Resilience Data Shows Ransomware Drives 70% of Energy Sector Losses
A new analysis reveals that while email compromise triggers many claims, ransomware incidents account for the vast majority of financial losses in the energy and utilities sector.
Key points
- Email compromise accounted for 21% of claims in the energy sector between Jan. 1, 2023, and Sept. 5, 2026.
- Ransomware represented 9% of claims but caused approximately 70% of incurred losses in the sector.
- Resilience found that 17% of cyber claims originated with vendors, compared to 24% in other sectors.
Resilience reported that ransomware incidents accounted for approximately 70% of incurred losses in the energy and utilities sector, despite representing only 9% of total claims filed. The insurer’s analysis of cyber insurance data revealed that email compromise was the most common initial vector, accounting for 21% of claims in the sector between Jan. 1, 2023, and Sept. 5, 2026.
According to Resilience, this 21% figure for email compromise was more than double the 10% rate observed across other sectors in its portfolio. The data indicates that while initial access methods vary, the financial impact of ransomware remains disproportionately high for energy and utilities companies compared to their peers in other industries.
Attack Methods and Control Failures
The report detailed how attackers successfully bypassed existing security controls in several reviewed incidents. Resilience noted that threat actors tricked employees into disclosing passwords and one-time codes on fake login pages. In other cases, attackers hijacked authenticated sessions that were already active, allowing them to move laterally without needing fresh credentials.
Resilience stated that attackers beat controls clients had already switched on, highlighting the effectiveness of social engineering and session hijacking. The insurer emphasized that when a control holds, no claim is filed, meaning insurance data only reflects failures. To understand true risk, organizations must test their defenses against the specific failure modes seen in real claims.
Vendor Risk and Operational Resilience
Vendor-originated incidents accounted for 17% of energy and utilities cyber claims, which is lower than the 24% rate seen across the rest of Resilience’s portfolio. However, ransomware incidents affecting equipment service providers and shared third-party infrastructure still caused significant operational and financial losses for utility companies.
The analysis found that tested backups enabled organizations to recover without paying ransoms. Additionally, network segmentation helped some companies maintain production even when their corporate IT systems were compromised. Resilience cautioned that insurance claims provide an incomplete picture of operational technology risk because intrusions into industrial control systems may go undetected or cause no immediate disruption.
What should you do?
Resilience recommended that organizations test multifactor authentication against social engineering and session hijacking attempts. The insurer also advised verifying backup recovery procedures, checking internet-facing controllers, and assessing whether operations can continue manually if digital systems fail. These steps help ensure that controls will hold when attackers attempt to bypass them.
Resilience noted that an attacker can sit in a control system for months without disrupting anything, leaving no reason to file a claim. This stealthy behavior means that relying solely on incident reports or insurance data may miss persistent threats. Proactive testing and manual operation assessments are critical for identifying gaps before they lead to significant losses.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Resilience
- Test multifactor authentication configurations against social engineering tactics and session hijacking scenarios to ensure they block unauthorized access.
- Verify that backup recovery procedures work by conducting regular restoration tests, ensuring data can be recovered without paying ransoms.
- Check internet-facing controllers for vulnerabilities and ensure they are properly segmented from corporate IT networks to limit lateral movement.
- Assess whether critical operations can continue manually if digital systems are compromised, ensuring business continuity during extended outages.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does the rate of email compromise in the energy sector compare to other sectors?
Email compromise accounted for 21% of claims in the energy and utilities sector, compared to 10% across other sectors in Resilience’s portfolio.
What percentage of losses in the energy sector were caused by ransomware?
Ransomware accounted for about 70% of the sector’s incurred losses, including reserves, despite representing only 9% of claims.
Did any clients file claims related to the 2026 campaign against water utilities?
No, Resilience reported that none of its clients filed a claim tied to the 2026 campaign against water and wastewater utilities.
