In late February, Change Healthcare, one of the largest health payment processing companies in the world suffered a ransomware attack. Change Healthcare, a subsidiary of UnitedHealth Group, accounts for nearly 40% of all medical claims in the US.

The cyber attack not only crippled the US healthcare system, but also resulted in theft of 6TB of medical data and the payment of US$22 million in Bitcoin by UnitedHealth Group to a ransomware gang in an attempt to protect patient data.

Following the hack of Change Healthcare, ransomware attacks against healthcare organizations spiked, as reported by Wired on June 12.

In April, the healthcare sector experienced 44 attacks, the highest number recorded in a single month by cybersecurity firm Recorded Future in its four years of data collection.

After a significant drop in 2022, research from Chainalysis reveals that ransomware payments rebounded, surpassing the $1 billion mark in 2023, with median extortion amounts exceeding $1 million in more than 60% of ransom demands and associated fees.

The severity of ransomware attacks has increased as criminals have continued to pursue larger ransoms. This assertion is supported by the fact the financial severity of claims related to ransomware attacks in the Resilience portfolio surged by 411% from 2022 to 2023, as noted in the Resilience Mid-Year 2024 Cyber Risk Report.

The report from the cyber risk solution company, Resilience, leverages data from its threat research team and insurance claims portfolio to analyse trends in hacking activity and industry responses. Here are the key findings: 

Ransomware: The leading driver of loss, escalating recovery costs

As stated in the report, “The cause of loss refers to what kinds of attacks led to material losses in our client portfolio. It is distinct from the point of failure which describes what the bad actor exploited in order to cause the losses.”

Source: Resilience Midyear 2024 Cyber Risk Report

Since January 2023, ransomware has been the top cause of loss in Resilience’s portfolio, with 64% of ransomware-related claims culminating in a loss.

Despite comprising 48% of all claims in Resilience’s portfolio in 2023, ransomware was responsible for more than 80% of the losses incurred.

The report points out a critical aspect that ransomware is not only the leading driver of loss, but also increases organizational recovery expenses, regardless of the payment of extortion fees.

“When companies are hit with ransomware, the severity of the attack can depend on the tactics of the particular group. Losses from ransomware claims might reflect extortion fees, recovery costs, crisis management costs, and other losses stemming from a ransomware attack and may not reflect the full measure of losses to the client. Our claims data shows that several ransomware groups had significant impacts in 2023,” the Resilience report mentioned, emphasising a growing trend of escalating costs associated with ransomware recovery.

For several years, ransomware, business email compromise (BEC), and transfer fraud have been at the forefront of the cyber crime landscape.

As noted in the report, BEC may appear to have declined in prominence in 2023 and 2024, but that perception is largely due to the media’s focus on ransomware.

The report goes on to explain that BEC attacks have remained relatively stable, accounting for 13% to 15% of loss claims between 2022 and 2024. However, in 2023, a higher proportion of these claims became material, increasing by 11% compared to 2022.

Additionally, the report underscores a rising threat within the Resilience portfolio, highlighting that BEC attacks are not only increasing in frequency, but also in their financial impact. “In fact, BEC attacks are becoming three times more frequent and are more than doubling in severity among our portfolio.” 

Data collection problems stemmed mainly from “An issue with pixel trackers used to track website and visitor analytics sending data to third parties against data collection laws. This drove higher than usual losses in that category for clients, a departure from years past and likely not part of a lasting trend”, the Resilience report further added.

Human error: The weakest link in cybersecurity

Human error is at the heart of many of this year’s “most notable and destructive” cyber incidents. Given that cyber risk is intrinsically or fundamentally a human-engineered risk, this is not surprising, observes the report.  

“An unpleasant fact is humans are the most likely point of failure in cybersecurity. It is time to point fingers. And yes, you’re the problem, it’s you. Phishing leads our list of points of failure for incurred claims yet again this year proving that even a server with open file transfer protocol is safer than thousands of employees eagerly clicking away”, cautions the Resilience report.

In 2023, 21% of claims reported phishing as a point of failure, often resulting in ransomware attacks or email compromise.

Software vulnerabilities, while constituting just 2% of claims last year, were responsible for 15% of the losses in Resilience’s portfolio. “These vulnerabilities were most often exploited using ransomware”, the report advised.

As more organizations confront ransomware attacks, treasury and security practitioners must take proactive steps to alleviate risks from ransomware threats.

Bolstering the human intelligence aspect, the first line of defence against ransomware attacks, is critical in the war against perpetrators of ransomware and other major types of cyber security threats.

Current and continual cybersecurity training for employees is vital for detecting and reporting threats. When employees are adequately trained, organizations can detect and mitigate both familiar and emerging types of cyber attacks before they occur. 

Conclusion

“Cyber threats continued to intensify in the first half of 2024 as cybercriminals exploited security gaps from growing business and technological consolidation”, the report warns.

The increase in the frequency of ransomware attacks and the soaring payout costs associated with them have elevated this issue to a board-level risk. Other types of cyber threats also warrant similar attention from corporate boards.

For now, it may be a good idea to heed the advice of Tom Egglestone, Global Head of Claims at Tom Egglestone: “While cybersecurity has historically been considered as a line item in a company’s budget, it’s clear that this is insufficient. Business leaders must adopt a risk-centric approach—one in which security strategies are grounded in the financial translation of cyber threats.”

Business leaders, finance chiefs, corporate treasurers and their teams, must also understand the playbook that cyber criminals use to infiltrate their organizations if they are to effectively safeguard their companies from the ever-evolving landscape of cyber threats and attacks. ⃰

 

⃰ Disclosure: Strategic Treasurer owns CTMfile.