By targeting the insurers themselves (their cyber isn't magically better....), and getting a customer list.