One ransomware crew now drives half of all cyber claims: At-Bay

At-Bay’s 2026 InsurSec report, based on more than 6,500 claims and 100,000 policy years, finds ransomware has become infrastructure-driven: 73% of ransomware attacks in 2025 began with a VPN, SonicWall appliances were linked to 27% of claims, and the Akira ransomware group — which used SonicWall in 86% of its attacks — accounted for over 40% of At-Bay’s ransomware claims with average ransom demands of $1.2 million.