Threat actors exploit cybersecurity gaps from M&A, software consolidation to maximize damage & profit, Resilience finds

Ransomware attacks surge in frequency and severity since 2023, buoyed by major attacks on Change Healthcare, CDK Global, and others

San Francisco, CA (July 1, 2024) – Threat actors evolved their tactics in 2024 to take advantage of business and technology consolidation, the leading cyber risk solution company Resilience found in its Midyear 2024 Cyber Risk Report. Increasing M&A and reliance on ubiquitous software vendors created new opportunities for threat actors to unleash widespread ransomware campaigns by exploiting a single point of failure. Some of the most disruptive cyberattacks over the past year involved heavily interconnected systems or recently acquired companies, to devastating effect—even putting entire economic sectors on hold.

The Midyear 2024 Cyber Risk Report, published today, leverages data from Resilience’s Threat Intelligence team and insurance claims portfolio to analyze trends in hacking activity and industry responses. Key findings include:

• Ransomware remained the leading cause of loss since January 2023, with 64% of ransomware-related claims resulting in a loss. The financial severity of claims related to ransomware attacks increased 411% from 2022 to 2023.
• Ransomware attacks on Change Healthcare and CDK Global, as well as the PanOS zero-day vulnerability, represented 2024’s top claim-driving events thus far.
• Of all claims received since January 2023, 35% were the result of a vendor data breach or ransom attack exploiting a third-party vendor—including notable vulnerabilities associated with Ivanti software—and in 2024 that number is already 40%, and expected to grow.
• The BlackCat hacking group—responsible for the Change Healthcare cyber incident—entered 2024 with an existing track record: in 2023, the group topped the list of most costly attacks, with BlackCat attacks accounting for 18% of covered losses from ransomware.
• Two sectors saw the largest increases in claims in 2024: manufacturing and construction. Manufacturing rose from 15.2% of all claims in 2023 to 41.7% of all claims in 2024; while construction rose from 6.1% of 2023 claims to 25.0% of 2024 claims.

Global M&A deal volume increased 36% in the first quarter of 2024. While this growth can be seen as a sign of positive economic development, it can also create a staggering number of potential new points of failure. Similarly, technology consolidation—in which industries rely on single suppliers for critical platform services—have proven to lead to catastrophic effects downstream if a single supplier is breached. In addition to potential ransom payments, impacted organizations typically face significant business interruption and lost revenue.

“Major attacks like the ones on Change Healthcare, CDK Global, and AT&T have been wreaking havoc and making headlines, but they also remind us that we’re facing a new status quo. Increased vendor interdependence and M&A activity have created an unprecedented opportunity for hackers, with far more points of failure and potential for human error,” said Vishaal “V8” Hariprasad, co-founder and CEO of Resilience. “Now more than ever, we need to rethink how the C-suite approaches cyber risk. Businesses are interconnected like never before, and their resilience now depends on that of their partners and others in the industry.”

Resilience’s unique combination of cyber insurance offerings, risk quantification, and cybersecurity expertise helps clients get ahead of emerging threats—and bounce back faster from cyber incidents that do occur. Over 90% of Resilience clients that directly experienced a ransomware attack in 2023-2024 avoided paying an extortion fee. In fact, even as incidents tied to Lockbit or Cl0p ransomware grew over the past year, Resilience clients were able to effectively mitigate and manage these destructive threats, and avoided paying any extortion fees tied to these hacking groups.

“While cybersecurity has historically been considered as a line item in a company’s budget, it’s clear that this is insufficient,” said Tom Egglestone, global head of claims at Resilience. “Business leaders must adopt a risk-centric approach—one in which security strategies are grounded in the financial translation of cyber threats. At Resilience, this approach has paid dividends. In 2023 and 2024, our clients minimized material losses, rarely paid extortions, and avoided business disruption—not only withstanding the effects of attacks, but coming out stronger on the other side.”

Read the full report  and register for our upcoming webinar.

About Resilience

Resilience helps organizations become cyber resilient to material losses by staying ahead of the bad guys. Founded by experts from across the highest tiers of the US military and intelligence communities – and built by prominent leaders and innovators from the cybersecurity, technology, and insurance industries – Resilience is the world’s first cyber risk company that offers risk quantification software, cybersecurity experts, and A+ insurance in integrated solutions purpose-built for large and middle-market organizations.

Resilience is proud to be backed by leading technology investment firms including General Catalyst, Lightspeed Venture Partners, Intact Ventures, Founders Fund, CRV, and Shield Capital. With headquarters in San Francisco, Resilience is globally dispersed, with teams in New York, Chicago, Los Angeles, Baltimore, Toronto, London, and Dublin. Resilience offers insurance coverage through its licensed and appointed insurance agency, and security services through its expert security team. The Resilience Solution is available through all broker partners to clients in the United States, United Kingdom, Canada, and Europe. For more information, visit www.cyberresilience.com. Your risk is our risk.

SOURCE: Resilience

Tags: cyber attacks, Cyber Insurance, cyber risk, cyber security, InsurTech, InsurTech Spotlight, Resilience InsurTech, United States (USA)