Ransomware Losses Climb as AI Pushes Phishing to New Heights

Ransomware remains the main threat to business, with the 2025 Midyear Cyber Risk Report from Resilience noting that phishing has leapt to clear prominence as the most common point of failure, aided by AI. The analysis shows vendor-related risk down from 22% of incurred losses in 2024 to 15% in H1 2025, yet downstream losses for affected firms remain high, and ransomware attacks in H1 2025 increased 73% in Q1 2025.

The report highlights a rapid shift to triple extortion, including data exfiltration and the threat of a DDoS attack, as criminals adapt to fortify their campaigns; it also notes that social engineering accounts for 42% of incurred claims and 88% of incurred losses in the first half of 2025, with AI supercharging several phishing and voice-based attacks.

Cybercriminals are targeting credentials at scale, with 1.8 billion credentials compromised in H1 2025—an 800% rise since January, including over 1 billion corporate and personal email accounts. Threat groups such as Interlock, Chaos, Medusa, Akira, and Nightspire were cited as primary drivers of attacks on the Resilience portfolio in H1 2025, amid a wider ecosystem where AI-enhanced social engineering is reshaping risk.

In a real-world negotiation example, a high‑end real estate firm faced a Chaos ransomware demand of $4 million in February 2025, which Resilience negotiated down to about $615,000 after strategic delay and psychological pressure. 9 September 2025.