; phishing/fake browser update. The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • Phoenix Locker/Evil Corp — identified in the supported attack description. [1]

TTPs

Response

The retained source reports coordination with law enforcement as part of the incident response. [1] The retained source describes a forensic or specialist investigation of the incident. [1]

This account is bounded to Formal Notice of Cybersecurity Incident. Details absent from that evidence are left unresolved rather than inferred. [1]