One ransomware crew now drives half of all cyber claims: At-Bay

Threat Overview

A single ransomware operation targeting one specific firewall brand now accounts for nearly half of all cyber insurance claims according to At-Bay's 2026 InsurSec Report, which analyzed over 6,500 claims and 100,000 policies. This unprecedented concentration of attack activity signals a fundamental shift in the threat landscape for healthcare practices. When one exploit path becomes this dominant, the window for remediation narrows dramatically — attackers are industrializing their operations, and every practice using the affected firewall technology is now a stationary target. The report's findings reframe cyber risk from a broad, diffuse threat into a highly concentrated vulnerability that can be specifically identified and mitigated.

Attack Vector & Tactics

While the report does not specify which firewall vendor is under siege, the attack pattern is clear: adversaries are exploiting a known vulnerability at scale, moving laterally across thousands of targets using identical tactics. This industrialized approach reflects modern ransomware economics — crews concentrate resources on a single high-value exploit rather than distributing effort across multiple attack vectors. For healthcare practices, this means perimeter defenses are being systematically probed for this specific vulnerability. Practices using the affected firewall technology are facing elevated risk regardless of their other security measures, creating what insurers now recognize as a binary risk profile: you either have the vulnerable equipment or you don't.

Defense Measures

Practices must immediately audit all network security appliances to identify the affected firewall brand and verify patch status. If patching is not immediately possible, implement compensating controls: deploy secondary network segmentation to isolate critical ePHI systems, enable aggressive firewall logging to detect reconnaissance activity, and establish out-of-band backup verification processes. Verify vendor BAAs explicitly cover security update response times — delays in patch deployment create exposure windows measured in hours, not weeks. Test incident response procedures specifically for perimeter compromise scenarios, and confirm backup systems can be restored without network access. This is not a theoretical drill — half of all claims in the dataset trace to this single exploit chain.

What This Means for Your Practice

The concentration of claims around one vulnerability exposes a critical truth: compliance documentation does not equal operational security. Many practices assume their compliance vendor's annual risk assessment and policy binder provide protection — they don't. The practices filing claims likely had compliant documentation. What they lacked was continuous security monitoring, real-time vulnerability tracking, and automated threat response. Cyber insurance underwriters are now recalculating risk based on specific security posture, not just compliance checkboxes. Practices that cannot demonstrate active security controls — not just policies about security controls — will face higher premiums or coverage exclusions. The breach cost average remains $9.8M according to IBM Security's 2024 report, and the 258-day average breach lifecycle means most practices discover compromise long after attackers have entrenched.