CNA Financial ransom (2021)
A ransom of about 40 million dollars that US insurer CNA reportedly paid in March 2021 after a ransomware attack, one of the largest ever reported.
The case struck the market because the victim was itself a major cyber insurer, supposed to understand better than anyone the cost of refusing to pay. It fed the debate on insurance's contribution to the ransomware economy: when a ransom is reimbursable, the attacker can aim higher. The responsible group used new malware, and the victim said it had verified that the group was not on the US sanctions list, which shows the check required before any payment. Analysts nonetheless noted similarities with the tools of Evil Corp, a sanctioned group, illustrating how hard it is to establish the extortionist's identity with certainty. The case sped up the tightening of underwriting questionnaires and of coinsurance on extortion cover.
CNA was attacked on March 21, 2021 by ransomware called Phoenix CryptoLocker. According to Bloomberg, on May 20, 2021, the insurer paid about 40 million dollars in late March to regain access to its network and data; CNA said it had followed the law and checked that the group was not sanctioned.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.