Hive takedown (2023)
An FBI operation that infiltrated the Hive ransomware for seven months, gave decryption keys to its victims, then seized its servers in January 2023.
The classic law enforcement response to ransomware comes after payment: tracing funds, indicting, rarely arresting. Against Hive, the FBI took another path: having penetrated the group's infrastructure in July 2022, it quietly collected decryption keys and passed them to victims as attacks unfolded, sparing them from paying without alerting the operators. It seized the servers only afterward, with German and Dutch police. The operation showed that infiltration can reduce ongoing losses rather than only punish. For insurance, it underscores the value of reporting an incident to authorities early: a victim who reports may receive a key that no negotiation would have obtained.
On January 26, 2023, the Justice Department announced the seizure of Hive's servers. The group had hit more than 1,500 victims and received more than 100 million dollars; over seven months of infiltration, the FBI had given more than 300 keys to victims under attack and more than 1,000 to earlier victims, averting by its estimate about 130 million dollars in ransoms.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.