A single ransomware crew exploiting a single brand of firewall is now driving nearly half of all cyber insurance claims, according to At-Bay’s 2026 InsurSec Report, which analysed more than 6,500 claims and 100,000 policy years. The report says attackers are now targeting network appliances rather than by industry or company size, with 73% of ransomware attacks beginning with a VPN in 2025.
Akira alone accounted for more than 40% of the claims linked to a single strain, and SonicWall appliances were present in 86% of its attacks, making SonicWall the most-targeted VPN in the dataset. The group’s ransom demands averaged $1.2 million, roughly half again as much as its rivals. Read more at Insurance Business Magazine.