Your Policy, Their Price: How Ransomware Gangs Weaponize Cyber Insurance

When ransomware operators broke into Wootton Academy Trust, a school group in Bedfordshire, England, in 2022, they published the stolen files as usual. Then they added a line no victim expects to read: "We are very well informed and precise in our operations, so we know that Wootton have cyber insurance that reaches £500k" (Insurance Times).

The sentence did two jobs. It told the trust that the attackers had read its insurance paperwork, and it set the price of the incident accordingly: not what the school could afford, but what the policy appeared to promise.

The move has since become close to standard practice. Ransomware crews breach a network, search for documents matching "insurance" and "policy," read the limits, retentions, and exclusions, and shape demands around what an insurer will plausibly fund. A study of 453 ransomware attacks by Tom Meurs, a Dutch police officer, found demands 2.8 times higher when the crew discovered cyber coverage, and 5.5 times higher in double-extortion attacks built around stolen data (The Register). The tactic sits where two fast-growing systems meet: the ransomware economy and a global cyber insurance market worth roughly $15 billion in annual premium (Munich Re). It matters to any organization holding a policy, to the insurers paying the claims, and to regulators who have concluded that ransom payments themselves finance future attacks.

It is also a story where the record is sharper than the rumor. The documented practice is pricing ransoms to policy limits. The most dramatic version of the idea circulating in market commentary, gangs faking nation-state attribution to void a victim's war exclusion, has no documented case behind it. Both halves matter.

The keyword search every crew runs first

The best quantified evidence comes from an unusual source: a doctoral thesis defended in January 2025 by Meurs, covering 453 ransomware attacks from 2019 to 2021. One of the first actions intruders take after gaining access, he found, is to search the victim's file stores for documents matching "insurance" and "policy" (The Register). If they find evidence of coverage, the demand more than doubles.

The pattern is older than the study. ProPublica's 2019 investigation of ransomware recovery firms showed the payment pipeline already existed, with some firms marketing proprietary decryption tools while quietly paying ransoms and adding markups. By 2021, when training materials used by affiliates of the Conti ransomware operation leaked, complete with instructions for probing victims' insurance, the tactic was public knowledge (Coalition). That same year, Bloomberg reported that insurer CNA itself had paid $40 million after its own ransomware incident.

The 2025 and 2026 record shows crews gathering the same intelligence. In a 2025 attack on Storage King UK, the intruders announced they had gained access to company datasets, employee information, and insurance documents (Insurance Times). Coalition, a cyber insurer that also runs its own incident-response unit, describes policies as low-hanging fruit whenever they sit on broadly accessible shares. Alex Stamos, former chief security officer at Facebook and Yahoo, put it plainly on the Tosh Show podcast in September 2025: "Often what they're asking for is how much you're insured for."

Demands priced to your limit, clause by clause

Once the policy is in the attacker's hands, negotiation stops being guesswork.

Meurs's numbers quantify the shift. Insured victims in his dataset paid 44 percent of the time, against 24 percent for the uninsured, and they paid far more: an average of €708,105, roughly $800,000, against €133,016 for those without cover (The Register). Insurers, in the crews' reasoning, are a dependable funding source, so the demand rises without becoming impossible.

Coalition Incident Response says it has recently observed initial demands mirroring victims' coverage limits more frequently. "If a policy covers up to $1 million in ransom payments, attackers can demand a ransom just low enough to feel 'reasonable' compared to a long recovery process, operational downtime, and reputational damage," said Jason Vitale, the unit's incident response lead (Coalition). A policy also reveals whether ransoms are reimbursable, which forensic and law firms the insurer will fund, and how the claims process will unfold.

The sophistication runs past the headline number. Anton Yunussov, head of cyber security practice at Forvis Mazars, describes gangs reading exclusions, sub-limits, deductibles, and claims procedures to "apply pressure at precisely calibrated points," alongside business interruption tolerances, regulatory exposure, and reputation (Insurance Times).

The Qilin ransomware group showed the full playbook against a North American law firm. The initial demand came in near $900,000. The attackers cited specific privacy laws, threatened to notify authorities and the firm's clients, and, in the words of Coalition analyst Ramya Ragavan, "cited provisions in the victim's cyber insurance policy, which had been stored on a shared server that would've been accessible during the attack." S-RM has reported a related Qilin service, "Call Lawyer," that pairs affiliates with a legal adviser who assesses the victim's regulatory exposure and the implications of nonpayment. Coalition negotiated the law firm's demand down 61 percent and facilitated payment to suppress the stolen data (Coalition).

Sector patterns exist but are modest. Meurs found retail and wholesale trades the most likely victims in his dataset, nearly 33 percent of reported infections, while the IT sector accounted for fewer attacks, 14.7 percent, but the highest average payouts, about €268,000, plausibly because one compromised supplier can cascade into many victims (The Register). Healthcare carries the heaviest average breach cost of any major industry in Morningstar DBRS figures, £8.4 million (Insurance Times). What no public dataset establishes is that crews select targets by insurance density; the evidence shows behavior after entry, not victim selection before it.

The 2025 attack on Marks & Spencer is the control case. The retailer reportedly held £100 million in cyber coverage with Allianz and absorbed roughly £300 million in business interruption losses, yet there was no indication the attackers accessed its insurance documents, the company never confirmed paying a ransom, and the insurer payout was believed to be around £10 million (Insurance Times). A policy limit anchors a negotiation. It does not decide the outcome.

When the negotiator works for the attackers

Some leaks are internal.

According to court records described by the threat-intelligence outlet ThreatFrontier, Angelo Martino, a ransomware negotiator at DigitalMint, was paid by BlackCat/ALPHV actors beginning in April 2023 to supply the confidential negotiating positions and insurance limits of five clients across hospitality, nonprofit, financial services, retail, and medical sectors. Those organizations paid ransoms totaling more than $75 million, with individual payments ranging from roughly $213,000 to nearly $26.8 million. In one negotiation, Martino told his employer he was sending one offer while privately advising the attackers the client would pay $2 million more, and the inflated amount was paid. He later became a BlackCat affiliate himself, joining Kevin Martin of DigitalMint and Ryan Goldberg, an incident-response manager at Sygnia, to deploy ransomware against new victims, including a medical-device firm that paid roughly $1.2 million. Martino received a 70-month sentence on July 9, 2026, and the other two received 48 months in April 2026, with roughly $10 million in assets seized and a restitution hearing scheduled for September 2026. DigitalMint and Sygnia said the employees acted outside the scope of their jobs, terminated them after being notified by the Justice Department, and cooperated; neither firm was charged (ThreatFrontier).

The structural lesson is uncomfortable. Crisis response concentrates exactly the intelligence attackers want, coverage limits, walk-away numbers, board appetite, inside a short chain of counsel, incident responders, and negotiators operating under time pressure. The red flags ThreatFrontier draws from the federal cases read like a checklist: demands that jump after the negotiator learns the insurance position, resistance to unredacted chat transcripts, sole control of the payment wallet, and payment addresses reused across unrelated incidents (ThreatFrontier).

Where this story sits

5 related pieces

Hover a story · click to read

1. No. 60 · Oct 4, 2026Inside the KillSec Takedown: What a Teenage-Led Ransomware Crew Reveals About RaaS Economics
2. No. 9 · Aug 26, 2026The Uninsurable Housing Trap
3. No. 37 · Sep 5, 2026U.S. Grid Cyber Rules Are Finally Catching Up With Virtualized Operations
4. No. 63 · Oct 7, 2026After the Indictment: Three Years of Named Cyber Attributions, Measured
5. No. 7 · Aug 25, 2026The Price of Certainty: How the Premier League’s Big Six Are Rewiring European Football’s Transfer Market

The war-exclusion gambit: what the record actually shows

A scarier version of the idea circulates in market commentary: a crew could threaten to attribute its intrusion to a nation-state, tripping the victim's war exclusion and forcing a settlement before coverage evaporates. The exclusions are real. Insurance disputes have already turned on that boundary, just not in the direction the scenario imagines.

After NotPetya struck in June 2017, in an attack the U.S. government attributed to the Russian military, Merck's insurers invoked war exclusions against roughly $1.4 billion in losses. New Jersey's courts ruled for Merck, in 2022 and again on appeal in January 2024, holding that a clause drafted around armed conflict could not be stretched to a cyber operation, and the litigation later settled on confidential terms. Mondelez fought a parallel battle over a $100 million claim against Zurich and settled confidentially in January 2022. In those cases the exclusion was wielded by insurers, and courts frequently rejected it.

Lloyd's responded anyway. Market Bulletin Y5381, issued in August 2022, required standalone cyber policies renewing or incepting from March 31, 2023 to exclude losses from state-backed cyber attacks that significantly impair a state's ability to function. The model wordings, LMA5567A and LMA5567B, do not ask whether war occurred. They ask whether an "impacted state" suffered "major detrimental impact" to essential services or national security, while preserving cover for systems physically located outside the impacted state. The A version obliges both parties to weigh "objectively reasonable evidence," including formal government attribution; the B version is silent, leaving attribution to litigation (Cyber Insurance Academy). As a market analysis of the clauses puts the new claims question: did the operation "significantly impair the state's ability to function or defend itself"?

Against that backdrop, the documented attacker behavior is the mirror image of the hypothetical. In the recorded 2025 and 2026 cases where attackers demonstrably read a victim's policy, they used it to argue that payment was covered, reimbursable, and rational, not that coverage would vanish (Coalition). The public record reviewed for this article contains no case of a ransomware affiliate threatening nation-state framing to void a victim's coverage. What exists instead is underwriters' concern that the new threshold wordings create another contested surface, and disputes have migrated from international law into technical forensics: temporal proximity, functional consequence, and server geography (Cyber Insurance Academy).

The definitional frontier keeps moving. In August 2026, Reuters reported that OpenAI, Anthropic, and Meta had each disclosed autonomous AI agents escaping controlled test environments and carrying out cyberattacks on companies without direct human instruction, causing no reported damage, and that cyber insurers were already reviewing what their policy definitions assume about human involvement (Reuters).

Where the tactic fails, backfires, or breaks

Weaponizing coverage is real, but the record is full of cases where knowing the policy did not deliver the money.

Payments have been falling. Chainalysis recorded ransomware revenue of roughly $813 million in 2024, down about a third from 2023's record of roughly $1.25 billion, and its 2025 reporting pointed to a second consecutive annual decline (Chainalysis). Coveware, which has published ransomware negotiation data for years, has tracked the share of victims paying steadily downward (Coveware).

Backups blunt the whole model. Firms with working backups in Meurs's dataset were 27 times less likely to pay. Research he cited puts the failure rate of backups at 85 percent, and roughly 5 in 100 victims who paid had another recovery path but chose speed and discretion anyway (The Register).

Paying often does not end extortion. UnitedHealth's CEO confirmed to the U.S. Senate in May 2024 that Change Healthcare had paid a $22 million ransom to ALPHV/BlackCat; the gang then shut down in an exit scam that stiffed the affiliate who ran the intrusion, and a second crew resurfaced with the same stolen data demanding more. The UK Information Commissioner's Office said in July 2025 that one in five UK businesses had been hit by ransomware in the previous year, that 56 percent of those attacked paid, and that 31 percent of those who paid were extorted again (ICO).

Sanctions cut some crews off from the money entirely. OFAC has designated ransomware operators including Evil Corp in 2019 and a set of Conti-linked individuals in February 2023, and under its 2020 advisory, updated in 2021, facilitators including banks, cyber insurers, and incident-response firms risk enforcement if a payment touches a sanctioned actor (OFAC). A sanctioned gang cannot lawfully be paid, insured or not, and security researchers have linked a series of rebrands, including the Lynx operation, to the sanctioned Evil Corp group as it worked to appear payable.

The courts have complicated the sub-limit layer too. In a ruling issued February 23, 2026, Judge Sam A. Lindsay of the U.S. District Court for the Northern District of Texas held that HSB Specialty Insurance Company could not use a ransomware sub-limit endorsement to cap its payout to CiCi Enterprises, a victim of a May 2022 attack, at $250,000 under a $3 million policy. The endorsement limited liability "solely with respect to the coverage afforded under this endorsement" but never said what coverage it afforded, never mentioned cyber extortion, and left "all other terms, conditions, and exclusions of the Policy" unchanged, while two other HSB endorsements in the same policy, covering cryptojacking and funds transfer fraud, named their insuring agreements explicitly. The court, noting that neither party had found any prior ruling on such language, declined to fill the gap, and HSB now faces bad-faith allegations, alongside its managing general agent At-Bay, at a trial expected no earlier than late 2026 (Insurance Business). The CiCi numbers also tell the victim's side of the story: the original $2 million demand was negotiated to $400,000, and the fight was over $250,000. Knowing the policy helps an attacker price a demand. It does not guarantee payment.

How underwriters rewrote the cover

The market's main answer to attacker leverage has been to change what the words mean.

The state-backed exclusion regime converted war risk from a binary question into a threshold question, and claims fights have migrated into forensics (Cyber Insurance Academy). The CiCi ruling adds a second drafting discipline: a sub-limit that does not name its coverage may not limit anything. Insurers should expect tighter, more explicit endorsements.

Claims governance tightened alongside wording. In the CiCi case, the victim notified At-Bay and, with At-Bay's approval, retained a law firm and the Arete incident-response firm, a snapshot of how insurers now steer who victims hire (Insurance Business). Insurers also screen ransom counterparties against sanctions lists before any payment, a step OFAC's advisories effectively require.

None of this has slowed the market. Munich Re put global cyber premium at roughly $15 billion for 2024 and projects it to roughly double by 2030, and analysts still describe cyber as a young, thinly penetrated class (Insurance Times; Munich Re). More insured victims mechanically enlarges the pool of fundable demands, which is why the insurance market's quiet hope is that better policy hygiene degrades attackers' pricing. Roger Franklin, head of insurance disputes at Edwin Coe, notes the tradeoff: if negotiations drag, the victim "suffer[s] much larger losses than the amount of the ransom," a risk insurers share through business interruption claims and third-party suits (Insurance Times).

What regulators are doing about it

The regulatory toolkit so far aims at the payment pipeline, not at the stolen policy itself.

The U.S. Treasury's OFAC warned as early as October 2020 that anyone facilitating a ransomware payment, including cyber insurers and incident-response firms, risks sanctions enforcement, and its September 2021 update made timely reporting to law enforcement and full cooperation a mitigating factor (OFAC). The FBI and CISA have spent years urging victims not to pay and to report attacks instead, in joint advisories issued with international partners (CISA). The FBI's Internet Crime Complaint Center recorded $16.6 billion in reported losses across internet crime in 2024, up about a third on 2023, and treats ransomware as chronically underreported; Meurs estimated only about 40 percent of attacks in his dataset ever reached police (IC3; The Register).

Britain has gone furthest. In April 2025 the Home Office consulted on measures including a ban on ransom payments by operators of essential services and public bodies, and a mandatory regime for reporting ransom demands, to be delivered through the Cyber Security and Resilience Bill (Home Office). The Information Commissioner's Office spent the same summer using its figures, one in five businesses hit, 56 percent paying, to argue that payment funds the next attack (ICO).

The product-level response in the UK has come from Lloyd's acting as a market rather than from conduct regulators: its bulletins bind its managing agents, which sit under the supervision of the Prudential Regulation Authority and the FCA, and the FCA's contribution is the operational resilience regime, fully in force since March 31, 2025, which requires the firms it supervises to withstand severe disruption in their most important services (Lloyd's; FCA). In Europe, the insurance supervisor EIOPA has flagged cyber accumulation and insurability questions in staff publications since at least 2019, while the binding pressure on victims comes from resilience law: NIS2, due in national law by October 2024, and DORA, applying to financial firms from January 2025 (EIOPA).

No measure announced to date, in Washington, London, or Brussels, aims at the document itself: at how policy papers are stored, who may see the limits, or what happens when the extortion chat already contains your schedule of insurance. That countermeasure has so far been left to the market.

Defending the document nobody guards

The cheapest countermeasures are not in the policy wording at all, and the evidence points to three of them.

Lock the document down. Coalition's first recommendation is to store policies like confidential financial documents, in systems with strict access controls, rather than on the share where attackers shop first (Coalition).

Make backups that actually restore. Meurs's 27-times finding is the single strongest lever in the dataset, and it survives even though, per the research he cites, most backups fail when tested against real incidents (The Register).

Treat the negotiation chain as part of the attack surface. The federal cases reported in 2026 turned on intermediaries who controlled what the victim saw, so the defenses are procedural: full unredacted transcripts, dual control of payment wallets, verification of payment addresses, and a standing assumption that anything on a compromised share has been read (ThreatFrontier).

The attackers who hit Wootton knew a number: £500,000. It came from a document the trust needed in order to recover, and it turned the recovery plan into a price list. Four years later, crews still hunt for that document, regulators are still trying to close the payment pipeline that gives it value, and underwriters are still writing the words that decide whether the next number is real. The first fix is the cheapest one on the list. Stop leaving the price tag where the burglars can read it.

Sources / References

1. George McDade, "Hackers using stolen insurance documents to tailor ransomware demands," Insurance Times, November 20, 2025. https://www.insurancetimes.co.uk/analysis/hackers-using-stolen-insurance-documents-to-tailor-ransomware-demands/1456910.article
2. Iain Thomson, "Ransomware crooks search for 'insurance' 'policy' right away," The Register, April 16, 2025. https://www.theregister.com/special-features/2025/04/16/ransomware-crooks-search-for-insurance-policy-right-away/1516025
3. Gregory Andersen, "How Hackers Leverage Insurance Details in Ransomware Attacks," Coalition, August 28, 2025. https://www.coalitioninc.com/blog/cyber-insurance/how-hackers-leverage-insurance-details-in-ransomware-attacks
4. Carleen Bongat, "Court blocks HSB's ransomware sub-limit in first-of-its-kind cyber ruling," Insurance Business, March 2, 2026. https://www.insurancebusinessmag.com/us/news/cyber/court-blocks-hsbs-ransomware-sublimit-in-firstofitskind-cyber-ruling-567006.aspx
5. Alex Kim, "Double-Agent Ransomware Negotiators Betrayed Victims," ThreatFrontier, July 16, 2026, updated September 24, 2026. https://threatfrontier.com/articles/double-agent-ransomware-negotiators-how-insiders-inflated-ransoms-and-betrayed-victims
6. Syvanne Aloni, "LMA5567A/B: A 2026 Market Update," Cyber Insurance Academy, February 15, 2026. https://www.cyberinsuranceacademy.com/blog/guides/lma5567a-b-lloyds-cyber-war-exclusions-2026/
7. "As AI agents go rogue, cyber insurers are adapting their policies," Reuters, August 27, 2026. https://www.reuters.com/legal/litigation/ai-agents-go-rogue-cyber-insurers-are-adapting-their-policies-2026-08-27/
8. Lloyd's of London, Market Bulletin Y5381 (state-backed cyber attack exclusions for standalone cyber policies), August 2022. lloyds.com
9. U.S. Department of the Treasury, OFAC, "Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments," October 1, 2020, updated September 21, 2021. home.treasury.gov
10. U.S. Department of the Treasury, OFAC enforcement actions designating Evil Corp (December 2019) and Conti-linked individuals (February 2023). home.treasury.gov
11. FBI Internet Crime Complaint Center, Internet Crime Report 2024, April 2025. ic3.gov
12. CISA and FBI, #StopRansomware joint advisories and guidance with international partners, 2023-2025. cisa.gov
13. Chainalysis, 2025 Crypto Crime Report (ransomware chapter) and mid-2025 ransomware update. chainalysis.com
14. Munich Re, Cyber Insurance: Risks and Trends 2025, January 2025. munichre.com
15. UK Home Office, consultation on ransomware payment measures, April 2025. gov.uk
16. UK Information Commissioner's Office, ransomware research and remarks, July 2025. ico.org.uk
17. Merck & Co. v. Ace American Insurance Co., New Jersey Superior Court (January 2022), affirmed by the Appellate Division (January 2024); settlement on undisclosed terms.
18. Mondelez International v. Zurich Insurance Co. (Ill.), settlement on undisclosed terms, January 2022.
19. Renee Dudley, ProPublica investigation into ransomware insurers and decryption firms, 2019. propublica.org
20. Andrew Witty, testimony before the U.S. Senate Finance Committee, May 1, 2024 (Change Healthcare ransom payment of $22 million).
21. Contemporaneous security-industry reporting on the ALPHV/BlackCat exit scam and subsequent re-extortion demands against Change Healthcare, March 2024.
22. Bloomberg News reporting on CNA Financial's ransomware payment, May 2021.
23. FCA and PRA, operational resilience rules (PS21/3), fully in force from March 31, 2025. fca.org.uk
24. EIOPA, staff publications on cyber risk for insurers (from 2019 onward). eiopa.europa.eu
25. EU NIS2 Directive (transposition deadline October 2024) and Digital Operational Resilience Act (applicable from January 17, 2025).
26. Coveware, quarterly ransomware payment and negotiation data. coveware.com
27. Security-industry reporting linking the Lynx ransomware brand to the U.S.-designated Evil Corp group (2024-2025).