by Brian Thompson | Sep 23, 2026 | Breach, Insurance, SMB
An insurance agency incident response plan gets written in one of two moments. Some agencies write it on a quiet afternoon, with time to think. Others write it in the first hour of a cybersecurity event, while a producer’s mailbox sends fake invoices to clients. The second version costs far more, and it starts a legal clock the agency may not know about.
Last Updated: September 2026
Here is how that hour usually looks at a 25-person agency. A client calls to ask why your office emailed new wire instructions. Nobody sent them. The account manager assumes it is spam. The owner is at a carrier meeting. By the time anyone asks who is in charge, half a day is gone. Under the insurance data security law in many states, that half day may count against a 72-hour deadline to notify the insurance commissioner.
This guide covers what that deadline is, what the model law expects your plan to include, how the first 72 hours should run, and what changes when the breach happens at a vendor. One note before we start: state versions of this law differ, and this is not legal advice. Check your own state’s statute and talk with counsel before you finalize anything.
The 72-hour clock: what the NAIC model law says
In 2017, the National Association of Insurance Commissioners adopted the Insurance Data Security Model Law, known as Model #668. It applies to licensees. That includes insurers, agencies, and producers licensed by a state insurance department. A growing number of states have adopted their own versions. The NAIC state adoption chart lists where each state stands. Your state may differ from the model in timing, thresholds, or exemptions.
Section 6 of the model sets the clock. A licensee must notify the commissioner as promptly as possible, and no later than 72 hours after it determines a cybersecurity event has occurred. For a producer, the duty applies when the state is the producer’s home state. It also applies in other states when the event involves 250 or more of that state’s residents and meets certain harm or reporting tests.
Notice the trigger. The clock starts at determination, not at discovery of a suspicious email. That is why the first hours matter so much. An agency with no process can spend a day deciding whether anything happened at all. An agency with a written insurance agency incident response plan knows who makes that call and how.
The exemption most small agencies misread
The model exempts licensees with fewer than ten employees, including independent contractors. But the exemption covers Section 4 only. Section 4 is the written information security program. Sections 5 and 6 still apply. So a nine-person agency may not need a full written program under the model. It still has to investigate a cybersecurity event and notify the commissioner on time. A small agency without an incident response process carries the same deadline with fewer people to meet it.
What the model law expects an insurance agency incident response plan to cover
Section 4H requires a written incident response plan as part of the information security program. The plan has to help the agency respond promptly and recover. The model lists seven areas it must address:
- An internal response process. What happens, in what order, when someone suspects an event.
- Goals. What the plan is trying to protect and restore.
- Roles and decision authority. Who leads, who decides, and who can act when the owner is unreachable.
- Communications. How the agency talks to staff, clients, carriers, and regulators, internally and externally.
- Remediation requirements. How the agency identifies and fixes the weakness that allowed the event.
- Documentation and reporting. How the agency records the event and its response.
- Review after an event. How the agency evaluates and revises the plan once things settle.
Read that list as an agency owner, and one item stands out. Roles and decision authority. In a small agency, the owner often holds every decision. If the owner is on a plane, the plan stalls. A useful insurance agency incident response plan names a backup decision maker in writing.
Section 5 adds the investigation duties. The agency, or a vendor acting for it, must determine whether an event occurred, assess its scope, identify the nonpublic information involved, and restore security. Section 5D requires the agency to keep records of every cybersecurity event for at least five years. Those records must be available if the commissioner asks.
How an insurance agency incident response plan runs in the first 72 hours
An insurance agency incident response plan on paper helps only if your team can run it under stress. Here is a practical sequence for a small agency. Adjust it to your state’s law and your own systems.
Hour zero to hour four: contain and call
Whoever spots the problem reports it to the named incident lead right away. The lead starts a written log with the time, the first report, and every action taken. Next, the team contains the damage. That can mean resetting a compromised password, disconnecting an infected machine, or suspending a mailbox rule that forwards client email. The lead then calls the agency’s outside response resources. That may include a breach response provider, counsel, and the agency’s cyber insurance carrier if the policy has notice terms.
Preserve evidence as you go. Do not wipe a laptop or delete suspicious emails before someone reviews them. The investigation needs them, and so may the commissioner.
Hours four to 24: investigate and decide
The investigation answers the Section 5 questions. What happened? Which systems were involved? Whose information was exposed? Is the attacker still inside? The goal of this window is a clear determination. Once the agency determines that a cybersecurity event occurred, the 72-hour clock is running. Write down the time of that determination. It anchors every deadline that follows.
Hours 24 to 72: notify with what you know
Section 6B lists up to 13 items the commissioner may expect. They include the date of the event, how it was discovered, the types of information involved, the number of affected residents, and a named contact person. The model says to provide as much as possible, and it creates a continuing duty to update. So the first notice does not need every answer. It needs to arrive on time.
Consumer notice follows your state’s breach notification law. Those deadlines are separate, and many states have tightened them. Our guide to business data protection practices covers how several states shortened consumer notice windows in 2026.
After 72 hours: fix, record, and review
Once notices go out, the work shifts to remediation and records. Close the gap that let the attacker in. Update the notice to the commissioner as facts change. File the event log where you can find it for five years. Then hold a short review. What slowed the team down? What would you change? Section 4H expects that review, and it is the step most teams skip.
Vendor breaches and your insurance agency incident response plan
Many agency breaches never touch the agency’s own systems. They start at a comparative rater, an agency management system, a payment processor, or an outsourced IT provider. Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party rose 60% in a year. They now account for 48% of all breaches in its dataset.
The model law does not let an agency hand that problem off. Under Section 6D, a vendor event gets the same treatment as an event on the agency’s own systems. The agency’s deadline begins the day after the vendor notifies it, or the day it otherwise learns of the event, whichever comes first. Under Section 5C, the agency must complete the investigation steps itself or confirm and document that the vendor did.
That makes vendor oversight part of incident response, not a separate checklist. Section 4F requires due diligence in selecting vendors and requires vendors to protect the information they hold. In practice, an insurance agency incident response plan should list:
- Every vendor that stores or can access client nonpublic information
- Each vendor’s breach contact and how fast its contract requires it to notify you
- Who at the agency receives vendor breach notices and logs the date
- What records you will need from the vendor to answer the commissioner
Our third-party data breach guide walks through what small businesses should ask vendors before something goes wrong.
What these events cost a small agency
The legal deadline is only part of the exposure. The larger cost usually comes from lost time. Verizon’s 2026 Breach Impact Study analyzed roughly 70,000 U.S. cyber insurance claims. It put the median impact for small and midsize businesses at about $38,000, and it named business interruption as the fastest-growing source of loss.
The attack types that drive those losses are familiar to agencies. Ransomware appeared in 48% of breaches in the 2026 DBIR, up from 44% the year before. The FBI’s 2025 Internet Crime Report put business email compromise losses at about $3 billion, the second-largest category of reported loss. Agencies move premium payments, claim checks, and client banking details every day. That makes them a natural target for payment redirection schemes like the one in our help desk impersonation guide.
An insurance agency incident response plan does not stop these attacks. It shortens the time between the first report and a controlled response. For a small agency, that time is where most of the cost lives.
Building an insurance agency incident response plan your team can run
An insurance agency incident response plan does not need to be a thick binder. It needs to be a short document your team has read, backed by people who know their roles. Start with these pieces:
- A named incident lead and a backup. Put both names in writing, with phone numbers that work after hours.
- A one-page call list. Include your breach response provider, counsel, your cyber insurance carrier’s notice line, key vendors, and your state insurance department’s reporting contact.
- A determination rule. Decide in advance who declares that a cybersecurity event occurred, and how that time gets recorded.
- A notification worksheet. Pre-build a form with the Section 6B items so the team fills in blanks instead of starting from scratch.
- A vendor section. List vendors that hold client data and how each will notify you.
- Staff training. Teach every employee how to report a suspicious email, call, or login right away. The report starts the clock on your response, not the attacker’s.
- An annual tabletop exercise. Walk through one realistic scenario for 45 minutes. Fix whatever breaks.
Then keep records of the work: training completion, vendor reviews, and exercise notes. If a commissioner, carrier, or client ever asks what your agency does to protect its data, those records answer faster than any policy statement. Our four-week Cybersecurity Awareness Month plan schedules that training, vendor review, and a tabletop exercise across October.
Insurance agency incident response plan FAQ
Does the NAIC Insurance Data Security Model Law apply to independent agencies?
The model applies to licensees, which include agencies and producers licensed by a state insurance department. Whether it applies to your agency depends on whether your state adopted a version of it and how that version reads. Check your state statute and the NAIC adoption chart.
How long does an agency have to notify the insurance commissioner?
Under the model law, no later than 72 hours after the agency determines that a cybersecurity event has occurred. Some states changed that timing or the triggers in their own versions, so confirm your state’s rule.
Is an agency with fewer than ten employees exempt?
Under the model, an agency with fewer than ten employees, including independent contractors, is exempt from Section 4, the written information security program. It is not exempt from the investigation and notification duties in Sections 5 and 6.
Does a breach at our agency management system vendor count?
Yes. Under the model, a cybersecurity event at a third-party service provider gets the same treatment as one on your own systems. Your deadline starts the day after the vendor notifies you or you otherwise learn of it, whichever comes first.
What does an insurance agency incident response plan need to include?
The model lists seven areas: an internal response process, goals, roles and decision authority, communications, remediation, documentation and reporting, and review after an event. A practical plan adds a call list, a vendor section, and a notification worksheet.
How long must we keep records of a cybersecurity event?
The model requires licensees to keep records of all cybersecurity events for at least five years and produce them on the commissioner’s request. Your state’s version may set different terms.
Is consumer notification the same as notifying the commissioner?
No. Consumer notice follows your state’s general breach notification law, which has its own deadlines and triggers. Under the model, the agency also sends the commissioner a copy of the consumer notice when commissioner notice is required.
Put people and records behind the plan
A plan only works when someone answers the phone at hour one and the records exist at hour 72. defend-id Business Essentials gives agencies 24/7 incident response and breach support, short employee security training, vendor management, and vulnerability scanning in one place. It helps your team organize, assign, and document the work behind your plan. Your agency still owns its plan and its obligations under your state’s law. See how defend-id supports insurance agencies.
Related articles
by Brian Thompson | Sep 16, 2026 | Breach, Identity Theft
A director at a mid-sized firm gets a phone call. The caller ID looks internal. The voice says it is IT support, following up on a login issue. It asks the director to click a link and verify the account. Nothing about the call feels unusual, because the attacker built it that way. This is a help desk impersonation scam. A new wave of it is currently targeting executives at small and mid-sized businesses.
Last Updated: September 2026
Security researchers at Arctic Wolf disclosed the campaign on September 7. They track it as PREY-0058. It is not a phishing email, and it is not a mass text blast. It is a live phone call from someone who sounds like they should be on your payroll. And it is working, largely because businesses assume this kind of attack targets IT staff, not executives.
What Happened: A New Help Desk Impersonation Campaign
PREY-0058 is a data theft and extortion operation. It targets Microsoft 365 and other cloud business tools. Arctic Wolf reports the campaign shares tradecraft with a group Google’s Mandiant tracks as UNC6671. A separate extortion group called Cinder likely overlaps with an earlier operation known as Pink. The specific group label matters less than the pattern underneath it. Several active crews are running the same playbook against American businesses right now, and refining it in parallel.
The campaign mainly singles out directors, vice presidents, and other executive staff. It does not focus on general employees. Confirmed targets span construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services. That list reads like a cross-section of the small and mid-sized business world. That is exactly why this deserves attention now, before the next round of headlines names a company you recognize.
How the Help Desk Impersonation Scam Works
The attack does not rely on malware. The attacker does not need to break into your network from the outside. It works because it convinces one real employee to open the door from the inside.
- The call. An attacker claiming to be internal IT or help desk staff calls the target directly. They often reference a plausible account or login issue to establish credibility fast.
- The link. The caller asks the target to visit a page to verify their account, reset a password, or register for multi-factor authentication.
- The capture. The page is a convincing fake. The target signs in and approves the MFA prompt. The attacker captures the authenticated session token in real time, a technique known as adversary in the middle, or AitM.
- The replay. The stolen session token gets replayed through a residential proxy. This makes the attacker’s login look like an ordinary home internet connection, not a suspicious one.
- The harvest. Once inside, the attacker browses SharePoint, OneDrive, Exchange, and Box. They collect whatever files and messages are accessible, then send an extortion demand.
Arctic Wolf found hundreds of lookalike subdomains built to impersonate real companies as part of this infrastructure. The attackers deploy no endpoint malware. They attempt no lateral movement across the internal network. Everything happens inside legitimate, cloud-based tools your business already uses and trusts every day. That is exactly why it does not trip the alarms a traditional malware infection would.
Why Executives Are the Target, Not Just the Help Desk
Most cybersecurity awareness content still frames voice-based scams as a threat aimed at receptionists and front-line staff. That framing is out of date. Verizon’s 2026 Data Breach Investigations Report found the human element present in 62 percent of breaches. Social engineering was the third most common breach pattern overall, at 16 percent. For the first time, the report broke out pretexting as its own initial access vector. Pretexting covers this kind of live-call impersonation. It reached 6 percent of breaches, and it is rising. Verizon’s researchers also found that phone-based social engineering succeeds roughly 40 percent more often than email phishing. Stopping it takes different training than a standard “do not click the link” course, since the target is being asked to be helpful in the moment, not to click something obviously suspicious.
Executives are attractive targets for three reasons. They carry the broadest account access. They get the least day-to-day scrutiny from IT. And they have the least time to double-check an unexpected call before their next meeting. Sophos’s 2026 State of Ransomware report found that 79 percent of ransomware attacks now begin with compromised identities, not a software vulnerability. Businesses with 100 to 250 employees stop attacks before encryption only 34 percent of the time. Larger enterprises stop them 46 percent of the time. Smaller organizations are not just as exposed here. They are measurably worse positioned to catch it in time.
Why MFA Alone Does Not Stop This
Multi-factor authentication is supposed to be the safety net under a stolen password, and it usually is. AitM attacks like PREY-0058 are built specifically to get around it. The victim is not tricked into giving up a password in isolation. They are walked through a real login and a real MFA approval on a fake page. The attacker then captures the session token issued afterward. That token behaves like a valid, already-authenticated login. That is why it survives standard MFA, and why identity itself has become the primary battleground instead of the password field. SpyCloud’s 2026 Identity Exposure Report recaptured 5.3 billion credential pairs from criminal sources in 2025 alone. Eighty percent of exposed corporate credentials sat in plaintext. Nearly half of all phished identities in its dataset belonged to corporate users, not consumers.
Why the Response Window Is Measured in Minutes
Once an attacker has a working session token, they move fast. Sophos’s separate 2026 Active Adversary Report is based on 661 incident response cases. It found the median dwell time before detection down to three days overall. Attackers who gain initial access now reach an organization’s Active Directory server in as little as 3.4 hours. Applied to a help desk impersonation scam, the gap matters. The gap between one employee approving a fake MFA prompt and an attacker pulling files out of SharePoint or Exchange is not a multi-day window. It is a same-day problem. A business that treats a suspicious IT call as something to mention at the next staff meeting is giving the attacker exactly the head start these numbers describe. The same compromised mailbox is how fake wire instructions reach borrowers at a mortgage closing, which is why our mortgage wire fraud prevention guide puts MFA and mailbox checks near the top of its list.
How to Protect Your Business
You do not need an in-house security team to close most of this gap. A few concrete habits go a long way.
- Never approve an MFA prompt you did not request. If a push notification appears out of nowhere, deny it and change the password immediately.
- Verify the caller through a number you already have on file. Do not use a number they give you, and do not click anything a self-identified IT caller sends.
- Move toward phishing-resistant MFA where your provider supports it, such as passkeys or hardware security keys. These are far harder to intercept through AitM than a one-time code.
- Use conditional access policies to restrict sign-ins from unexpected locations or unmanaged devices. Watch for a sign-in followed immediately by heavy SharePoint or Exchange search activity.
- Put the real policy in writing, in plain language. A legitimate help desk will never ask an employee to approve an MFA prompt or enter credentials into a page a caller sent them.
There is a second layer worth planning for now, not after an incident happens. Attackers pulling data out of SharePoint, OneDrive, Exchange, and Box are not always after corporate secrets. HR files, benefits records, and employee personal information often live in those same systems. An attack aimed at the business can end with individual employees’ Social Security numbers, dates of birth, and personal records sitting in an extortion group’s hands. That is a personal identity theft problem for the people affected, not just an IT incident for the company. Identity theft protection as an employee benefit gives a team somewhere to turn. Monitoring, alerts, and full-service recovery support are available if their information ends up exposed this way, separate from whatever the IT team is doing to secure the network itself.
Frequently Asked Questions
What is a help desk impersonation scam?
A help desk impersonation scam is a social engineering attack. A criminal poses as internal IT or help desk staff, usually by phone, to convince an employee to approve a fraudulent login or multi-factor authentication request. It gives the attacker access without needing malware or a direct network breach.
How is this different from typical vishing?
It uses the same voice-call delivery as other vishing attacks. The specific impersonation of internal IT staff, paired with adversary-in-the-middle token theft, makes it more effective at defeating standard multi-factor authentication than a generic scam call.
Does multi-factor authentication stop this attack?
Not reliably. The attacker captures a valid session token after the victim completes a real MFA approval. Standard MFA methods like one-time codes and push approvals do not block that. Phishing-resistant methods such as passkeys and hardware security keys are significantly more effective.
Who is being targeted by campaigns like PREY-0058?
Arctic Wolf’s research found the campaign mainly targets directors, vice presidents, and other executive staff. Confirmed victims span construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.
What should an employee do if they get a call from “IT support”?
Hang up. Call the help desk back using a number already on file, never a number or link the caller provides. A legitimate IT team will never ask an employee to approve an MFA prompt they did not initiate.
What should a business do if employee data was exposed in an attack like this?
Confirm what systems and file locations were accessed. Notify affected employees promptly. Give them a path to identity monitoring and recovery support, since exposed HR and benefits data can lead to personal identity theft separate from the initial business intrusion.
Help desk impersonation scams work because they exploit trust in an ordinary workplace interaction, not a technical flaw you can simply patch. Training your team to verify before they trust is the first line of defense. Our four-week Cybersecurity Awareness Month plan shows how to fit that training into October. Giving employees a real safety net if their personal information ends up exposed anyway is the second. defend-id gives your team identity monitoring, fraud alerts, and full-service recovery support as a voluntary benefit. A breach at the company level does not have to become a lasting personal crisis for the people who work there. Learn how defend-id can protect your team.
Related Articles
help desk impersonation scam
by Brian Thompson | Sep 9, 2026 | Breach, SMB
Data breach notification requirements for small businesses changed in more states than most owners realize this year. California shortened its notice deadline to a hard 30 days. Oklahoma expanded what counts as reportable data and attached six-figure penalties to businesses that cannot show they had reasonable safeguards in place. Virtually every small business handles customer or employee data. If yours does, the rules you followed in 2025 are already out of date.
Last Updated: September 2026
Most small business owners think of a data breach as an IT problem. It is also a legal deadline, and in 2026 that deadline got shorter, stricter, and more expensive to miss. The businesses least prepared for that shift are not the ones getting breached. They are the ones who get breached and then find out, in the middle of the worst week of their year, that they had 30 days to notify customers. They had no idea the clock had already started.
What Changed in 2026: New Data Breach Notification Requirements in California and Oklahoma
Two states moved first, and both took effect January 1, 2026.
California’s New 30-Day Deadline
California (SB 446) replaced its old standard, “the most expedient time possible,” with a specific number. Businesses must now notify affected California residents within 30 calendar days of discovering or learning of a reportable breach. Narrow exceptions remain for active law enforcement investigations, but the default is now a countdown, not a judgment call. If a breach affects more than 500 residents, you must also notify the state Attorney General, within 15 calendar days of notifying individuals.
Oklahoma’s Bigger Overhaul
Oklahoma (SB 626) went further. It expanded what counts as reportable data. On top of the usual Social Security and payment card numbers, the list now includes government-issued IDs, electronic credentials that enable access to financial accounts, and biometric information. Breaches affecting 500 or more residents require Attorney General notification within 60 days. That notice must cover what happened, what data the breach involved, how many residents it affected, what safeguards the business had in place, and the estimated financial impact.
Oklahoma also attached real numbers to non-compliance: businesses without reasonable safeguards in place face penalties up to $150,000 per breach. Businesses that had safeguards but failed to meet the notice requirements face $75,000 plus actual damages. Sector exemptions exist for entities already regulated under HIPAA, GLBA, or Oklahoma’s Hospital Cybersecurity Protection Act, but even those businesses still have to notify the Attorney General.
This Is Now the National Trend
Neither law applies only to large companies. Both apply to any business handling the data of state residents. A five-person shop in Tulsa with customers in Oklahoma is on the hook exactly the same as a regional retailer.
California and Oklahoma are not outliers, they are the leading edge of a pattern. More than 20 states have moved toward specific, shorter notification windows over the past few years. That replaces the old “reasonable time” language that gave businesses room to interpret their own obligations. Most small businesses with any online presence effectively operate in multiple states. If yours does, assume a 30-day clock, not a vague one, is already the standard that applies to you.
Why “Reasonable Safeguards” Is Now the Legal Standard
Oklahoma built its penalty structure around a phrase that used to be vague: reasonable safeguards. It is not vague anymore. The FTC Safeguards Rule already applies to a wide range of businesses that handle consumer financial data. It spells out exactly what a reasonable information security program has to include:
- A designated person responsible for the program
- A written risk assessment, reviewed periodically
- Access controls, data encryption, and multi-factor authentication
- Continuous monitoring, or annual penetration testing plus vulnerability scans every six months
- Regular employee security training
- Oversight of vendors and service providers who touch your data
- A written incident response plan
- At least annual reporting on how the program is performing
That list is no longer just an FTC requirement for financial-adjacent businesses. It is quickly becoming the practical definition of “reasonable safeguards.” State Attorneys General, courts, and cyber insurers point to this list when they decide whether a breached business gets the lighter penalty or the six-figure one.
The Six Pillars of a 2026 Data Protection Program
Strip away the legal language and the FTC’s list collapses into six practices every small business needs. That holds regardless of which state’s law technically applies to you.
Pillars One Through Three
1. Vulnerability scanning. You cannot fix what you cannot see. Regular scanning of your network and systems for exploitable weaknesses is the baseline every regulator now expects. It is also the single fastest way to catch a problem before it becomes a breach instead of after.
2. Written, current policies. A security policy you have not reviewed since you wrote it is not a policy, it is a liability. Regulators and courts increasingly ask not just whether you had a policy, but when you last updated it.
3. An incident response plan you have actually tested. When a breach happens, the businesses that meet their notification deadlines are the ones that already know who does what. Figuring out your response plan during the breach itself is how 30-day deadlines get missed.
Pillars Four Through Six
4. Employee training that keeps up. Human error is still the leading cause of breaches. A once-a-year slideshow does not meet the bar anymore; regulators are looking for ongoing, practical training that reflects current threats like AI-generated phishing.
5. Vendor and third-party oversight. Your obligations do not stop at your own systems. If a vendor with access to your customer data gets breached, you can still be the one who has to notify. Knowing who has access to what, and holding vendors to a written standard, is now a documented requirement, not a nice-to-have.
6. A policy center you can actually produce on demand. When an Attorney General, an auditor, or a cyber insurance underwriter asks for proof of your safeguards, “we have a guy who handles that” is not an answer. You need documentation you can hand over the same day someone asks for it.
What Unprepared SMBs Are Actually Losing
The cost of getting this wrong is not hypothetical, and it is not shrinking.
The average cost of a data breach globally reached $4.44 million in IBM’s 2025 Cost of a Data Breach Report. Breached organizations took an average of 241 days to identify and contain an incident. That is the fastest that number has been in nine years, and still the better part of a full year. Organizations using unsanctioned “shadow AI” tools tacked an additional $670,000 onto their average breach cost, and 63% of organizations still have no AI governance policy at all.
Small businesses are not sitting this out. VikingCloud’s 2025 SMB Threat Landscape Report found that a successful cyberattack hit 1 in 3 small and mid-sized businesses in the past year. One in 5 said damages of just $10,000 would be enough to force them to close. Seventy-one percent admit their own defenses are inadequate, and 74% manage cybersecurity themselves, without dedicated training, because that is what their budget allows.
The FBI’s Internet Crime Complaint Center recorded nearly $21 billion in reported cybercrime losses in 2025, a 26% jump from the previous year’s record. Business email compromise alone accounted for more than $3 billion of that total. None of this is theoretical risk. Unprepared businesses are receiving that bill right now, and states are writing penalties into law for the ones that cannot show they tried.
Building a Program That Meets Data Breach Notification Standards
None of this requires an in-house security team or an enterprise budget. It requires the six pillars above, implemented consistently and documented in a way you can produce on short notice. Start by identifying which of the six your business is missing today. That gap is exactly where a breach turns into a six-figure problem instead of a bad week.
If your current program is a folder of documents nobody has opened since last year, the deadlines above are the moment to change that. Do it before a regulator or a breach forces the timeline. The businesses that come through a breach in the best shape are rarely the ones with the fewest incidents. They are the ones who could already answer “what are your safeguards” before anyone asked. They had already written the answer down, kept it current, and could point an employee straight to it without a scramble.
Frequently Asked Questions
What is the FTC Safeguards Rule, and does it apply to my small business?
The FTC Safeguards Rule applies to businesses that handle consumer financial information. That includes many auto dealers, mortgage brokers, tax preparers, and retailers offering financing. It requires a written information security program covering risk assessment, access controls, employee training, vendor oversight, and incident response. If you are unsure whether it applies to you, assume the underlying practices apply anyway; most state breach notification laws now reference similar standards.
State Deadlines and Penalties
What is the deadline to notify customers after a data breach in California in 2026?
Under SB 446, California businesses must notify affected residents within 30 calendar days of discovering or learning of a reportable breach. If a breach affects 500 or more residents, you must notify the Attorney General within 15 calendar days of notifying individuals.
What changed under Oklahoma’s new breach notification law, SB 626?
Oklahoma expanded reportable data to include government-issued IDs, financial account credentials, and biometric data. Breaches affecting 500 or more residents require Attorney General notification within 60 days. Penalties range up to $150,000 per breach for businesses without reasonable safeguards, or $75,000 plus damages for businesses that had safeguards but failed to meet notice requirements.
What counts as “reasonable safeguards” under these laws?
There is no single legal checklist that applies everywhere. The FTC Safeguards Rule lists nine elements: risk assessments, access controls, vulnerability testing, employee training, vendor oversight, and a written incident response plan among them. Regulators and insurers increasingly treat that list as the practical standard.
Cost, Planning, and Compliance Overlap
How much does a data breach actually cost a small business?
There is no single small-business-specific figure, but the signals are consistent. The global average breach cost was $4.44 million in 2025. According to VikingCloud’s 2025 research, 1 in 5 small and mid-sized businesses say damages of just $10,000 would be enough to force them to close.
Do I need a written incident response plan even if I have never had a breach?
Yes. Both the FTC Safeguards Rule and Oklahoma’s new law expect one to already exist. You should not be writing it for the first time after an incident occurs. A tested plan is also what makes hitting a 30-day notification deadline realistic instead of theoretical.
What is the difference between HIPAA, GLBA, and FTC Safeguards Rule compliance?
HIPAA governs health information and applies to healthcare providers and their business associates. GLBA governs financial information and applies to financial institutions broadly defined. The FTC Safeguards Rule implements GLBA’s security requirements specifically. Many small businesses, particularly those handling any kind of financing, fall under more than one of these at the same time.
Related Articles
by Brian Thompson | Aug 12, 2026 | Breach, Identity Theft
The Identity Theft Resource Center released its H1 2026 Data Breach Report on July 22. The number at the top of it is hard to process: 471.2 million victim notices issued in six months. That already beats every notice sent out across all of 2025 combined, and it happened in half the time. If you run a small business or manage HR and benefits, this is not just a scary headline. It is a set of specific, actionable signals about where risk actually sits right now. Most of it does not look like the breach coverage you are used to reading, and that gap is exactly why this report is worth your time.
Last Updated: August 2026
According to the H1 2026 data breach report, the ITRC tracked 1,803 data compromises in the first half of the year. That pace puts 2026 on track to pass the 3,321 compromises recorded in all of 2025. Q2 alone accounted for 1,029 of those compromises, the second highest single quarter in ITRC’s tracking history. But the compromise count is not what makes this report unusual. It is where the notices came from, and what that concentration means for any company that relies on outside vendors. That describes almost every company, including yours.
What the H1 2026 Data Breach Report Actually Reveals
A single incident involving Instructure Holdings’ Canvas education platform generated an estimated 275 million victim notices on its own. That is the Canvas learning management system used in thousands of schools, not the Canva design tool. One breach, 58 percent of the entire H1 total. Attackers reportedly used a support ticket submitted through a teacher account as their entry point. From there, they pulled an estimated 3.65 terabytes of data. The fallout has already touched nearly 9,000 schools.
Zoom out and the pattern holds across the whole report. Supply chain attacks generated 280.6 million victim notices from just 38 initial breach events in H1 2026. Those 38 events spread across 206 downstream entities. One vendor gets hit, and the notice count multiplies across every organization that trusted that vendor with data. Financial services led all sectors in raw compromise frequency at 387 incidents, with healthcare close behind at 281. Publicly traded companies made up only 10.3 percent of compromises. They still accounted for 83.4 percent of all victim notices. When a large platform goes down, it takes its entire customer base down with it.
None of this requires your company to be the one that gets breached. It requires your company to use software, payroll providers, benefits administrators, or any other vendor that touches employee or customer data. Most SMBs check that box several times over, often without a clear inventory of which vendors hold what.
Insider Wrongdoing Is Up Sevenfold, and the Number Is Small on Purpose
The report also documented 21 malicious insider wrongdoing events in H1 2026, compared to just 3 across all of 2025. That sevenfold jump is the ITRC’s own framing, and it holds up. It is also worth reading correctly. Twenty one events is still a small, high severity category. It is not a sign that a fifth of the workforce has gone rogue. The ITRC ties the rise to two forces converging at once. Tech sector layoffs are creating disgruntled or financially desperate former employees with lingering access. At the same time, nation state recruitment schemes are targeting insiders directly, offering payment in exchange for data or system access.
The financial exposure behind that category is real even at small scale. The Ponemon Institute’s 2026 Cost of Insider Risks Global Report puts the average cost of a malicious insider incident at $742,125. Organizations spend an average of $19.5 million annually managing insider risk overall. Those figures come from large enterprise data sets, so treat them as a ceiling rather than a prediction for a 40 person company. But the underlying math does not disappear at smaller scale. It just means there is far less budget available to absorb a single bad incident, and far less room for a slow response.
For HR and benefits teams specifically, this is the offboarding conversation nobody wants to have twice. Access review at termination, not just at hire, is no longer optional. A departing employee with valid credentials and thirty days of unrevoked access is exactly the profile the ITRC is describing.
The Transparency Crisis: Notification Is Not the Same as Information
Only 24 percent of H1 2026 breach notices disclosed any information about the attack vector. That is the lowest rate the ITRC has ever recorded. It means roughly three out of four people will receive a breach notice this year with no real explanation attached. The same is true for three out of four HR departments handling the fallout. Nobody learns whether it was phishing, ransomware, an unpatched vulnerability, or an insider. They get told they were exposed. They do not get told how. That gap makes it nearly impossible to know what to actually change in response, so the same vulnerability often stays open long after the notice arrives.
This gap matters more than it sounds like it should. A notice with no attack vector gives an employee nothing to act on beyond generic advice. It gives an employer nothing to defend against beyond generic controls, applied everywhere and tailored to nothing. Fourteen zero day events were recorded in H1 2026 alone, nearly matching all of 2025’s total of 17. That trend line matters because zero day attacks target flaws nobody knew existed yet. No amount of employee training would have stopped them.
What SMB Owners and HR Teams Should Do Differently in the Second Half of 2026
The ITRC’s own guidance for businesses centers on three moves. Adopt a zero trust posture instead of assuming internal network traffic is automatically safe. Apply least privilege access controls so any single compromised account, whether it belongs to an employee or a vendor, can only reach what it strictly needs. Vet supply chain vendors on an ongoing basis rather than once at signing. None of that requires an enterprise security budget. It requires treating vendor access the way you would treat a new hire’s access. Review it on a schedule, limit it by default, and revoke it the moment it is no longer needed.
A few concrete starting points for the second half of the year:
- Audit which vendors currently hold employee Social Security numbers, banking details, or health information. Confirm each one has a breach notification obligation spelled out in its contract, not just implied.
- Review offboarding procedures specifically for access removal timing. Paperwork completion and system access removal are two different clocks, and they should not run on different days.
- Assume any breach notice your company receives this year will not tell you how the breach happened. Build your response plan around that assumption instead of waiting for details that likely will not come.
- If your organization does not already offer identity monitoring as a benefit, H1 2026’s numbers make the business case on their own. With 471 million notices already issued, the odds that an employee receives one this year are no longer low.
- Ask new and existing vendors directly what their own insider access controls look like. A vendor that cannot answer that question is a bigger liability than the report’s numbers suggest on their own.
- Put a specific person’s name next to breach response, not just a department. When a notice arrives at 5pm on a Friday, “someone in IT will handle it” is not a plan.
The Small Business Post-Breach Playbook walks through the first 48 hours after your own company gets hit directly. This report describes the more common scenario for most SMBs in 2026: a vendor gets hit, and your employees end up holding the notice instead of you.
Frequently Asked Questions
What is the ITRC H1 2026 Data Breach Report?
It is the Identity Theft Resource Center’s midyear analysis of U.S. data compromises, published July 22, 2026. It tracked 1,803 compromises and an estimated 471.2 million victim notices issued between January and June 2026. That already exceeds the total for all of 2025.
How many people were affected by data breaches in the first half of 2026?
The ITRC estimates 471.2 million victim notices were issued in H1 2026 alone. That figure reflects total notices issued, not unique individuals. One person can receive multiple notices from different breaches in the same period, so the true number of unique people affected is lower than the headline figure.
Why did one breach account for more than half of all H1 2026 notices?
A supply chain breach involving Instructure Holdings’ Canvas education platform generated an estimated 275 million victim notices, or 58 percent of the H1 2026 total. It illustrates how a single vendor compromise can multiply across every organization and individual connected to that vendor, far beyond the original target.
Why are insider threats increasing in 2026?
The ITRC recorded 21 malicious insider wrongdoing events in H1 2026 versus 3 in all of 2025, a sevenfold increase. The report attributes this to tech sector layoffs and nation state recruitment efforts that specifically target employees who already have legitimate data access.
What does the ITRC mean by a transparency crisis?
Only 24 percent of H1 2026 breach notices disclosed how the breach occurred, the lowest rate ever recorded. Most people and businesses receiving a notice have no information about the attack method behind it, which limits their ability to respond with anything more specific than general precautions.
What should small businesses do differently after this report?
The ITRC recommends zero trust architecture, least privilege access controls, and ongoing supply chain vendor vetting rather than one-time onboarding checks. Reviewing offboarding access removal timing and confirming vendor breach notification obligations are practical starting points for smaller teams without a dedicated security staff.
Does identity theft protection help employees after a vendor data breach?
Yes. Most H1 2026 notices originated from third-party vendor breaches rather than direct attacks on the employer. Identity monitoring and recovery support give employees a resource regardless of which vendor was responsible. The employee usually has no direct relationship with that vendor and no easy way to hold it accountable, which is exactly the gap a monitoring benefit is designed to close.
The H1 2026 numbers make one thing clear. Breach exposure is no longer something only large enterprises need to plan around, and a strong password policy alone will not address it. If your company has not reviewed how identity protection fits into your benefits package this year, now is the moment to do it. Talk to Defend-ID about what a turnkey identity protection benefit looks like for a team your size.
Related Articles
by Brian Thompson | Aug 5, 2026 | Breach, Identity Theft, Scams
Deepfake scams have moved past the experimental stage. Criminals no longer need hours of footage or a Hollywood budget. A LinkedIn video, a voicemail greeting, or a few seconds of audio pulled from a webinar recording is now enough to build a convincing fake of your CEO, your CFO, or your employee’s own family member. What used to take a skilled forger a week now takes a scammer minutes.
Last Updated: August 2026.
This article breaks down how deepfake scams are being used against businesses right now and the numbers behind why this threat is accelerating faster than almost any other fraud category. It also covers what actually happens to an employee after they have been the one fooled. That last part is the piece most security blogs skip. It is also the part that matters most once the wire transfer is already gone.
What Is a Deepfake, and Why It Is an HR Problem Now
A deepfake is synthetic media, video, audio, or images, built with artificial intelligence to convincingly mimic a real person’s face, voice, or expressions. Three years ago, deepfake scams required a data set of hours. Today they require far less:
- A handful of public photos
- A short video from a company website, webinar, or LinkedIn post
- As little as three seconds of clean audio
That last point is the one that should worry HR and finance leaders most. Voice cloning models trained on just three to ten seconds of speech can already produce a convincing match. That is enough to fool a coworker on the phone, according to testing cited by Fox News. Every recorded all-hands meeting, sales call, or conference talk your executives have given is now raw material for deepfake scams.
The 2026 Numbers: How Fast Deepfake Fraud Is Accelerating
The scale of this problem has changed dramatically even in the last year. Three data points define the current threat landscape:
- Deepfake fraud attempts are up 2,137 percent over the last three years. Deepfakes made up just 0.1 percent of all fraud attempts three years ago. Today they account for roughly 6.5 percent, according to Signicat’s Battle Against AI-Driven Identity Fraud report.
- The FBI now tracks AI fraud as its own category. The FBI’s 2025 Internet Crime Report, released in April 2026, broke out artificial intelligence complaints for the first time in the Internet Crime Complaint Center’s 25-year history. That new category alone covered 22,364 complaints and nearly $893 million in reported losses. The FBI stated the real number is likely higher, since most victims never realize AI was involved in the scam that hit them. Read the full release from the FBI’s National Press Office.
- Per-incident losses are climbing. Industry surveys of business leaders in 2026 put the average cost of a single deepfake fraud incident close to $500,000. Financial services firms report losses well above $600,000 per incident, while small businesses typically lose tens of thousands rather than hundreds of thousands. These figures vary by methodology and industry, so treat them as directional rather than exact.
None of this is a one-time news event. Deepfake scams are a live, accelerating trend. The businesses least prepared for it are the ones still picturing deepfakes as a novelty rather than a Tuesday-morning phone call.
How Cybercriminals Use Deepfakes to Target Your Business
Deepfakes fit naturally into the fraud tactics businesses already deal with. They just make each one far more convincing:
- Wire transfer fraud. A video call or voice message from “leadership” requesting an urgent payment, often timed for end of day or before a holiday when verification is slower.
- Credential harvesting. A cloned voice posing as an IT admin who needs a password reset “right now” to fix a supposed outage.
- Data access manipulation. An impersonated executive requesting sensitive files, HR records, or payroll data.
- Vendor and partner scams. A cloned voice leaving a voicemail about “updated” banking details for an upcoming invoice.
What changed in the last year is the sourcing. Attackers used to need a leaked recording or a hacked voicemail system to get audio of an executive. Now they pull it from the same LinkedIn video your marketing team posted to build the CEO’s personal brand. The more visible your leadership is online, the more raw material a scammer has to work with.
Real-World Example: $25 Million Lost to a Single Video Call
In one widely documented case, a finance employee joined a video call that appeared to include the company’s CFO and several familiar colleagues. Every face and voice on the call matched people the employee had worked with for years. The “CFO” instructed the employee to process a transfer, and the employee complied. By the end of the call, this deepfake scam had moved more than $25 million to accounts controlled by criminals.
Every person on that call, other than the victim, was a deepfake. Nothing about the request felt unusual because everything about the delivery felt normal. That is the core danger of deepfake scams: they do not exploit a technical vulnerability. They exploit the trust employees place in their own eyes and ears.
Red Flags: What Employees Can Still Catch
Deepfake technology keeps improving, but most attacks in the wild still carry small tells. Slow down and check for these before acting on any urgent request:
Visual cues
- Lips slightly out of sync with the audio
- Unnatural blinking or stiff facial movement
- Lighting or shadows that do not match the rest of the frame
- Body movement that does not track with speech cadence
Audio cues
- A flat or slightly robotic tone
- Repetitive phrasing or odd word choices
- Background noise that cuts in and out unnaturally
- Speech rhythm that feels a little off compared to how the real person talks
These cues will not always be obvious, and they will get harder to spot as the technology improves. That is exactly why verification habits matter more than visual scrutiny alone.
Verification Habits and Organizational Protections
Modern security awareness is not about spotting every fake. It is about pausing long enough to verify. Before acting on an unusual request, employees should ask themselves three questions: Is this request unusual for this person? Would acting on it cause serious harm if it turns out to be fake? Is there a second way to confirm it?
Organizations can make deepfake fraud far harder to pull off with a few concrete steps:
- Require a callback or shared passphrase for any request involving a wire transfer, password reset, or sensitive data, confirmed through a channel the attacker does not control.
- Turn on multi-factor authentication everywhere sensitive systems live, so a cloned voice cannot substitute for a stolen credential.
- Limit public exposure of executive voice and video where practical, and be aware that any public appearance is now training data for attackers.
- Run regular security awareness training that specifically covers deepfake and voice-cloning scenarios, not just email phishing. Our phishing awareness guide and vishing attacks breakdown are good starting points for that training.
- Give employees identity protection as a benefit, not just a corporate firewall. Deepfake scams frequently start with stolen personal data. Employees need somewhere to turn when their own identity, not just the company’s bank account, is what gets hit.
What Happens to the Employee After the Call
Most coverage of deepfake scams stops at the wire transfer. That is a mistake, and it is the gap defend-id was built to close.
The $25 million case above involved a corporate account. But a growing share of deepfake and voice-cloning fraud targets employees personally, not just their employer. A cloned voice claiming to be a family member “in trouble” convinces someone to wire money from their own savings. A fake HR representative talks an employee into confirming a Social Security number “to update payroll.” A spoofed executive persuades a new hire to share personal banking details during onboarding. When that happens, the damage lands on the individual employee’s credit, bank accounts, and peace of mind, not just the company’s balance sheet.
This is where the employer/HR angle actually pays off. Generic IT-security content stops at “train your employees.” It rarely addresses what happens to that employee after they have already been tricked. Their own identity is now compromised, and they do not know where to turn. That is a retention and trust question as much as a security one.
Offering identity theft protection as an employee benefit means someone on your team has support the moment this happens. Monitoring catches misuse early, and recovery advocates handle the calls, disputes, and paperwork so the employee is not fighting it alone. It is the difference between an employee quietly absorbing a financial disaster and an employee who knows their employer had their back when it counted. For the fuller case, see our 2026 HR guide to identity theft protection as a benefit.
Related reading: our breakdowns of deepfake job applicants targeting HR teams and workplace identity theft hijacking employee paychecks cover two more angles on this same trend.
Frequently Asked Questions
What is a deepfake scam?
A deepfake scam uses AI-generated video, audio, or images to impersonate a real person, such as an executive, IT admin, vendor, or family member. The goal is to trick someone into sending money, sharing credentials, or handing over sensitive data.
How much audio does it take to clone someone’s voice in 2026?
Current voice-cloning tools can produce a convincing match from as little as three to ten seconds of clean audio. That audio is often pulled from public sources like a LinkedIn video, webinar recording, or voicemail greeting.
How fast are deepfake scams actually growing?
Deepfake fraud attempts have increased 2,137 percent over the last three years, according to Signicat. The FBI also added AI fraud as its own tracked category for the first time in its 2025 Internet Crime Report. That new category covered more than 22,000 complaints and nearly $893 million in losses.
Can employees really detect a deepfake without special tools?
Sometimes. Lip-sync issues, unnatural blinking, flat vocal tone, and odd background audio are still common tells. But detection alone is not a reliable defense as the technology improves, which is why verification protocols matter more than visual scrutiny.
What happens to an employee personally if they are tricked by a deepfake scam?
It depends on the scam. Employees can lose personal savings, have their Social Security number or banking details exposed, or become targets of follow-up fraud. Identity theft protection benefits give them monitoring and recovery support for exactly this scenario.
What should a business do if it suspects a deepfake attack in progress?
Stop the interaction and verify the requester’s identity through a separate, trusted channel, such as a known phone number. Do not proceed with any transfer or data disclosure until that verification is confirmed.
Awareness and Systems Are Your Best Defense
Deepfake scams work because they exploit the one thing humans trust most, our own eyes and ears. You cannot stop the technology from improving. You can build the habits and systems that keep your organization, and your employees, ahead of it. Slow down. Verify identity through a second channel. Use passphrases for high-risk requests. Give employees somewhere to turn when the fraud gets personal.
defend-id provides the automated layer that protects employees when identity-based attacks slip past training and policy. Monitoring, alerts, and full recovery support reduce risk and distraction. Your team stays focused on the work instead of untangling a stolen identity on their own time. Talk to us about adding identity protection to your benefits package.
Related Articles
by Brian Thompson | Jun 17, 2026 | Breach, Employee Benefits, Identity Theft
Constella Intelligence is one of the companies that powers many of the identity protection services operating in the U.S. today. Every quarter they publish a breach report drawn from their global monitoring network. Their Q1 2026 data breach report covers January through March 2026, and the numbers are worth paying attention to if you have employees.
Here is what the report found, in plain terms.
Criminals stole a staggering amount of data in just three months
In the first quarter of 2026, Constella tracked more than 229,000 breach events across the open web, dark web, and underground forums. After filtering out duplicates and low-quality data, investigators confirmed 3,685 of those as real incidents containing usable identity information. Those breaches produced 9.73 billion verified records.
For comparison: Constella confirmed 8,460 total breaches across all of 2025. The 2026 pace is running nearly double that.
The odds that at least one of your employees has personal data sitting in that pool are not low. They are close to certain.
It is not just passwords being stolen anymore
This is the part that matters most for HR and benefits teams.
The largest category of Q1 breaches came from direct attacks on primary databases: government systems, telecom providers, financial institutions. These are not recycled credential lists. They are fresh records pulled from the source. In fact, 95% of those breaches contained more than just a username and password. Attackers walked away with phone numbers, home addresses, national ID numbers, and financial account details all bundled together.
That is a complete identity profile. Criminals do not need to piece it together from multiple sources. It comes pre-assembled.
One more number worth sitting with: companies holding your employees’ data stored 42% of those breached passwords in plain text. No encryption. No protection. Anyone who accessed those databases got working credentials instantly.
Your employees did everything right and still got exposed because someone else did not.
There is a type of attack most employees have never heard of
The second major finding in the report involves something called infostealers. Most non-technical people have never encountered this term, so here is a plain-language explanation.
An infostealer is a type of malware that runs quietly in the background on an infected computer. It does not lock files or demand a ransom. Instead, it copies every saved password, every active login session, and every stored credential from the device and sends that data to whoever deployed it. Then it disappears.
In Q1 2026, Constella processed 31.6 million of these stolen data packages, pulled from 2.77 million infected devices worldwide.
Why does this matter for your employees specifically? Two reasons. First, infostealers capture active session data, not just passwords. As a result, even accounts protected by two-factor authentication can fall to this attack. Changing the password afterward does not fix it. Second, employees who use personal devices for any work-related task, or whose family members share a home computer, have no corporate IT protection against this. In other words, it is a household risk, not just a workplace one.
The sectors hit hardest are ones your employees use every day
Finance and retail led Q1 breach counts. Government databases came in third. Healthcare was in the top ten.
These are not fringe platforms. They are banks, online stores, insurance portals, and benefits systems. The top five individual breaches of the quarter hit a data broker, a streaming service, a car marketplace, a retail chain, and a shipping company. Combined, those five incidents alone exposed 270 million records.
Every account your employees have ever created is a potential exposure point. Not because of anything they did, but because of how the companies holding their data chose to protect it.
What this means if you are evaluating identity protection as a benefit
The argument for offering identity protection as an employee benefit used to center on awareness and vigilance. Teach employees to spot phishing. Use strong passwords. Enable two-factor authentication. That advice is still worth giving. But the Q1 2026 data breach report makes clear it is not enough on its own.
Today, employers expose employees through breaches at companies those employees trusted years ago. The stolen data is complete enough to open new accounts, file fraudulent tax returns, and take over existing financial accounts. Additionally, the methods attackers now use, like infostealers, bypass the standard defenses most individuals have in place.
Monitoring, early alerting, and professional recovery support are not a luxury add-on. They are the difference between catching a problem in week one and finding out six months later when the damage is done.
If you are still on the fence about whether identity protection belongs in your benefits package, Q1 2026 answers the question plainly. The risk is real, it is growing, and it is landing on ordinary employees.
Learn more about how identity theft protection works as an employee benefit, or review our small business post-breach playbook for what to do if your company is affected. For a closer look at the attack methods behind these numbers, see our guides on phishing and third-party data breaches.
Source: Constella Intelligence, Q1 2026 Quarterly Breach Report. All statistics in this article come directly from that report. Full methodology available at constella.ai.
