1

What do ransomware losses look like now and how is cyber insurance responding?

Key claims data insight

Read more about what this means for your business

What this means for your business

Ransomware is the highest-severity risk in our dataset and one of the most expensive categories of all cyber events. It’s also impacting organizations large and small.

Organizational disruption from ransomware is often greater than expected, which can lead to underinsurance. If your business relies on time-sensitive systems, ransomware is the threat most likely to generate significant losses as a result of downtime, lost productivity, interrupted customer services and the cost of rebuilding systems. Every hour you can cut from ransomware discovery and recovery timelines can reduce total costs.

If attackers hit you directly, it’s usually more costly than if they hit your vendors. However, direct attacks tend to be discovered faster than vendor-originating events. This means third-party vendor incidents can add days to the total duration of incidents, making recovery more complicated and expensive than it may have otherwise been.

“Every hour you can cut from ransomware discovery and recovery timelines can reduce total costs."

Priority steps to better prepare, respond and recover from ransomware attacks

1

Develop and test ransomware-specific response plans that incorporate your cyber insurance

Ransomware incidents move fast and demand your business can make critical decisions under pressure. Having a response plan specifically tailored to ransomware will maximize your chances of a shorter, smoother recovery. Your plan should incorporate the specifics of your cyber insurance, including the approved incident-response suppliers you should use and how and when you must report the incident to your insurer. Integrating your cyber insurance into response plans helps minimize problems when you come to claim. A live ransomware event shouldn’t be the first time you test your plan. Test your plans regularly to engage all the right stakeholders, clarifying their roles and decision-making responsibilities.

2

Identify and quantify the specific ransomware scenarios facing your organization

Paying a ransom is only one element of ransomware costs. You will face other immediate response costs and longer-term financial impacts, including damage to your reputation and revenue, particularly if attackers have extracted data. The scope of your cyber coverage, your policy limits and retentions and the foundations of your incident response and claims processes need to match these exposures. To get this right and ensure your insurance aligns, you should discuss in advance whether the business would be prepared to pay a ransom and, if so, how it would pay.

3

Do you know how a 25-day ransomware incident would impact your organization? Identifying and quantifying key ransomware scenarios helps you understand where the business is most vulnerable and your true financial exposures. This way you can prioritize your response actions and confirm you have the right cyber insurance limits.

Align your insurance coverage to how ransomware losses are actually happening

Industry spotlight: Manufacturing

Manufacturing is among the industries persistently reporting cyber incidents more than others.

The sector accounts for around 13% of all cyber notifications in our dataset, with ransomware as the top driver of the most costly and damaging events for the industry.

Case study: Ransomware attack on critical systems

Attackers accessed a global manufacturing company’s network and encrypted critical systems across multiple production sites. While the business identified the breach quickly and disconnected plants within two hours, operations were disrupted for several weeks while systems were restored.

Costs exceeded $80 million, with the business interruption costs alone hitting the maximum amount the manufacturer’s cyber insurance policy could pay out.

The business has since strengthened its cyber security controls and runs regular recovery exercises to better protect against and recover from ongoing cyber threats.