Summary Points
-
Email compromise is disproportionately common: It caused 21% of energy and utilities claims, versus 10% across other sectors; attackers sometimes bypassed MFA through phishing or hijacked sessions.
-
Ransomware drives the biggest financial losses: Though only 9% of sector claims, it accounted for about 70% of incurred losses. Tested backups enabled recovery without ransom payments, while network segmentation helped keep some production running.
-
Vendor claims are less frequent, but can have broad effects: Vendors initiated 17% of energy-sector claims, versus 24% elsewhere; incidents at equipment providers and shared services caused operational and financial disruption.
- Claims understate operational-technology risk: No reviewed utility claims involved control-system manipulation, despite reported attacks on exposed controllers. Resilience urges organizations to test MFA, backup recovery, internet exposure, segmentation, and manual operating procedures.
The Core Issue
Resilience’s analysis of cyber insurance claims in oil and energy, utilities, and renewables found that email compromise made up 21% of energy-sector claims filed from Jan. 1, 2023, to Sept. 5, 2026—more than twice the 10% share across other sectors. Ransomware represented only 9% of energy claims, yet caused about 70% of incurred losses, including reserves. In reviewed incidents, attackers bypassed security measures by tricking employees into revealing passwords and one-time codes or hijacking authenticated sessions. Vendors were the starting point for 17% of energy claims, and attacks on equipment providers and shared services sometimes disrupted operations.
However, Resilience cautioned that insurance claims reveal only part of the threat. Its clients had filed no claims involving control-system manipulation, despite reported 2026 attacks on water and wastewater utilities in at least seven states. Such intrusions may go undetected or cause no immediate disruption, so they may never generate a claim. Tested backups helped some organizations recover without paying ransoms, while network segmentation kept production running at others. Resilience therefore urged energy organizations to test MFA against social engineering and session theft, verify backup recovery, inspect internet-facing controllers, assess vendor dependencies, and practice operating equipment manually. The findings were reported by Resilience and covered by Industrial Cyber.
What’s at Stake?
Resilience’s warning about rising ransomware and vulnerable operational technology (OT) is not limited to energy and utilities; it can reach any business that relies on connected equipment, building systems, or third-party services. A compromised system can halt production, interrupt customer service, or expose sensitive data. If the attack spreads to physical operations, it may also create safety risks. Meanwhile, lost revenue, recovery costs, regulatory scrutiny, and damaged trust can compound the disruption. In short, a cyber incident can become a business-wide crisis—even when the initial weakness lies in one overlooked device or supplier.
Possible Next Steps
Timely remediation is essential to contain ransomware, reduce exposure in vulnerable operational technology (OT), and protect reliable, safe service.
Priority Actions
- Prioritize risk: Inventory IT and OT assets, identify internet-facing and unsupported systems, and rank vulnerabilities by exploitability, operational impact, and safety consequences.
- Patch safely: Test security updates in representative environments, then deploy them through controlled OT change windows. Where patching is unsafe or unsupported, restrict access, disable unnecessary services, and apply other compensating controls.
- Segment networks: Separate business IT, industrial control systems, and critical OT zones; tightly control traffic between them and remove direct internet access where it is not essential.
- Harden access: Require multifactor authentication for remote and privileged accounts, limit permissions, remove dormant accounts, and supervise vendor access with time-bound approvals.
- Strengthen recovery: Maintain encrypted, offline or immutable backups of critical configurations and data; regularly test restoration and confirm recovery priorities for essential services.
- Improve detection: Monitor OT and IT networks for unusual access, lateral movement, and changes to control systems. Ensure alerts reach personnel able to respond promptly.
- Prepare response: Maintain and exercise ransomware and OT incident procedures, including isolation decisions, safety coordination, communications, and service restoration.
- Manage suppliers: Assess third-party access and security practices, set clear incident-reporting expectations, and review connections to critical systems.
- Govern progress: Assign remediation owners and deadlines, track overdue high-risk findings, and review outcomes with leadership—supporting the NIST CSF’s Govern, Identify, Protect, Detect, Respond, and Recover functions.
Stay Ahead in Cybersecurity
Discover cutting-edge developments in Emerging Tech and industry Insights.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
