Resilience reveals a "dramatic evolution" in the economics of cybercrime in its 2025 Cyber Risk Report, noting that more than two-thirds of ransomware attacks in the second half of 2025 leveraged data theft rather than encryption. The report, based on claims data from the Resilience Risk Operations Center, shows that extortion demands to suppress stolen data accounted for 65 per cent of all extortion claims in the latter half of the year, up from 49 per cent in the first half. Across the full year, data theft-only attacks represented 57 per cent of all incidents. The shift indicates that threat actors are prioritising long-term leverage over immediate business disruption. Resilience notes that as organisations strengthen backup practices, hackers are bypassing these defences by stealing sensitive information to create a prolonged "reputational and regulatory tail." Financial severity remains concentrated in specific industries. The retail sector saw average claim severity reach US$2.6 million in 2025, while the manufacturing and healthcare sectors also remained primary targets. Vendor risk continues to be a significant factor, with 18.8 per cent of 2025 losses attributed to third-party vulnerabilities. The findings also highlight a surge in wrongful data collection claims, which doubled in 2025 due to aggressive lawsuits regarding non-breach privacy practices. However, the report finds that few of these claims exceeded clients' self-insured retentions. Vishaal Hariprasad, CEO and co-founder of Resilience, says: “2025 was a year of profound change in the cyber landscape. We saw threat actors professionalise their operations, moving away from the 'smash and grab' tactics of the past toward more sophisticated, long-term extortion campaigns. For organisations, this means cyber risk is no longer just a technical hurdle: it is a long-term financial and strategic liability.” Resilience is a cyber risk company that provides risk quantification software, cybersecurity expertise, and insurance solutions. Founded by experts from the United States military and intelligence communities, the firm is headquartered in San Francisco with global operations in London, Dublin, and Toronto.
