The Ransomware Feedback Loop: How Insurance Makes Cybercrime More Profitable

Cyberattacks are no longer rare—they’re routine. In 2021, ransom payments hit $812 million worldwide, and businesses still face massive downtime and damage to their reputation after an attack. The problem isn’t just growing; it’s being shaped by financial incentives. A key part of that is cyberinsurance. As more companies buy coverage, attackers see it as a signal

Now, a large share of ransomware attacks result in insurers stepping in to pay. In the UK, nearly 82% of ransomware incidents end with a payout. Attackers don’t just want data—they want money, and insurance makes that money easier to get. They’ve even started publicly revealing what they’ve stolen, using shame and exposure to push victims into paying. This isn’t just about breaking into systems anymore. It’s about creating pressure, making it harder for victims to resist.

How the Ransomware Cycle Is Being Reinforced

• Insurance Fuels Attack Demand: Criminals are increasingly targeting businesses with cyberinsurance. These organizations are seen as easier targets because they’re more likely to pay. The more coverage available, the more attacks follow.
• Attackers Are Using Public Shaming to Force Payments: Beyond direct ransom demands, hackers are now leaking data and naming companies publicly. This tactic puts pressure on victims to pay up, especially when the cost of exposure is high.
• Ransomware Tools Are Now Easy to Access: Tools that once required deep technical skills are now available for rent on dark web marketplaces. A 2020 attack on Twitter by teens—where they made over $100,000—shows how even inexperienced actors can profit from these tools.
• Insurance Policies Often Skip Real Risk Checks: Many policies don’t properly assess a company’s security before offering coverage. That means organizations may be insured despite having weak defenses, making them both vulnerable and financially incentivized to stay that way.

The cycle isn’t just about attacks. It’s about how money flows through the system—making cybercrime more accessible and more profitable. Without better oversight and stronger prevention, the feedback loop will only grow stronger.

We need businesses to stop treating cyberinsurance as a shield and start seeing it as part of a broader, more responsible security strategy.