Scattered Spider Targeting American Insurance Firms

Hackers Posing as Help Desks and Call Centers to Target Victims, Google Warns Akshaya Asokan (asokan_akshaya) • June 17, 2025

A hacking collective behind recent cyberattacks on major British retailers has pivoted to target U.S. insurance firms, warned Google.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

John Hultquist, chief analyst at Google Threat Intelligence Group, said Tuesday the company is "aware of multiple intrusions" against insurance companies in the United States that are potentially linked to Scattered Spider.

Scattered Spider, tracked as UNC3944 by Google, is a financially motivated threat group consisting largely of English-speaking adolescents based in the U.S. and the United Kingdom. The group is suspected behind the May cyberattacks of British retailers Marks & Spencer, Co-op and Harrods (see: Retail Sector in Scattered Spider Crosshairs).

"Given this actor's history of focusing on one sector at ...