A mid-sized retail firm insured by Allianz Commercial fell victim to a Scattered Spider-linked ransomware attack in early 2025, initiated via a fake help desk call that compromised employee credentials. Within 24 hours, attackers exfiltrated customer payment data (credit cards, personal details) and encrypted critical systems, halting e-commerce operations for 48 hours. The breach exposed 120,000 customer records, triggering privacy litigation under GDPR and a €2.1M ransom demand (partially paid to prevent data leaks). The incident disrupted supply chain integrations, causing €3.8M in business interruption losses—amplified by a concurrent cloud outage at a third-party payment processor. While Allianz’s tabletop exercises helped contain the attack, the retailer faced reputational damage from press coverage and a 15% drop in quarterly sales. Regulatory fines for delayed breach notification added €900K to the total loss.

The report highlights that while large insured companies (e.g., in manufacturing, retail, or professional services) have improved cybersecurity resilience in 2025—reducing severity by 50% and large-claim frequency by 30%—ransomware remains the dominant threat, accounting for 60% of large cyber claims (>€1M). A key trend is the shift toward double extortion (data exfiltration + encryption), now comprising 40% of large claim values (up from 25% in 2024), with losses involving data theft doubling in cost compared to non-exfiltration incidents. The average data breach cost reached $5M in 2024, driven by stricter regulations. Despite progress, attacks on less resilient SMEs (88% of their breaches involve ransomware vs. 39% for large firms) and supply chain vulnerabilities expand the risk landscape. The report warns of seasonal spikes during Black Friday/Cyber Monday, where retail’s high personal data exposure and business interruption risks amplify extortion leverage. While early detection mitigates some losses, prolonged undetected attacks escalate costs exponentially—up to 1,000x higher if data theft and encryption occur. Business interruption alone accounts for >50% of claim values, underscoring the operational cripple potential of such incidents.