Why Data Exfiltration Has Replaced Ransomware as the Top Cyber Threat

The ransomware threat has undergone a major transformation, with data exfiltration now surpassing system encryption as the primary source of damage and claims in cyberattacks. Many small to mid-sized businesses are no longer scrambling to restore encrypted data thanks to improved backup strategies, but this hasn’t translated to lower losses. Instead, attackers are stealing massive volumes of sensitive information and leveraging it for extortion, triggering costly legal, regulatory, and reputational fallout.

Ransom payment rates have plummeted—from 85% in 2019 to 25% by the end of 2024—yet overall claims costs continue to rise. The financial burden now stems from data mining, breach notification obligations, privacy class actions, and increased legal expenses. These emerging costs demand a shift in how insurers underwrite cyber risk and handle claims.

As attackers gain deeper access and dwell longer in networks, insurers and insureds alike must prioritize tools like Data Loss Prevention (DLP). These solutions offer visibility into sensitive data flows, prevent unauthorized transfers, and help maintain compliance with regulations such as HIPAA, CCPA, and GDPR. However, many DLP rollouts fall short due to poor data classification and inventory management.

For insurance professionals, the new cyber risk landscape calls for a pivot: from focusing primarily on operational disruption to managing data-centric exposures. Underwriters, adjusters, and brokers must recalibrate their approach to cyber coverage, claims processing, and client guidance to stay ahead in a threat environment increasingly driven by data theft.