The moment every boardroom dreads

There is a moment in almost every ransomware negotiation — usually around 36 hours, when legal, IT and the CFO are all in the same room — when someone says it out loud: “Let’s just see what the insurance covers.” That instinct, understandable as it is, has become one of the most expensive assumptions in modern business. The threat landscape has moved on.

The insurance market is moving on with it. And the organizations still treating cyber insurance as their primary recovery strategy are flying into a storm with a beach umbrella.

How ransomware became a business

Criminal groups don’t think in generations — they follow the money. Early campaigns were blunt instruments: Mass phishing, opportunistic encryption and hope that enough victims panic-pay. Groups like REvil and Conti figured out that one well-researched enterprise target was worth more than ten thousand spray-and-pray attempts. Ransom demands climbed from hundreds of dollars to tens of millions.

What you’re dealing with now is categorically different from both predecessors. Ransomware 3.0 isn’t primarily about encryption. That’s just the opening move. The real play is owning your leverage — over your operations, your data, your customers and your regulators — simultaneously.

Verizon’s 2024 Data Breach Investigations Report documented ransomware or extortion as a factor in 32% of all breaches, with organized criminal groups accounting for most incidents.

Triple extortion: The mechanics of maximum pressure

Most organisations mentally prepare for one thing when they hear “ransomware” — locked systems, a ransom note, a recovery decision. That framing is now dangerously out of date.

What groups like ALPHV (BlackCat) and Cl0p deploy is a three-layer pressure campaign. Encryption hits first — operations locked, revenue stopped. Then comes exfiltration: Your data was already removed before the encryptor ran, and that threat doesn’t expire when you restore from backup. The third layer is the one most organisations are least prepared for — direct contact with your customers, regulators and shareholders, timed to maximise pressure at the worst possible moment.

They don’t just threaten to follow through. They follow through.

The economic logic here is sound, from the attacker’s perspective. A good backup strategy can defeat encryption alone. Exfiltration cannot. Once your customer records, intellectual property or board communications are in the hands of a criminal group, no backup restores that situation. You are no longer dealing with a technology problem.

Coveware’s ransomware analysis for Q4 2024 consistently shows that data exfiltration now occurs in most enterprise ransomware cases, fundamentally altering the negotiation and recovery calculus.

Ashish Mishra

What the Change Healthcare case tells you about real costs

Consider what happened to Change Healthcare in early 2024. The ALPHV group’s attack on this healthcare payments processor didn’t just encrypt systems — it exposed the personal health information of potentially over 100 million Americans and disrupted pharmacy services across the country for weeks. Parent company UnitedHealth Group reportedly paid approximately $22 million in ransom. The total financial impact, including operational disruption, remediation and ongoing legal exposure, came to approximately $3.09 billion for 2024 alone. Insurance covered a fraction of it.

HHS Office for Civil Rights confirmed it formally opened an investigation into Change Healthcare and UnitedHealth Group, focused on whether protected health information was breached and whether HIPAA Rules were complied with — citing the attack’s unprecedented impact on patient care and privacy.

The numbers from Change Healthcare are worth sitting with, because they reframe the entire insurance conversation in a single case study. In February 2024, the ALPHV group walked into this healthcare payments processor through an unprotected Citrix portal and spent weeks moving through the network before anyone noticed. By the time the encryptor ran, the damage was already done — over 100 million Americans had their personal health information exposed, pharmacy services across the country ground to a halt, and UnitedHealth Group found itself paying approximately $22 million in ransom to a group that took the money and disappeared without delivering the promised decryptor.

The total bill for 2024 came to approximately $3.09 billion. That figure covers operational disruption, remediation, provider support and ongoing legal exposure. The insurance programme covered a fraction of it — and that fraction came after a fight, not automatically.

HHS Office for Civil Rights didn’t wait for the dust to settle. They opened a formal investigation into whether UnitedHealth Group had complied with HIPAA Rules and whether patient privacy protections had held up, framing it publicly as the largest breach of healthcare data in American history. That regulatory pressure didn’t arrive weeks later. It arrived while the organisation was still in active recovery.

Why your insurance policy is not the safety net you think it is

That example points directly to the insurance problem. Cyber insurance was priced and structured for a different threat model. Carriers increasingly include sub-limits for ransomware events, exclusions for nation-state attribution (a category that is deliberately difficult to disprove when it suits an insurer), and requirements around security controls that many policyholders have never actually verified they meet. After a major incident, you may discover that your $10 million policy has a $2 million ransomware sublimit — and that a coverage dispute will run in parallel with your breach response for the next 18 months.

This isn’t theoretical. Merck’s legal battle with insurers after the 2017 NotPetya attack — which attackers attributed to Russian state actors — dragged through the courts for years before a settlement. Merck settled with remaining insurers in January 2024 — just days before New Jersey Supreme Court oral arguments — after the appellate court ruled that the hostile/warlike action exclusion did not apply to the NotPetya cyberattack on a non-combatant firm.

On another side, Lloyd’s of London subsequently mandated that all standalone cyber policies must exclude losses arising from state-backed cyber operations, effective March 2023. The market is not moving in favour of policyholders.

Lloyd’s of London’s Market Bulletin Y5381, published in August 2022, required all standalone cyber policies to exclude losses arising from state-backed cyber operations, effective from 31 March 2023 — in direct response to coverage disputes arising from state-attributed attacks.

None of this means you shouldn’t carry cyber insurance. You should. But the mental model must change. Insurance is a financial transfer mechanism for residual risk — the risk that remains after you’ve built meaningful defences.

What a mature incident response architecture looks like

What contains a triple extortion event is a mature incident response architecture. That means several things working in concert: Network segmentation that limits an attacker’s lateral movement after initial access; endpoint detection and response tooling that can identify suspicious behaviour before encryption begins; an offline or immutable backup strategy that survives even a sophisticated attacker who has spent weeks inside your environment; and a rehearsed response capability that doesn’t require you to learn the playbook during the incident itself.

The “rehearsed” part is where most organisations fall short. Tabletop exercises are valuable, but they rarely simulate the full chaos of a real event — the communication blackouts, the pressure from the CEO’s office, the media calls starting before you’ve even confirmed the scope.

MGM Resorts’ 2023 ransomware attack, attributed to Scattered Spider, demonstrated what happens when the human layer fails, even if the technology layer is adequate. Social engineering of the IT help desk gave attackers initial access. The subsequent disruption cost the company an estimated $100 million in lost revenue and remediation costs in a single month.

Guidance: NIST’s Cybersecurity Framework 2.0 provides the most widely adopted reference architecture for incident response capability maturity, covering identification, protection, detection, response and recovery functions.

The only bet that pays off in both scenarios

The uncomfortable truth your board needs to hear is this: The question is no longer whether your organisation will face a sophisticated threat actor. For any organisation of meaningful size, operating in a connected supply chain, with digital customer relationships, the question is how well-prepared you are when it happens. The economics of ransomware as a criminal enterprise have never been stronger. Attack-as-a-service platforms have lowered the barrier to entry. Ransom payment data is analysed and used to calibrate future demands. These groups study your financial filings.

Investing in incident response capability — in people, process and technology — is not a cost centre decision. It’s the only bet that pays off in both the prevention scenario and the response scenario. Insurance pays out after the damage is done. A mature response architecture reduces the damage itself.

The organisations that navigated the Cl0p MOVEit campaign of 2023 with the least disruption weren’t the ones with the biggest insurance policies. They were the ones who had mapped their data flows, limited unnecessary MOVEit exposure and had a response team that could move within hours rather than days.

That’s the standard you’re competing against now.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?