Life Insurance News Roundup: Early October 2026 — The DNA and Data Reckoning

The early days of October 2026 turned an uncomfortable spotlight on the two things a life insurance company knows about you that almost nobody else does: what is written in your DNA, and what sits in its own databases. In the span of five days, California passed the strongest genetic-privacy law in the country, Connecticut put new limits on direct-to-consumer DNA testing, South Korea’s president ordered a nationwide probe into a wave of financial-sector data breaches, a New Zealand insurer found itself named on a ransomware leak site, and a life-insurance-adjacent AI startup raised another $34.5 million to automate the paperwork underneath it all.

Read together, these are not five unrelated headlines. They are one story: the personal information that determines whether you get covered — and at what price — is now the industry’s most contested asset. This roundup walks through each development, explains what it actually changes, and tells you what to do about it as a policyholder or a shopper.

Why Your DNA Became the Life Insurance Story of Early October 2026

Life insurance underwriting has always run on information. For a century that meant a paramedical exam, a blood draw, and a stack of medical records. Over the past decade it has increasingly meant data — prescription histories, driving records, and, at the edges, genetic information. Federal law has never fully closed the genetic gap for life insurance. The Genetic Information Nondiscrimination Act of 2008 (GINA) bars the use of genetic information in health insurance and employment, but it explicitly exempts life, disability, and long-term-care insurance. That exemption is exactly what the state-level push in early October aimed to fix.

At the same time, insurers hold enormous pools of sensitive customer data — and the industry is under sustained cyberattack. The same week that California acted on genetics, South Korean regulators were convening emergency meetings over breaches at some of the country’s largest banks. The two threads — protecting what you volunteer (genetic tests) and protecting what you surrender (account data) — converged into a single theme this week: data stewardship is now a consumer-protection issue in life insurance.

1. California’s AB 1798: The Nation’s Strongest Genetic-Privacy Law

On September 30, 2026 — National Previvor Day — Governor Gavin Newsom signed AB 1798, the Safeguarding Genetic Information Act, into law. The measure prohibits life, long-term-care, and non-health disability insurers from using an asymptomatic person’s genetic test results to cancel, limit, or deny coverage, or to set differential premiums. Its protections take effect January 1, 2027.

The bill’s path matters as much as its text. An August 21 amendment removed the $1.5 million face-value threshold that had previously allowed insurers to consider genetic information on high-value policies. The law now applies to all life and disability policies regardless of size. It also extended the restrictions beyond traditional insurers to licensees, surplus-line insurers, reinsurers, and third-party service providers — closing the outsourcing loophole through which an insurer could otherwise have a vendor do what it could not do itself. A separate provision bars the use or disclosure of an individual’s full genome.

The law was driven by the ALS Association, Assemblymember Lori Wilson, and California Insurance Commissioner Ricardo Lara, over what advocates described as fierce opposition from the life insurance industry. “No one should have to choose between their physical health and their financial future,” Wilson said. “People should not be penalized for what’s written in their DNA.”

What the law does not do is just as important. Insurers may still access your medical record as part of an application and may still consider a clinical diagnosis — a manifest disease or disorder — even if that diagnosis was informed by a genetic test. In other words, California has protected the predisposition while preserving underwriting on the diagnosis. For a family weighing whether to pursue testing for a hereditary cancer syndrome, that distinction is the whole ballgame.

2. The State-Level Wave: Connecticut, Illinois, and the Genetics Patchwork

California is not acting alone. On October 1, 2026, Connecticut’s Public Act 26-64 took effect, limiting what direct-to-consumer genetic-testing companies — the 23andMe and AncestryDNA tier — may do with the results they collect. Under the law, those firms may not disclose genetic testing results to employers, to certain insurers for underwriting purposes, or to third parties they know intend to use the data for advertising or marketing. The statute goes further than a mere disclosure ban: it gives consumers a property right and exclusive control over their biological sample and the results derived from it, with rights to access, delete, destroy, and withdraw consent.

Connecticut’s package also touches facial recognition, surveillance pricing, and a data-broker registry — signals that the state is treating genetic data as one front in a broader privacy war rather than an isolated insurance issue. Illinois has moved in parallel: amendments introduced to its Genetic Information Privacy Act (SB 2799 and HB 4897) would strip the long-term-care exemption and bar life, disability, long-term-care, and health insurers from soliciting or using genetic information at all, with an effective date targeted for January 1, 2027.

The table below shows how the new state rules stack up against the federal baseline.

Jurisdiction	Law	Effective	Core protection
California	AB 1798 — Safeguarding Genetic Information Act	Jan 1, 2027	Bans life, LTC & disability insurers from using asymptomatic genetic results in underwriting; drops the $1.5M face-value exception; extends to reinsurers and third-party vendors; bars use of the full genome
Connecticut	Public Act 26-64	Oct 1, 2026	Bars direct-to-consumer DNA firms from sharing results with employers or insurers for underwriting; grants consumers a property right over samples and results
Illinois	SB 2799 / HB 4897 (introduced)	Jan 1, 2027 (proposed)	Would remove the long-term-care exemption and bar life, disability, LTC and health insurers from using or soliciting genetic information
Federal	GINA (Genetic Information Nondiscrimination Act)	2009	Protects health insurance and employment — but not life, disability, or long-term-care insurance

The pattern is unmistakable: where Washington has left a hole for life insurance, the states are filling it one legislature at a time. That creates a compliance patchwork — a policyholder in California will soon enjoy protections a policyholder in a state without such a law does not.

3. South Korea’s Data-Breach Crackdown: A Warning for Insurers Everywhere

Half a world away, the same week produced a stark reminder of what happens when the data an insurer holds is compromised. On October 4, 2026, South Korean President Lee Jae Myung ordered a thorough investigation and response after a wave of personal-data leaks at banks, finance companies, and public agencies. Financial Services Commission (FSC) Chairman Lee Eog-weon convened an emergency meeting that had been moved forward from October 7 after additional breaches surfaced at second-tier financial institutions.

The disclosures escalated quickly. Shinhan Bank reported a breach on September 30; by the weekend, KB Kookmin, Hana, and Woori banks had also been implicated. Regulators said the attacks appeared to be broad vulnerability scans rather than strikes on a single institution, with attack traffic traced to IP addresses in the United States, Japan, Singapore, Vietnam, and Britain. The FSC said it could not rule out the use of artificial intelligence in the attacks and called for an “AI attacks defended by AI” posture. South Korea’s revised Personal Information Protection Act now allows fines of up to 10% of annual revenue for negligent large-scale leaks.

For insurance policyholders, the lesson is direct: the same institutions that underwrite your risk are themselves a target. A breach does not just expose a name and an account number — it can expose the medical and financial details that carriers use to price coverage, precisely the information the genetic-privacy laws are trying to wall off.

4. Tower Insurance and the Ransomware Claim That Tests New Zealand’s Rules

The breach theme extended to the life and general insurance sector itself. On October 2, 2026, Tower Insurance — a dual-listed NZX/ASX insurer — confirmed it was investigating after a ransomware group listed it on a cyber-extortion leak site. Tower said the information was “unverified” and that it was working with external cybersecurity consultants and had notified authorities, promising to contact affected customers if any are identified.

Tower’s dilemma exposes a gap in New Zealand’s regime. Under the Privacy Act 2020, an organisation must notify the Privacy Commissioner and affected individuals once a breach has caused or is likely to cause serious harm — but the maximum fine for failing to notify is just NZ$10,000, a figure Consumer NZ has called “embarrassingly low.” Australia, by comparison, can levy up to AU$50 million for serious privacy breaches. As a dual-listed company, Tower is also bound by continuous-disclosure obligations that could force an exchange announcement if a confirmed breach would materially affect its securities.

5. Outmarket’s $34.5 Million Round: The AI Behind the Paperwork

If the first four stories are about protecting data, the fifth is about what the industry is doing with it. Outmarket AI announced a $34.5 million Series B led by SignalFire, with Fika Ventures, Permanent Capital Ventures, TTV Capital, and Dash Fund participating — just four months after a $17 million Series A, and at a reported valuation of roughly $335–355 million. The company says it has more than 10,000 active users and serves over 300 agency customers.

Outmarket is not a carrier. It builds an “intelligence layer” that connects to agency management systems and automates commercial, employee-benefits, personal-lines, and specialty workflows — the rekeying, quoting, and servicing work that consumes agents’ hours. CEO and co-founder Vishal Sankhla, who previously led product at the digital life distributor Ethos, framed the thesis plainly: “Agencies don’t want another point solution. They want an intelligence layer that understands their data and does the work.”

The funding round is a useful counterweight to the privacy headlines. The same technology that makes insurers and agencies more efficient also concentrates sensitive customer data in more places — which is exactly why the regulatory pressure of the same week matters. Efficiency and stewardship are now two sides of the same coin.

What This Means for Your Policy

Strip away the jurisdictions and the jargon, and the early-October developments send three practical signals to anyone who owns or is shopping for life insurance.

• Your test results are becoming less usable against you — but only in some states. If you live in California (from 2027), Connecticut, or a state that follows, a predisposition revealed by a genetic test cannot be used to deny or price your life coverage. If you live elsewhere, the federal GINA exemption still leaves the door open for life insurers.
• Your data is a target, and the rules are catching up. The South Korean and Tower Insurance episodes show that the breach risk is real and cross-border. Regulators are responding with steeper penalties — up to 10% of revenue in South Korea’s case.
• Automation is reshaping how your application is handled. AI tools like Outmarket’s are moving into quoting and servicing. That means faster decisions — and more places where your data lives, which raises the stakes on how it is protected.

Five Steps to Protect Your Health Data and Your Coverage

1. Think before you test — or know your state’s rules first. If you are considering a predictive genetic test and you do not live in a state with a life-insurance genetic ban, confirm how a result could be used before you apply for coverage.
2. Apply for coverage before, not after, a test. Where a state protects predispositions but not diagnoses, the sequencing of an application and a test can matter enormously. Consider locking in coverage first.
3. Ask your agent in writing what data the carrier will pull. Prescription history, driving records, and third-party databases are routinely used. You are entitled to know the sources.
4. Lock down the accounts tied to your policies. Use unique passwords and multi-factor authentication on any insurer or agency portal that holds your personal information.
5. Know the breach playbook. If your insurer reports a breach, request written notice, ask what data was exposed, and take the free credit monitoring — then watch for identity fraud tied to your medical and financial records.

Key Takeaways

• California’s AB 1798 bans life, LTC, and disability insurers from using asymptomatic genetic results in underwriting, effective January 1, 2027.
• The law removed the old $1.5 million face-value exception and covers reinsurers and third-party vendors, not just carriers.
• Connecticut’s Public Act 26-64 (Oct 1, 2026) limits how direct-to-consumer DNA companies share results with employers and insurers.
• South Korea’s FSC moved an emergency meeting forward to October 4 after breaches at multiple major banks, and can now fine up to 10% of revenue.
• Tower Insurance was named on a ransomware leak site, exposing New Zealand’s NZ$10,000 cap on failure-to-notify penalties.
• Outmarket AI raised $34.5 million to automate agency workflows — the same data that privacy regulators are racing to protect.

Timeline: The Early-October DNA-and-Data Developments

Date (2026)	Development	Jurisdiction
Sept 30	Governor Newsom signs AB 1798, the Safeguarding Genetic Information Act	California
Sept 30	Shinhan Bank reports a data breach to regulators	South Korea
Oct 1	Public Act 26-64 takes effect, limiting DNA-data sharing	Connecticut
Oct 2	Tower Insurance named on a ransomware leak site; investigation begins	New Zealand
Oct 4	President Lee orders a probe; FSC holds an emergency meeting	South Korea
Oct 2026	Outmarket AI announces a $34.5 million Series B	United States

Frequently Asked Questions

Can a life insurance company use my genetic test results?

Under federal law, yes in many cases — GINA exempts life insurance. But state law is changing fast. California’s AB 1798 will bar life, long-term-care, and disability insurers from using an asymptomatic person’s genetic results in underwriting starting January 1, 2027, and other states are considering similar rules. Insurers may still consider a clinical diagnosis that appears in your medical record.

Does a 23andMe or AncestryDNA test affect my life insurance?

Direct-to-consumer tests are not the same as clinical genetic testing ordered by a physician, and most carriers do not ask for them. Still, a positive result you disclose or that surfaces elsewhere could be relevant. Connecticut’s Public Act 26-64 now limits how direct-to-consumer DNA companies may share your results with insurers for underwriting, and gives you a property right over your sample and results.

When do the new genetic-privacy laws take effect?

California’s AB 1798 takes effect January 1, 2027. Connecticut’s Public Act 26-64 took effect October 1, 2026. Illinois’ proposed amendments (SB 2799 and HB 4897) target January 1, 2027. Because the rules differ by state, always confirm the law that applies where you live and where the policy is issued.

Does GINA protect me from life insurance discrimination?

No. GINA (2008) protects health insurance and employment but explicitly exempts life, disability, and long-term-care insurance. That gap is precisely why states like California, Connecticut, and Illinois have acted on their own.

What happens to my policy if my insurer suffers a data breach?

Your coverage itself does not change — a breach does not void your policy. But the personal and medical data behind your application may be exposed. If your insurer reports a breach, ask for written notice describing exactly what was compromised, accept any offered credit monitoring, and monitor your accounts for identity fraud.

Can an insurer raise my rates because of a predisposition?

In states with genetic-privacy protections, an asymptomatic predisposition cannot be used to raise your premium. In states without them, the federal GINA exemption means a life insurer may be able to. A diagnosed condition, however, is generally fair game for underwriting everywhere.

Will the industry fight these laws?

The life insurance industry opposed California’s AB 1798, arguing it limits the data available to price risk accurately. Trade groups have historically preferred a uniform federal standard over a state-by-state patchwork. Expect continued lobbying as more states take up genetic-privacy bills in 2027.

Related Resources

• NAIC Consumer Resources — state insurance regulator guidance on policyholder rights and complaints
• California Department of Insurance — AB 1798 and California consumer protections
• NIH National Human Genome Research Institute — genetic discrimination law and GINA explained
• AM Best Ratings Search — check the financial strength of any carrier before you buy
• FTC Privacy and Security Guidance — how your data should be handled by companies that hold it

Get Your Free Life Insurance Quote

Whether you are locking in coverage before a genetic test or reviewing the protection you already own, comparing quotes across multiple highly rated carriers is the fastest way to see real numbers. Get your free life insurance quote today and see how your health profile — and your state’s rules — affect what you pay. The best time to protect your family was yesterday; the second-best time is now.

Watch: Life Insurance Explained

Continue reading our related coverage: Carrier Accountability and Genetic-Testing Protections, how life insurance underwriting works, the application process step by step, no-medical-exam policies, and our life insurance fraud protection guide.