Resilience Flags Data-Theft Ransomware Surge and Rising Vendor Risk in 2025 Cyber Claims

New updates have been reported about Resilience.

Resilience is reporting a sharp shift in ransomware economics across its 2025 cyber insurance portfolio, with attackers favoring data theft over encryption and exploiting this for longer-term leverage. According to the company’s 2025 Cyber Risk Report, extortion tied to suppressing stolen data increased from 49% of extortion claims in the first half of 2025 to 65% in the second half, and data-theft-only attacks represented 57% of all incidents as adversaries work around improved backup strategies.

The report, based on claims and telemetry from Resilience’s Risk Operations Center, also highlights the growing role of infostealers, which harvested more than 2 billion credentials and frequently appeared in victim environments before ransomware was deployed, making them a critical early warning indicator. Vendor-related incidents emerged as the second-largest loss category for Resilience clients, accounting for 18% of total losses, as threat actors increasingly abuse password reset mechanisms and compromise open-source code repositories, heightening the risk of cascading disruption across entire supply chains.

Resilience notes that threat groups such as Interlock are systematically scanning stolen data for cyber insurance policies to fine-tune ransom demands to sit just below coverage limits, underscoring how insurance terms are directly influencing attack economics. CEO Vishaal “V8” Hariprasad stresses that the material impact of cyber incidents now extends well beyond immediate downtime, with long-tail financial and operational consequences that can accumulate over months or years, raising the stakes for how clients structure risk transfer and security investments.

In response, Resilience is advising clients to prioritize data loss prevention, zero-trust architectures, dark‑web and credential monitoring, vendor contingency planning, and tabletop exercises, alongside insurance programs calibrated to current severity rather than historical loss averages. Head of the Risk Operations Center Judson Dressler points to the company’s proactive hunting for stolen credentials and emerging vulnerabilities as an example of how Resilience is adapting its integrated model of risk quantification software, cybersecurity services, and insurance to an “everything, everywhere, all at once” cyber risk environment, with implications for pricing, underwriting discipline, and the value proposition it offers large and mid‑market enterprises across the U.S., U.K., Canada, and Europe.