"The real risk is about more than a security incident's immediate disruption, it's about the long-tail aftershocks that follow," he added. "Claims data gives us the best and most granular insight into the real-world costs of those shockwaves. Understanding the materiality of the full lifecycle of a cyber incident is the only way to meaningfully arm ourselves against advanced new tactics and grow more resilient to inevitable threats."

Other key takeaways…

In 2025, extortion demands to suppress stolen data comprised less than half (49%) of all extortion claims in the first half of the year, then grew to nearly two-thirds (65%) in the second half. Across the entire year, data theft-only attacks accounted for more than half (57%) of all attacks, as hackers look to bypass organizations' increasingly strong backup practices.
In 2025, infostealers harvested more than 2 billion credentials and were frequently observed in victim organizations' environments before ransomware attacks occurred, meaning that infostealer activity should be treated as a critical early warning signal requiring immediate action to prevent credential harvesting and prevent follow-on attacks.
In 2025, threat groups like Interlock continued to find victim organizations' cyber insurance policies among stolen data to better calibrate their ransom demands—maximizing payouts while staying below coverage limits.
In 2025, vendor risk was the second-highest loss category across Resilience's portfolio, representing nearly one-fifth (18%) of total losses. Threat actors are successfully leveraging password reset attacks and are increasingly infiltrating open-source code repositories that serve as the foundation for enterprise applications; this opens the door to an industry-wide cascade of short- and long-term disruption following the compromise of a critical vendor.

See also:

Special Reports /

Cybercriminals prioritized long-term leverage over immediate disruption in 2025

Related Stories

Recommended For You