Double Extortion Is Now the Default: 70% of Ransomware Claims Involve Stolen Data First

The ransomware business has evolved past the simple model of "encrypt your files, demand payment." Today's dominant model is double extortion: the attackers steal your data before they encrypt anything, then threaten to publish it unless you pay. According to Insurance Business America, reporting on Coalition's 2026 Cyber Claims Report, double-extortion ransomware accounted for 70 percent of ransomware claims in 2025.

For an insurance agency, that shift changes the math entirely. Encryption is a recoverable event — you restore from backups and move on. Data exfiltration is not. Once your policyholders' PHI, SSNs, and financial details are on a leak site, the damage is permanent, the notification obligations are mandatory, and the regulatory exposure is immediate.

Why Backups Are No Longer Enough

For a decade, the standard advice was "back up your data and you'll survive ransomware." That advice is now incomplete. If the attacker has already copied your data, a clean backup only protects you from the encryption demand — it does nothing to stop the publication threat. A backup strategy without a data-protection strategy is a half-measure.

The platforms that survive double extortion are the ones that make the exfiltration itself difficult: encryption at rest, strict access controls, tenant isolation, and audit logging that detects unusual bulk export before it completes. Kaffeine's security architecture is built around exactly those controls — not because encryption is exotic, but because it's the only control that keeps stolen data from being usable.

The Insurance Agency's Specific Exposure

Insurance agencies are unusually exposed to double extortion because their CRM is a single system that concentrates the most sensitive data in the organization: client PHI, producer credentials, commission records, and carrier appointment details. A platform with weak segmentation turns one compromised producer account into a full-book exfiltration event — which is why our feature set treats tenant isolation as a security control, not a configuration option.

The Coalition data tells the rest of the story: organizations that paid a ransom were frequently targeted again, often by the same actor. Payment doesn't end your exposure; it confirms it. NAIC guidance notes that nearly 80 percent of organizations that paid a ransom were hit again.

What to Demand From Your Platform

If your CRM vendor can't answer "how would you detect and stop a bulk export of my data?" you're carrying double-extortion exposure you can't see. The right answer combines:

• Encryption at rest so stolen files are unreadable without keys
• Row-level security so one compromised user only reaches their own records
• Audit logging that flags anomalous export volumes in real time
• Tenant isolation so a breach of another customer never reaches you

The Takeaway

Ransomware is no longer just an availability problem — it's a confidentiality problem with no recovery path. Treat your insurance CRM as the most sensitive data store in your business, because that's exactly how the extortion groups treat it. Defense-grade security is the only architecture that meaningfully reduces double-extortion risk, and it's the standard Kaffeine was built to meet.

— G. David Humphries, Kaffeine Security