{"id":237976,"date":"2025-05-12T12:08:49","date_gmt":"2025-05-12T12:08:49","guid":{"rendered":"https:\/\/peraltafinancing.com\/business\/insurance\/data-exfiltration-is-the-new-ransomware-in-evolving-cyber-landscape\/"},"modified":"2025-05-12T12:08:49","modified_gmt":"2025-05-12T12:08:49","slug":"data-exfiltration-is-the-new-ransomware-in-evolving-cyber-landscape","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=237976","title":{"rendered":"Data Exfiltration is the New Ransomware in Evolving Cyber Landscape"},"content":{"rendered":"


\n<\/p>\n

\n

It\u2019s 6:15pm on a Friday night as an SMB insured reaches out to the Converge hotline reporting that its servers are encrypted and its network is down. Only there\u2019s no panic in the caller\u2019s voice. They are confident in their third party cloud hosted backups. They are all ready to spin up a new clean virtual network and restore their systems; they just require some assistance from a digital forensics and restoration provider.<\/p>\n

They are hoping to be fully (business) operational by Monday, with only some minor residual effects that could last another week or two. No need or interest in paying the threat actor\u2019s ransom.<\/p>\n

But wait. Within days they\u2019ll discover that the threat actor exfiltrated hundreds of gigabytes of data from their network, and that is where the point of this article begins.<\/p>\n

Ransomware Landscape<\/strong><\/p>\n

The ransomware landscape has changed significantly over the past few years\u2014not just in how attacks occur, but in what drives claims severity and frequency. What was once primarily a business interruption event\u2014where attackers encrypted files and demanded a ransom for the decryption key\u2014has evolved into something much more complex, and in many cases, more damaging.<\/p>\n

\"\"<\/a>
John Spiehs<\/figcaption><\/figure>\n
\"\"<\/a>
Andrew Shaughnessy<\/figcaption><\/figure>\n

Early ransomware attacks often relied on untargeted phishing campaigns or open Remote Desktop Protocol (RDP) ports. If attackers were successful, they\u2019d encrypt critical systems, and many organizations\u2014lacking mature backup strategies\u2014would pay to recover. These incidents were often disruptive, but the ransom demands were relatively modest, and the data impact was minimal.<\/p>\n

Over the past several years, threat actors have moved to more targeted approaches. As organizations have strengthened their business continuity planning and moved to cloud infrastructure, they\u2019ve become better at managing the operational impacts of ransomware. This has driven attackers to make data theft a central feature of their attacks, and in some cases, it\u2019s the only tactic used.<\/p>\n

Attackers are gaining deeper access, moving laterally within networks, and exfiltrating massive volumes of data\u2014sometimes hundreds of gigabytes or even terabytes. Business interruption losses\u2014while still common\u2014are often more contained. Ransom payment rates have steadily dropped\u2014from 85% of victims paying in early 2019 to just 25% at the end of 2024, according to Coveware\u2019s recent quarterly report<\/a>.<\/p>\n

However, claims costs have not decreased. In fact, they\u2019ve risen.<\/p>\n

What\u2019s changed is the nature of the losses:<\/p>\n