Why ransomware remains a growing risk for corporate leadership
In the latter part of 2025, major cyber insurance carriers released publications emphasizing that cyber events remain the top executive risk for crippling business operations. Many note the rapid adoption of AI technology by employers across corporate departments, an aggregation of protected personal information and more confidential data on centralized internal systems. These changes can make large public companies especially susceptible to ransomware attacks that are increasingly weaponizing AI to exploit system vulnerabilities and steal sensitive data in exchange for large sums of money.
The threat of faster, more severe ransomware attacks should be of particular concern for corporate officers. In 2024 alone, just three data breach-related securities class actions implicating directors and officers (D&O) rank among the largest settlements, totaling $560 million.
Even as the risk gap for ransomware attacks continues to widen, the perceived preparedness of D&Os in the United States stands at 83%, creating a potentially false sense of security. These statistics emerge at a time when board-level accountability is being increasingly scrutinized by regulators following high-severity cyber incidents, including ransomware attacks.
In 2025, the Securities and Exchange Commission charged Ashford Inc. with making materially false and misleading disclosures after a threat actor accessed the company’s servers and exfiltrated more than 12 terabytes of data, including sensitive hotel guest information. The investigation resulted in a settlement, with the asset management company paying a significant civil penalty. Cases like this highlight the increased regulatory exposure companies face even as they attempt to recover from ransomware attacks.
How ransomware attacks are evolving in 2026
Ransomware attacks have become more sophisticated as companies implement more sophisticated controls and recovery strategies. Traditional ransomware relied solely on encrypting files and demanding payment for decryption keys. However, over the past few years, attackers have significantly evolved their tactics, introducing multi-layered threats that combine encryption with data theft – and even broader targeting. Regulatory experts have delineated three stages of ransomware attacks that are now commonly used.
Phase 1: Encryption and operational disruption
Threat actors carefully research and select their victims. Attackers then deploy ransomware malware to encrypt files and systems, rendering core systems unusable and disrupting corporate operations.
Phase 2: Data theft and extortion
Threat actors steal sensitive data belonging to employees and customers, as well as confidential business information and threaten its release if ransom demands are not met.
Phase 3: Stakeholder pressure and public disclosure threat
Threat actors escalate pressure by directly contacting external stakeholders, such as customers and vendors, and threatening disclosure of stolen data to force quicker ransom payments from the victimized corporation.
The rise of extortion-only ransomware attacks
It is the third phase that has become more common over the recent months. Many attackers now even skip encryption entirely – exfiltrating data and threatening leaks and contacting key stakeholders to extract payments. These “pure extortion” attacks are cheaper and faster – often leaving minimal forensic evidence. Reports stated that the number of extortion-only attacks doubled this year to around 6% of all incidents, and encryption-only attacks only dropped to 50%.
Why cyber insurers are paying closer attention to ransomware exposure
Cyber insurers emphasize that time is of the essence, as ransomware attacks increased by 132% in the first quarter of 2025. They see cyber events becoming more prevalent but also resulting in longer periods of disruption. Many threat actors now have the capability to shut down entire systems, significantly increasing their leverage when demanding ransom payments. In the United States, ransomware accounted for 72% of cyber claim dollars in 2024.
Risk management practices that can help reduce ransomware exposure
U.S. government agencies, including the FBI, NSA, and CISA, have issued guidance that includes the following recommendations:
- Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups before proceeding with system restoration procedures
- Enforce an additional layer of multifactor authentication for accounts with privileged access
- Identify and patch known vulnerabilities before threat actors can exploit them
- Adopt a formal, dedicated incident response plan for ransomware attacks. [#StopRansomware Guide – CISA]
What corporate leaders can take away from current ransomware trends
The increasing risk and severity of ransomware attacks against corporate entities pose a material threat that the C-suite should actively address. Litigation exposure stemming from these cyber events is more significant, as decisions made by directors and officers following a cyber incident will inevitably be subject to heightened scrutiny. If the trends identified in insurance carrier reports persist, cyber risk is likely to remain a top concern for executives in the coming years. As AI changes risk dynamics, directors and officers must stay current with the means to protect their companies with technology, processes and risk transfer.
