Guess what happens when ransomware fiends find 'insurance' 'policy' in your files
(2025/04/16)
- Reference: 1744784712
- News link: https://www.theregister.co.uk/2025/04/16/dutch_ransomware_study/
- Source link:
Ransomware operators jack up their ransom demands by a factor of 2.8x if they detect a victim has cyber-insurance, a study highlighted by the Netherlands government has confirmed.
For his [1]PhD thesis [PDF], defended in January, Dutch cop Tom Meurs looked at 453 ransomware attacks between 2019 and 2021. He found one of the first actions intruders take is to search for documents with the keywords "insurance" and "policy." If the crooks find evidence that the target has a relevant policy, the ransom more than doubles on average.
In double-extortion attacks, where intruders threaten to publish data stolen from the victim unless the ransom is paid, those with insurance on average are quoted 5.5x more than those who don't.
[2]
If a company has cyber-insurance, it's assumed the insurer will cover the ransom, especially if not paying will lead to much higher recovery and cleanup costs, damages, and subsequent claims. Thus, it's in the extortionists' interests to ramp up their demands, but not too much, as they see insurers as a surefire source of funding. Paying the ransom encourages the crime, however, hence officials in [3]America and [4]Britain pushing against the practice.
[5]
[6]
Meurs said, of the intrusions he looked into, those with insurance paid the criminals 44 percent of the time, compared to 24 percent of the uninsured. In addition, insured victims paid a lot more – an average of €708,105 ($800,000, £600,000), compared to €133,016 ($150,000, £110,000) for their uninsured brethren.
Phishing emails with links were the most common point of infection, accounting for a third of successful attacks, with spam accounting for eight percent. Malicious mobile apps are also an important vector, accounting for 13 percent of successful infections, and one in ten attacks was down to poorly patched applications or operating systems.
My research shows that the ICT sector in particular pays high amounts. Companies from this sector often supply the ICT for many other companies, which means that multiple companies are victims of a single attack.
By far, the retail and wholesale trades were most likely to get hit, accounting for nearly 33 percent of reported infections in the data set, with an average payout of €112,793 ($130,000, £100,000). The IT sector is less popular but much more profitable, accounting for 14.7 percent of attacks but with the highest average payout of the top ten trades covered at €268,039 ($300,000, £230,000) – which makes them a very attractive target for criminals.
"I often read in chat messages that cybercriminals send to each other, or on illegal marketplaces where login details are sold, that they are specifically looking for companies from sectors that pay a lot," [7]the Dutch cop said .
[8]
"My research shows that the ICT sector in particular pays high amounts. Companies from this sector often supply the ICT for many other companies, which means that multiple companies are victims of a single attack. This may be why the willingness to pay is higher."
Part of the problem of researching a topic like this is the reporting, he noted. Meurs said that only around 40 percent of ransomware attacks are actually reported to the police, although that's better than online fraud scams, where only between 11.5 and 14 percent make it onto law enforcement's radar.
But wait, there's good news
There is a pretty good solution, Meurs said, and that's to have a decent backup system.
According to the research, firms with a proper backup system were 27x less likely to pay criminals off, for the simple reason that they usually don't need to. Even then, surprisingly, some do.
"In roughly 5 out of 100 cases in which a payment is made, victims do have the option to recover in a way other than paying, but they still choose to pay - for example to recover faster or to prevent reputational damage," he [9]said .
[10]
"In the remaining 95 cases, there is no other option to recover. In those cases, their entire IT infrastructure is broken and can no longer be repaired, making paying the ransom the only option to avoid bankruptcy."
[11]Extortion crew threatened to inform Edward Snowden (?!) if victim didn't pay up
[12]Now 1.6M people had SSNs, life chapter and verse stolen from insurance IT biz
[13]Attackers swipe data of 500k+ people from Pennsylvania teachers union
[14]Names, bank info, and more spills from top sperm bank
He also noted that while companies might think that they have a good backup system in place, most don't. Meurs cited research claiming that 85 percent of backups fail to work properly, and such systems are actively targeted by the criminals the moment they get into a system. He recommends offsite backups.
"It is noteworthy that victims who lack backups generally pay lower ransoms than those who have backups that cannot be restored, with both the average ransom per attack and the cumulative amounts being lower," he argued.
"One plausible explanation could be that businesses holding data considered valuable enough for ransom payments are generally more likely to employ backup systems, compared to those with less valuable data."
Meurs opines that double-extortion ransomware is likely to become the dominant form of attack, by the very clear logic that it adds negligible risk to the criminal and increases the chances of a successful payout. And while Dutch payouts are trending down at the moment, that situation may change if new tactics emerge. ®
Get our [15]Tech Resources
[1] https://tmeurs.github.io/papers/PhD_Dissertation_Meurs_jan25.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2024/10/14/ransomware_insurance_ban/
[4] https://www.theregister.com/2024/05/14/uk_ncsc_partners_with_insurance/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.digitaltrustcenter.nl/veel-bedrijven-hebben-eigenlijk-geen-keuze-tussen-betalen-of-niet-betalen
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.digitaltrustcenter.nl/nieuws/ransomware-in-het-mkb-cybercriminelen-verhogen-losgeld-bij-cyberverzekering
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2025/03/18/extortionists_ox_thief_legal_threats/
[12] https://www.theregister.com/2025/04/15/landmark_admin_data_loss/
[13] https://www.theregister.com/2025/03/19/pennsylvania_nonprofit_cyberattack/
[14] https://www.theregister.com/2025/03/19/sperm_bank_data_leak/
[15] https://whitepapers.theregister.com/
For his [1]PhD thesis [PDF], defended in January, Dutch cop Tom Meurs looked at 453 ransomware attacks between 2019 and 2021. He found one of the first actions intruders take is to search for documents with the keywords "insurance" and "policy." If the crooks find evidence that the target has a relevant policy, the ransom more than doubles on average.
In double-extortion attacks, where intruders threaten to publish data stolen from the victim unless the ransom is paid, those with insurance on average are quoted 5.5x more than those who don't.
[2]
If a company has cyber-insurance, it's assumed the insurer will cover the ransom, especially if not paying will lead to much higher recovery and cleanup costs, damages, and subsequent claims. Thus, it's in the extortionists' interests to ramp up their demands, but not too much, as they see insurers as a surefire source of funding. Paying the ransom encourages the crime, however, hence officials in [3]America and [4]Britain pushing against the practice.
[5]
[6]
Meurs said, of the intrusions he looked into, those with insurance paid the criminals 44 percent of the time, compared to 24 percent of the uninsured. In addition, insured victims paid a lot more – an average of €708,105 ($800,000, £600,000), compared to €133,016 ($150,000, £110,000) for their uninsured brethren.
Phishing emails with links were the most common point of infection, accounting for a third of successful attacks, with spam accounting for eight percent. Malicious mobile apps are also an important vector, accounting for 13 percent of successful infections, and one in ten attacks was down to poorly patched applications or operating systems.
My research shows that the ICT sector in particular pays high amounts. Companies from this sector often supply the ICT for many other companies, which means that multiple companies are victims of a single attack.
By far, the retail and wholesale trades were most likely to get hit, accounting for nearly 33 percent of reported infections in the data set, with an average payout of €112,793 ($130,000, £100,000). The IT sector is less popular but much more profitable, accounting for 14.7 percent of attacks but with the highest average payout of the top ten trades covered at €268,039 ($300,000, £230,000) – which makes them a very attractive target for criminals.
"I often read in chat messages that cybercriminals send to each other, or on illegal marketplaces where login details are sold, that they are specifically looking for companies from sectors that pay a lot," [7]the Dutch cop said .
[8]
"My research shows that the ICT sector in particular pays high amounts. Companies from this sector often supply the ICT for many other companies, which means that multiple companies are victims of a single attack. This may be why the willingness to pay is higher."
Part of the problem of researching a topic like this is the reporting, he noted. Meurs said that only around 40 percent of ransomware attacks are actually reported to the police, although that's better than online fraud scams, where only between 11.5 and 14 percent make it onto law enforcement's radar.
But wait, there's good news
There is a pretty good solution, Meurs said, and that's to have a decent backup system.
According to the research, firms with a proper backup system were 27x less likely to pay criminals off, for the simple reason that they usually don't need to. Even then, surprisingly, some do.
"In roughly 5 out of 100 cases in which a payment is made, victims do have the option to recover in a way other than paying, but they still choose to pay - for example to recover faster or to prevent reputational damage," he [9]said .
[10]
"In the remaining 95 cases, there is no other option to recover. In those cases, their entire IT infrastructure is broken and can no longer be repaired, making paying the ransom the only option to avoid bankruptcy."
[11]Extortion crew threatened to inform Edward Snowden (?!) if victim didn't pay up
[12]Now 1.6M people had SSNs, life chapter and verse stolen from insurance IT biz
[13]Attackers swipe data of 500k+ people from Pennsylvania teachers union
[14]Names, bank info, and more spills from top sperm bank
He also noted that while companies might think that they have a good backup system in place, most don't. Meurs cited research claiming that 85 percent of backups fail to work properly, and such systems are actively targeted by the criminals the moment they get into a system. He recommends offsite backups.
"It is noteworthy that victims who lack backups generally pay lower ransoms than those who have backups that cannot be restored, with both the average ransom per attack and the cumulative amounts being lower," he argued.
"One plausible explanation could be that businesses holding data considered valuable enough for ransom payments are generally more likely to employ backup systems, compared to those with less valuable data."
Meurs opines that double-extortion ransomware is likely to become the dominant form of attack, by the very clear logic that it adds negligible risk to the criminal and increases the chances of a successful payout. And while Dutch payouts are trending down at the moment, that situation may change if new tactics emerge. ®
Get our [15]Tech Resources
[1] https://tmeurs.github.io/papers/PhD_Dissertation_Meurs_jan25.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2024/10/14/ransomware_insurance_ban/
[4] https://www.theregister.com/2024/05/14/uk_ncsc_partners_with_insurance/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.digitaltrustcenter.nl/veel-bedrijven-hebben-eigenlijk-geen-keuze-tussen-betalen-of-niet-betalen
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.digitaltrustcenter.nl/nieuws/ransomware-in-het-mkb-cybercriminelen-verhogen-losgeld-bij-cyberverzekering
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_9_yPzqMKv2VkZm9X1a_AAAAcY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2025/03/18/extortionists_ox_thief_legal_threats/
[12] https://www.theregister.com/2025/04/15/landmark_admin_data_loss/
[13] https://www.theregister.com/2025/03/19/pennsylvania_nonprofit_cyberattack/
[14] https://www.theregister.com/2025/03/19/sperm_bank_data_leak/
[15] https://whitepapers.theregister.com/
What people are willing to pay to avoid ...
Anonymous Coward
... doing backups.
It's the ultimate test to study the value of procrastinating.*
For the first time in history, economists can now put an exact value, and price, on procrastinating.
What is often forgotten is to test the backups regularly. I suspect that is something with an even higher procrastinating value.
* It hit me too, I have to admit.
Doctor Syntax
Add some text to the effect that the insurance policies are cover rewards for the delivery of the miscreants for trial or the bodies thereof.
I wonder..
Blazde
If you scatter a few stern banking letters detailing maxed out revolving credit agreements in your files, will that help lower the ransom demand?
Re: I wonder..
Brewster's Angle Grinder
Even if they were looking for it, that wouldn't affect the insurance payout.
Cyber security an afterthought
Business that have yet to take cybersecurity seriously (or just going through the motions) or do not have the culture (employees are a weak link) are also more vulnerable and may be targetted