Ransomware

Ransomware is a type of malicious software that is covertly installed on a computer without the computer user’s knowledge. It blocks access to the now-infected computer system by locking the system’s screen or locking the user’s files until a ransom is paid.

Insurance coverage for cyber extortion depends on a company’s cyber coverage. In some cases, defense and indemnity costs for cyber extortion can be included in cyber insurance forms.

Background

Ransomware has been an existing threat to cybersecurity since the 1990s. PC Cyborg, the original ransomware, was spread by the mailing of infected floppy disks in 1991 by an AIDS researcher-biologist. “Archiveus,” active in the mid ‘00s, was ransomware that used encryption. In the early 2010s, fake electronically sent warnings made to look like they were from law enforcement demanded that “fines” be paid for the alleged “illicit activities” of the recipient, and exploited newly-developed anonymous payment services. Some in the industry believe that certain forms of ransomware originated in Russia between 2005 and 2006, then spread across Europe, with ransomware infections occurring essentially continuously across Europe and North America by 2012.

Modern ransomware takes many forms. When users unknowingly visit compromised websites, ransomware can be downloaded. Ransomware can also infiltrate technology in other ways: opening attachments from spam emails, downloading materials from malicious pages, or opening online advertisements infected with viruses (commonly known as ‘malvertisements’). Cloud space ransomware travels from the user’s computer to cloud-storage systems like Dropbox and compromises files stored in the cloud. Targeted ransomware is focused on high-profile targets that are likely to pay higher ransoms because they have more to lose.

Some of the biggest recent ransomware attacks include:

• Change Healthcare - (2024) A critical error by Change Healthcare failing to turn on its Multifactor Authorization System resulted in the largest healthcare cyberattack in U.S. history, with the ALPHV/BlackCat ransomware group gaining access to sensitive patient care and encrypting and affecting healthcare information of up to 192 million people nationwide.
• MGM - (2023) Hackers utilized a phishing technique to infiltrate MGM’s systems and damage guest information, resulting in $100 million in damages.
• Salt Typhoon - (2024) Salt Typhoon, a hacking group, targeted several major U.S. telecommunication providers such as Verizon and AT&T, gaining access to text and call metadata and comprising
• Marks and Spencer - (2025) Marks and Spencer, a British retailer, was the victim of a cyberattack that exposed sensitive customer information and payment details, affecting over 16.9 million customers and resulting in $27M in costs to the retailer.

It is virtually impossible to trace ransomware attacks back to the cybercriminal’s server. Ransom payments are usually made in online currencies like Bitcoin, which are also untraceable. In most cases, it is near impossible to break the encryption code, so most organizations prefer to pay the ransom rather than spend years attempting – perhaps without success – to retrieve their information. The size of ransom demands varies depending on the ransomware type and the price or exchange rates of the digital currencies used, but overall losses are high.

While ransomware detection and repair techniques are becoming more effective, ransomware developers are also making ransomware harder to find and encrypted files harder to recover. Newer ransomware is focused on making the spread of attacks less predictable.

Injuries and Damages

Ransomware functions like a kidnapping. Injuries can include violation of state and federal laws, property damage, business interruption, reputational damage, emotional distress and more. Ransomware can attack individuals as well as entities. For less sophisticated attacks, such as e-mail attachments that are viruses and ‘malvertisements,’ the targets are more likely to be individuals. The more complex attacks tend to be against healthcare companies and other entities that hold private information. By 2021, ransomware damages are expected to reach $8 billion, which is almost 60 times more than it cost in 2015. By 2025, ransomware damages are expected to reach $57 billion, which is almost 7 times more than it cost in 2021.

Legislation and Regulation

Ransomware attacks are subject to the same laws and regulations as data breaches.

As of January 2022, all fifty states, the District of Columbia and several U.S. protectorates have enacted legislation “requiring private, governmental or educational entities to notify individuals of security breaches of information involving personally identifiable information”.

MMost of these laws include provisions that outline which entities must comply with the law, how to define “personal information”, how a data breach is defined and the requirements for notice when a breach occurs. However, while no broad federal law currently exists to directly address data breach issues, several US laws exist that regulate data breach notification within specific industries. An example includes the HIPAA breach notification rule, which requires organizations that are covered by HIPAA to provide notification after a data breach of health-related information.

National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law

The NAIC Insurance Data Security Model Law was developed to respond to the increased levels of data breaches among several industries. Based on the model, insurers and companies that are licensed by the department of insurance are required to create and maintain “an information security program, investigate any cybersecurity events and notify the state insurance commissioner of such events.” THE NAIC and the federal government has urged all states to adopt the model law. Currently, 8 states (AL, CT, DE, MI, MS, NH, OH and SC) have adopted the model law.

Liability and Insurance

Experts point out that all companies are potential targets for ransomware. An attack can result in customer and investor lawsuits for disclosing confidential data, loss of proprietary information and business interruption. Some of the risk can be offset by insurance coverage. Commercial general liability insurance policies, fidelity insurance policies and cyber insurance policies may provide some protection. After a ransomware attack, cyber insurance could cover legal advice and computer analysts. Stand-alone ransomware insurance products are being marketed by some insurance companies who are likely to impose an intensive application process that examines company data practices, employee training programs and company investments in cybersecurity technology.

To receive the benefits of coverage, the insured must cooperate with the insurer, including, for example, by not disclosing to any entity that there is cyber extortion coverage, obtaining the consent of the insurer before making any extortion payment, using expert incident response services and coordinating with authorities.

Litigation

Although litigation against ransomware groups or individual hackers can be difficult due to the anonymous nature of the attack, new litigation has developed recently targeting both businesses who have been the subject of the attacks and individual hackers.

Emoi Servs., L.L.C. v. Owners Ins. Co. (2022)

Emoi Servs. L.L.C. was a software company who experienced a ransomware attack on September 12, 2019 after a hacker demanded a ransom of 3 bitcoins for a decryption key to access lost files. Emoi filed an insurance claim under their insurance policy with Owners Insurance Co., but the court concluded that the attack didn’t result in “direct physical loss or damage to covered media, and therefore, the policy did not cover EMOI's losses.”.

Woodall v. Octapharma Plasma, Inc. (2024)

Octapharma, a company which operates more than 190 blood plasma donation centers, was the subject of a massive cyberattack that exposed sensitive personal information including Social Security numbers and financial data. They recently agreed to a $2.55M Settlement after being sued for various torts including negligence and a breach of their fiduciary duty for not having the appropriate monitoring and security systems to prevent such an attack.

National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Co. (2020)

National Ink sued their insurer, Casualty Insurance, after being the victim of a ransomware attack and attempting to receive coverage from their general insurance policy. The court held that damage to a computer data/software system was considered “direct physical loss or damage to property” because loss of some functionality should have still been covered.

Surfside Non-Surgical Orthopedics v. Allscripts Healthcare Solutions, Inc. (2018)

In 2018, Allscripts, a Florida company that sold e-prescribing services to medical providers, was sued for a ransomware attack that prevented 1,500 clients from accessing their client information. The plaintiffs (Surfside) in the class action complaint accused Allscripts of being “wanton, willful, and reckless” with respect to protection deficiencies. Plaintiffs also argued that SamSam, the ransomware that was employed against Allscripts, had been a well-known threat for about two years before the suit was filed, and that Allscripts did not adequately protect against such threats. The Court dismissed Surfside’s claim for lack of standing to sue.

Future Outlook

Unfortunately, experts predict that the worst is yet to come, stating that ransomware will move beyond the purely financial and turn personal, with attackers focusing on big-data leaks and utilizing new AI-orchestrated technology. Although companies are able to restore data through new technology, the publication of that data is at an all-time high. The FBI’s 2024 report stated that 3156 ransomware complaints were received that year (a 11.7% annual increase). Additionally, the surge in highly organized ransomware groups could result in a decentralization of ransomware attacks, making the potential consequences more serious and the insurance industry’s involvement in developing and marketing cyber security insurance products more crucial. In particular, the last few years saw a surge in Codefinger, a new ransomware scheme which made it nearly impossible to recover leaked information without the payment of some ransom. As the threats continue to evolve, the potential consequences become more serious and the insurance industry’s involvement in developing and marketing cyber security insurance products becomes ever more crucial.