Penetration Testing in Indianapolis, IN

The Indianapolis and Indiana threat landscape

Indianapolis has already lived through one of the defining breaches in US healthcare. In early 2015, Anthem, the Indianapolis-headquartered insurer now operating as Elevance Health, disclosed that attackers had reached a data warehouse holding records on close to 79 million people after a spear-phishing campaign gave them credentials with database access. The lessons from that incident still frame how we test insurers and health systems here: the initial foothold came through people, the decisive step was privileged access that should never have reached a bulk data store, and the exfiltration ran for weeks before anyone noticed. Ransomware has since become the dominant pattern for the rest of the metro. In the autumn of 2022 the Indianapolis Housing Agency was hit by a ransomware attack that interrupted payments to landlords and exposed personal data of around 200,000 residents, and Indiana hospitals and physician groups have reported repeated extortion incidents involving patient data. Life-sciences companies face a different adversary: state-aligned and commercially motivated groups that want clinical-trial data, manufacturing process data and molecule designs, and that reach them through research partners, contract manufacturers and shared cloud tenants. The logistics corridor that earns Indiana its 'Crossroads of America' name adds warehouse-management systems, handheld scanners, yard and dock automation and supplier portals, most of which were designed for throughput rather than for an attacker on the network. On top of this sits a regulatory change: since 1 January 2026, the Indiana Consumer Data Protection Act requires controllers to maintain reasonable data security practices and to document data protection assessments for higher-risk processing. Engagements in Indianapolis routinely uncover flat networks between corporate and distribution-centre environments, service accounts with standing access to claims and member data, research collaborators who kept cloud access after a study closed, and operational technology on manufacturing lines reachable from the office domain.

Compliance frameworks we report against

Engagements for Indianapolis organisations regularly feed into Indiana, federal and customer-driven regulatory reporting. Deliverables include an executive summary, CVSS-scored findings with evidence, an attack narrative and prioritised remediation, formatted so that the privacy officer, the compliance lead and the external auditor can each use the same report against the framework below that applies to them. A verification retest of medium and higher findings within 90 days is included.

• Indiana Consumer Data Protection Act (IC 24-15), in force since 1 January 2026: reasonable data security practices, documented data protection assessments for higher-risk processing, enforcement by the Indiana Attorney General with a 30-day cure period
• Indiana data breach notification law (IC 24-4.9): notice to affected Indiana residents and the Attorney General without unreasonable delay and no later than 45 days after discovery
• Indiana insurance data security requirements based on the NAIC Insurance Data Security Model Law, overseen by the Indiana Department of Insurance
• HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation, enforced by the HHS Office for Civil Rights
• 21 CFR Part 11 electronic records and GxP change control for regulated research and manufacturing systems
• FDA section 524B of the Federal Food, Drug, and Cosmetic Act and the FDA premarket cybersecurity guidance for cyber devices
• GLBA Safeguards Rule (16 CFR Part 314) and SEC Regulation S-P (amended 2024) for insurers, advisers and financial institutions
• NIST SP 800-171 and CMMC 2.0 Level 2 under DFARS 252.204-7012 for the defence supply chain
• SEC cybersecurity disclosure rules (Form 8-K Item 1.05 and Regulation S-K Item 106) for listed companies
• SOC 2 Trust Services Criteria CC4.1 and CC7.1
• PCI DSS v4.0.1 Requirement 11.4 penetration testing where payments are in scope
• NIST SP 800-115 technical security testing

Why Indianapolis organisations choose HackersHub

Indianapolis runs on Eastern time, which makes the working day easy to share with Amsterdam: our afternoon overlaps your morning, and scoping and readout calls land inside your business hours. That is the only thing local about us, and we say so plainly. HackersHub, founded in the Netherlands in 2015 and now past 2,500 completed engagements, is run from its Amsterdam headquarters and has no Indiana office, address or staff. Pharma portals, insurer APIs, cloud tenants and identity platforms are tested from the Netherlands. When a scope needs hands in the building, whether a data centre in Fishers, a distribution site near the airport or a hospital campus downtown, our testers fly into Indianapolis International for the agreed window, and vetted US delivery partners can add capacity. Every tester is OSCP-certified at minimum, OSWE and CREST holders take the application and advanced work, and Michael van Mameren (OSCP) leads the engagement. Reports follow PTES, OWASP WSTG and MASTG and NIST SP 800-115 and are built for the reviewers Indiana organisations actually face: FDA inspectors, HHS investigators, CMMC assessors, SOC 2 auditors and, since January 2026, the Attorney General under the new privacy act. US clients are already served from the Netherlands, a full US market entry follows in Q1 2027, and before then 20 qualifying US companies can have a penetration test carried out free of charge. Across 127 reviews, clients rate the work 4.9 out of 5.