Newsletter #11 — Every month, we pick out the insurance and brokerage news that matters. See you on the first Friday of every month.
Topic of the month: the extranet, the weak link nobody audits
Three French insurance organisations saw their data walk out the door within fifteen days in August. La Mutuelle Générale de Prévoyance on 10 August, with around 198,000 identities and 133,018 IBANs exposed. Evy at the start of the month, with 238 MB exfiltrated and 13,870 accounts affected. Solimut Mutuelle de France on 23 August, an intrusion reported to the ACPR and the CNIL (France’s insurance supervisor and data-protection authority), with the attacker claiming 1.24 million policyholders.
What links these three cases isn’t how sophisticated the attack was, it’s the way in. In MGP’s case, the breach came from a compromised technical provider that ran the extranet. And the extranet is exactly where the industry has concentrated, over the past ten years, everything it holds that is most sensitive: underwriting data, bank details, supporting documents, payroll filings. It’s also the part that gets audited least, because it’s often run by a third party and has never been seen as a core system.
The numbers confirm the shift. On 18 August, Beazley Security reported a 36% rise in newly disclosed vulnerabilities in the second quarter, and above all that compromised credentials account for 67% of the ransomware intrusions it investigated. Attackers no longer break in, they log in. On the cost side, Chubb’s cyber report published on 25 August shows claims becoming less frequent among European SMEs and mid-caps, but the average cost tripling between 2020 and 2025.
The question to ask isn’t a technical one: how many portals give access to your policyholder data today, and which one was updated most recently? For an insurer distributing through brokers, delegated underwriters and partners, the list is longer than expected, and the extranet built in-house five years ago isn’t the safest one: it’s simply the one nobody maintains anymore. That’s what attackers understood before the market did: you no longer attack a company, you attack its ecosystem.
And behind that question sits an architectural one. Every portal added alongside the management system is one more perimeter to secure, one more contract to monitor and one more chain of responsibility to untangle the day something goes down. When underwriting, policy administration and partner access all run on the same platform, there’s only one perimeter to audit and keep up to date. It’s never a guarantee against attack, but it’s one less surface to defend.
Sources: L’Assurance en Mouvement (24 August 2026), Reinsurance News (18 August 2026), Planète CSCA (25 August 2026)
3 insurance stories from August 2026
Summer wildfires: €500M, and claims payouts become a political issue
France Assureurs puts the cost of the megafires in Gironde, the Landes and the Var at nearly €500 million, for around 25,000 claims filed, against €80M and 2,000 claims in 2022. The cost has risen sixfold in four years.
But the new development isn’t the amount. On 18 August, visiting Gironde, Sébastien Lecornu announced he would make public the names of insurers who “don’t play fair” on compensation, without specifying any criteria, whether on timelines, refusal rates or loss-assessment standards.
🔎 Why it matters: the operational quality of claims settlement is becoming a reputational risk judged in the public square, and that expectation covers everything handled under delegated authority or on behalf of others.
Sources: L’Assurance en Mouvement (18 and 30 August 2026)
Munich Re buys At-Bay: “InsurSec” goes to scale
Munich Re is set to acquire US cyber insurtech At-Bay for an enterprise value of $575M. At-Bay writes $278M in gross premiums.
The interesting part isn’t just the deal size: Munich Re is betting on a model where the insurer no longer simply indemnifies the risk, but monitors and reduces it continuously.
🔎 Why it matters: the “insurance + prevention + technology” model could gradually become the standard for heavily data-driven risks.
Source: Insurance Business (19 August 2026)
APRIL launches its future P&C specialty hub
APRIL announces the acquisition of Alexis Assurances, a broker specialising in renewable energy and construction. Based near Lyon, it serves more than 1,000 clients, with expertise in professional and ten-year construction liability, contractors’ all risks and machinery breakdown for solar and wind.
The deal marks the launch of a future P&C specialty hub, designed to gradually bring together several technical areas of expertise.
🔎 Why it matters: the wholesale broker is becoming a platform that aggregates specialist niches, rather than a generalist offer built from scratch.
Source: Tripalio (2 September 2026)
Other news at a glance
- 💵 Funding: Skan AI raises $63M in a Series C, Faye $50M in a Series C and Axle $17.5M in a Series A. Three deals, the same thesis three times over: AI-driven automation of operations and claims.
- 🌍 International: Alan buys Senegal’s Tanel and opens its first base in Africa, in a West African health market estimated at €600M.
Events you might be interested in
- 🗓 Les Journées du Courtage, 15–16 September, 25th edition, at the Palais des Congrès in Paris. 👉 We’ll be there! The Korint team is on site both days to talk through your platform, underwriting or claims-management projects.