Resilience claims analysis: ransomware drives ~70% of energy-sector cyber losses; MFA bypass and exposed OT controllers widen exposure

Linha do tempo

1. industrialcyber.co ↗ · pub. 21/10/2026 09:36 · coletado 21/10 10:01 primeiro registro

   Resilience claims analysis: ransomware drives ~70% of energy-sector cyber losses; MFA bypass and exposed OT controllers widen exposure

   ler a análise desta fonte ocultar

   Resilience's report Cyber risk in energy and utilities analyzes cyber insurance claims filed between Jan. 1, 2023 and Sept. 5, 2026. Email compromise made up 21% of energy and utilities claims, against 10% across the rest of the portfolio. Ransomware was only 9% of claims but about 70% of incurred losses including reserves. In several cases attackers beat MFA that was already enabled, through social engineering or session hijacking. Resilience warns that claims data undercounts OT risk, because intrusions into control systems can go undetected or cause no disruption. It notes that none of its clients has filed a claim tied to the 2026 campaign against water and wastewater utilities.

   Technical Details

   • MFA bypass: one attacker had an employee enter a password and a one-time code on a fake login page and captured both at once. Another hijacked an already authenticated session and used it to register a new MFA method of their own for persistence.
   • Vendor/third-party exposure: 17% of energy claims originated at a vendor, versus 24% elsewhere. About a third of those vendors were HR, payroll, benefits or accounting firms. In one case ransomware at an equipment operator caused a client's income loss, and one shared-service incident produced claims from two utilities.
   • Ransomware and OT: in one claim, ransomware reached SCADA and knocked out communications, leaving the client with no visibility of equipment that was still running. In two other cases segmented OT networks kept production running through an IT compromise. Two clients recovered from tested immutable backups without paying.
   • 2026 water/wastewater campaign: by July 30, 2026, utilities in at least seven states had reported incidents to the FBI. Attackers reached controllers exposed directly to the internet and changed their IP addresses and passwords. At least one organization found modified controller project files after noticing ladder logic discrepancies across sites. The FBI noted that third parties configured several victim networks similarly, so success at one customer may be repeatable at others. Minnesota IT Services separately reported a coordinated OT attack on more than 30 community water systems on July 26-27, 2026, with no attribution and no confirmed link to the FBI's reporting.
   • Prior advisories: CISA warned in Nov. 2023 about exploitation of one manufacturer's controllers using default passwords. In April 2026 six US agencies issued a joint advisory on Iranian-affiliated actors exploiting internet-exposed controllers, widened on July 22, 2026 from one manufacturer's controllers to three.
   • Targeting: Cyfirma's Q1 2026 report found Qilin and Akira drew only 3.4% and 4.8% of their victims from energy and utilities, which it reads as opportunistic targeting.

   Remediation

   • Test MFA against social engineering and session hijacking. Prefer phishing-resistant factors, block legacy IMAP/POP password logins, restrict third-party app mailbox consent, and control MFA method registration, including via help desk resets.
   • Verify restores from offsite, immutable backups that an attacker with domain credentials could not reach.
   • Segment OT from corporate IT and assume IT is fully compromised. Review engineering workstations, vendor remote access and shared credentials.
   • Inventory internet-reachable controllers and remove exposure. Compare controller logic with a known-good baseline and monitor for unexpected configuration or credential changes.
   • Assess vendor dependencies and the revenue impact of vendor downtime. Practice manual operations.