Ransomware to blame for nearly half the cyber-insurance claims filed in early 2020

Nearly half of the cyber-insurance claims filed in the first half of this year were the result of ransomware attacks, further proof that digital extortion attempts are having a ripple effect throughout the private sector.

Ransomware attacks were the cause of 41% of the cyber-insurance claims filed over the first six months of 2020, according to a report published by Coalition, a cyber-insurance vendor that compiled the data based on findings from 25,000 small and medium-sized companies in the U.S. and Canada. Coalition reported a 47% increase in the number of ransomware attacks, with the average size of the demand jumping by 46% over the time period in question.

While cyber-insurance vendors have financial interest in emphasizing the frequency and severity of ransomware attacks, the latest figures come after a series of similar numbers hinted at the size of the ransomware problem. Beazley Breach Response, a unit of the London-based insurer, said in March that its clients reported 775 attacks in 2019, a 131% increase from the year before.

The FBI, meanwhile, regularly holds meetings with insurance industry executives, in an attempt to obtain a better grasp on the type of ransomware attacks that are hitting American companies. If ransomware victims are reluctant to report such incidents to law enforcement, the logic goes, they might be more forthcoming with an insurer that could cover the costs and financial fallout from such a breach. (Insurance companies frequently refuse to pay cybersecurity-related claims, depending on the policy and exact circumstances, unless compelled by a court.)

The emerging ransomware strains Maze and DoppelPaymer are particularly popular among scammers, the Coalition report said. Both kinds of malware are more complex than traditional forms of ransomware, the researchers said, and thus are harder to decrypt, allowing the ransomware gangs behind the hacks to demand higher ransoms.

Maze ransomware attackers, in particular, have differentiated themselves by breaching a number of major companies, then threatening to leak the affected files unless a victim agreed to meet their demands. The FBI has warned companies to beware of Maze ransomware, while attackers reportedly have struck victims including photography company Canon and the city of Pensacola, Fla.

The FBI’s Internet Crime Complaint Center received 2,047 ransomware complaints from U.S. victims in 2019, resulting in adjusted losses of roughly $8.9 million. Those most recent figures represent a significant uptick from the 1,493 victims who told the FBI about $3.6 million in losses in 2018.