Incident : Ransomware

ALL4362043100125

Exposure Impact

Title: Shift in Cyber Threats Targeting Small and Mid-Sized Firms in 2025

Description: In 2025, cybercriminals are increasingly targeting small and mid-sized firms due to hardened defenses at larger enterprises. Ransomware remains the dominant threat, with 88% of breaches at SMEs involving ransomware (vs. 39% at larger firms). Attackers are shifting from encryption to data exfiltration, which is more lucrative and less resource-intensive. Social engineering, credential abuse, and supply chain disruptions are key attack vectors. Retailers are the most targeted industry, while regulatory pressures (e.g., DORA, NIS2) and cyber insurance adoption are rising. Early detection, basic controls (patching, MFA, backups), and tabletop exercises significantly reduce claim costs.

Date Publicly Disclosed: 2025-06-30

Type: Ransomware

Attack Vector: Phishing/Social EngineeringCompromised CredentialsFake Help Desk Calls (e.g., Scattered Spider)Supply Chain VulnerabilitiesCloud Security IncidentsGenerative AI-Enhanced Scams

Vulnerability Exploited: Lack of Multi-Factor Authentication (MFA)Unpatched SystemsPoor Network SegmentationInsufficient Backup ProtocolsWeak Supplier Security Controls

Threat Actor: Scattered SpiderOpportunistic Cybercriminal GroupsInitial Access Brokers (IABs)Ransomware-as-a-Service (RaaS) Affiliates

Motivation: Financial Gain (Ransom Payments)Data Theft for Resale (Dark Web)Disruption of Business OperationsExploitation of Supply Chain Weaknesses

Incident : Ransomware

ALL0293402100925

Exposure Impact

Title: Cyber Insureds Gain Ground on Attackers, But Holidays Bring Heightened Risk: 2025 Mid-Year Report

Description: Allianz Commercial's 2025 mid-year report highlights a 50% reduction in cyber claim severity and a 30% drop in large claims frequency among insured companies due to improved detection and response capabilities. Ransomware remains the top threat (60% of large claims), with attackers targeting smaller firms (88% of data breaches in SMEs vs. 39% in large firms). Double extortion (ransomware + data exfiltration) now accounts for 40% of large claim values, up from 25% in 2024. Retail, manufacturing, and professional services are the most impacted sectors. Business interruption costs exceed 50% of claim values, while non-attack incidents (e.g., data mishandling) represent 28% of large claims.

Date Publicly Disclosed: 2025-06-30

Type: Ransomware

Attack Vector: Social Engineering (e.g., impersonation of employees)Exploitation of Digital Supply Chain VulnerabilitiesTargeted Attacks on SMEs/Less Resilient FirmsSeasonal Attacks (e.g., Black Friday to Year-End)

Vulnerability Exploited: Weak Detection/Response Capabilities (SMEs)Wide Attack Surfaces (Retail: staff, suppliers, IT systems)Lack of Business Continuity PlansPrivacy Regulation Non-Compliance

Motivation: Financial Gain (Extortion/Ransom)Data Theft for Resale (Dark Web)Exploitation of Seasonal Vulnerabilities (e.g., Holiday Shopping)

Incident : Ransomware ALL4362043100125

Entity Type: Small and Medium-Sized Enterprises (SMEs), Retailers, Manufacturers, Professional Services Firms

Industry: Retail (Most Targeted in H1 2025), Manufacturing, Professional Services

Location: Global (with focus on regions with low cyber insurance penetration)

Size: Small to Mid-Sized Firms

Customers Affected: Millions (due to supply chain/retail breaches)

Incident : Ransomware ALL0293402100925

Entity Name: Unspecified Large Insured Companies (Multinationals)

Entity Type: Corporation

Industry: Manufacturing (33% of large claims), Professional Services (18%), Retail (9%)

Location: Global (Focus on Asia/Latin America for SMEs)

Size: Large (Improved Resilience) & SMEs (Higher Targeting)

Incident : Ransomware ALL0293402100925

Entity Name: Small and Medium-Sized Enterprises (SMEs)

Entity Type: Business

Industry: Cross-Sector (Retail Highlighted)

Location: Global (Emphasis on Asia/Latin America)

Size: Small to Mid-Sized

Incident : Ransomware ALL4362043100125

Incident Response Plan Activated: Yes (for insured firms with preparedness)

Third Party Assistance: Cyber Insurance Providers (E.G., Allianz), Forensic Investigators, Legal Counsel.

Containment Measures: Network SegmentationIsolation of Affected SystemsRevoking Compromised Credentials

Remediation Measures: Patching VulnerabilitiesEnhanced Authentication (MFA)Data Recovery from Backups

Recovery Measures: Business Continuity PlansSupplier Risk AssessmentsCustomer Notification (if data breached)

Communication Strategy: Transparent Disclosure (for insured firms)Regulatory Reporting (DORA/NIS2 compliance)

Network Segmentation: Critical for limiting lateral movement

Enhanced Monitoring: Early detection reduced losses by 1,000x

Incident : Ransomware ALL0293402100925

Incident Response Plan Activated: True

Third Party Assistance: Cyber Insurance Providers (E.G., Allianz Commercial), Law Enforcement (International Coordination).

Containment Measures: Early Detection/Response (Reduces Costs by 1,000x)Business Continuity Plans

Incident : Ransomware ALL4362043100125

Type of Data Compromised: Personally identifiable information (pii), Financial records, Corporate intellectual property

Sensitivity of Data: High (PII, payment data)

Data Exfiltration: Primary tactic (more common than encryption)

Data Encryption: Secondary (still used in 60% of large claims)

Personally Identifiable Information: Frequently targeted in retail breaches

Incident : Ransomware ALL0293402100925

Type of Data Compromised: Personally identifiable information (pii), Corporate data (exfiltrated in 40% of large claims)

Sensitivity of Data: High (PII, Financial Data in Retail)

Incident : Ransomware ALL4362043100125

Data Encryption: Used in 60% of large claims (>€1M)

Data Exfiltration: Dominant tactic (88% of SME breaches)

Incident : Ransomware ALL0293402100925

Data Encryption: True

Data Exfiltration: True

Incident : Ransomware ALL4362043100125

Regulations Violated: Digital Operational Resilience Act (DORA) - EU, NIS2 Directive - EU, Sector-Specific Privacy Laws (e.g., GDPR),

Legal Actions: 1,500+ privacy litigation cases (US, 2024)

Regulatory Notifications: Mandatory under DORA/NIS2 for critical sectors

Incident : Ransomware ALL0293402100925

Regulations Violated: Data Privacy Laws (e.g., GDPR), Sector-Specific Regulations,

Incident : Ransomware ALL4362043100125

Lessons Learned: SMEs are now primary targets due to weaker defenses compared to large enterprises., Data exfiltration is more profitable and easier than encryption for attackers., Basic controls (MFA, patching, backups) drastically reduce financial impact., Supply chain and cloud security are critical but often overlooked., Tabletop exercises and business continuity planning improve resilience., Regulatory compliance (DORA, NIS2) will raise the bar for mid-sized firms.

Incident : Ransomware ALL0293402100925

Lessons Learned: Early detection/containment reduces costs exponentially (1,000x lower impact)., Business continuity plans mitigate >50% of claim costs (business interruption)., SMEs remain highly vulnerable (88% of breaches vs. 39% in large firms)., Double extortion (ransomware + data theft) is rising (40% of large claims in H1 2025)., Cyber insurance improves resilience (70% loss impact increase for insureds vs. 250% for uninsured over 4 years)., Seasonal risks (e.g., Black Friday) require heightened vigilance.

Incident : Ransomware ALL4362043100125

Recommendations: Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.Implement MFA and network segmentation to limit lateral movement., Conduct regular patching and backup testing., Train employees on social engineering (e.g., phishing, fake help desk calls)., Assess third-party/supplier cybersecurity risks., Adopt cyber insurance to mitigate financial and operational risks., Prepare for DORA/NIS2 compliance if operating in the EU., Use tabletop exercises to test incident response plans., Monitor dark web for stolen credentials/data.

Incident : Ransomware ALL0293402100925

Recommendations: Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).Implement robust detection/response capabilities (e.g., EDR, SIEM)., Develop and test business continuity plans to reduce interruption costs., Prioritize supply chain security and third-party risk management., Enhance employee training to counter social engineering (e.g., impersonation attacks)., Leverage cyber insurance for risk transfer and incident response support., Strengthen data privacy compliance to avoid regulatory fines., Monitor dark web for stolen data (especially for SMEs)., Prepare for seasonal threats (e.g., holiday shopping periods).

Incident : Ransomware ALL4362043100125

Source: Allianz Cyber Security Resilience 2025 Report

URL: https://www.allianz.com/en/press/news/reports/250627-cyber-security-resilience-2025.html

Date Accessed: 2025-06-27

Incident : Ransomware ALL4362043100125

Source: Allianz Commercial - Global Cyber Insurance Market Projections

URL: https://commercial.allianz.com/en/insights/press-releases/cyber-insurance-market-to-double-by-2030.html

Date Accessed: 2025-06-30

Incident : Ransomware ALL0293402100925

Source: Allianz Commercial - Cyber Security Resilience Outlook (2025 Mid-Year Report)

Date Accessed: 2025-06-30

Incident : Ransomware ALL0293402100925

Source: Verizon Data Breach Investigations Report (DBIR)

Incident : Ransomware ALL4362043100125

Investigation Status: Ongoing (trend analysis based on H1 2025 claims data)

Incident : Ransomware ALL0293402100925

Investigation Status: Ongoing (Trend Analysis)

Incident : Ransomware ALL4362043100125

Stakeholder Advisories: Mid-Sized Firms Urged To Adopt Cyber Insurance And Basic Controls., Retailers Advised To Secure Customer Data And Supply Chains., Eu Organizations Must Prepare For Dora/Nis2 Compliance Deadlines..

Customer Advisories: Monitor financial accounts for fraud (if data breached).Report suspicious communications (e.g., phishing, fake support calls).

Incident : Ransomware ALL0293402100925

Stakeholder Advisories: Heightened Risk During Holiday Seasons (Black Friday To Year-End)., Smes Urged To Adopt Cyber Insurance And Basic Hygiene Measures., Large Firms Advised To Share Threat Intelligence With Supply Chains..

Customer Advisories: Retail customers: Monitor financial accounts for fraud during holidays.SME customers: Implement multi-factor authentication (MFA) and backups.

Incident : Ransomware ALL4362043100125

Entry Point: Compromised Credentials (Most Common), Phishing Emails, Fake Help Desk Calls (E.G., Scattered Spider), Exploited Vulnerabilities In Supply Chain,

Reconnaissance Period: Often <24 hours (rapid movement to ransomware)

High Value Targets: Retailer Databases (Pii/Payment Data), Manufacturing Supply Chain Systems, Cloud-Stored Corporate Data,

Data Sold on Dark Web: Retailer Databases (Pii/Payment Data), Manufacturing Supply Chain Systems, Cloud-Stored Corporate Data,

Incident : Ransomware ALL0293402100925

Entry Point: Social Engineering (Employee Impersonation), Digital Supply Chain Exploits, Unpatched Vulnerabilities (Smes),

High Value Targets: Retail Sector (Pii, Payment Data), Manufacturing (Ip, Operational Data), Professional Services (Client Data),

Data Sold on Dark Web: Retail Sector (Pii, Payment Data), Manufacturing (Ip, Operational Data), Professional Services (Client Data),

Incident : Ransomware ALL4362043100125

Root Causes: Lack Of Basic Controls (Mfa, Patching) In Smes, Over-Reliance On Perimeter Security (No Segmentation), Poor Employee Training On Social Engineering, Supply Chain/Vendor Security Gaps, Delayed Detection And Response,

Corrective Actions: Mandate Mfa And Least-Privilege Access., Implement Network Segmentation And Zero-Trust Principles., Conduct Regular Phishing Simulations And Security Training., Audit Third-Party Vendors For Cybersecurity Risks., Deploy Edr/Xdr For Early Threat Detection., Test Backups And Incident Response Plans Quarterly.,

Incident : Ransomware ALL0293402100925

Root Causes: Inadequate Detection/Response (Smes), Over-Reliance On Digital Supply Chains, Lack Of Employee Awareness (Social Engineering), Seasonal Operational Strains (E.G., Holiday Staffing),

Corrective Actions: Mandate Cyber Insurance For Smes In High-Risk Sectors., Expand Law Enforcement Coordination For Ransomware Disruption., Promote Adoption Of Nist/Cis Controls For Baseline Security., Incentivize Threat Intelligence Sharing Among Industries.,