Energy and utilities cyber claims show ransomware drives losses despite low frequency, e-mail compromise far more common than in other sectors

Ransomware accounted for 70% of incurred losses in energy and utilities claims from January 1, 2023, to September 5, 2026, even though it represented only 9% of all claims, according to Resilience’s analysis of cyber-insurance data. Meanwhile, email compromise accounted for 21% of energy claims versus 10% elsewhere. The report, titled Cyber risk in energy and utilities, also found that malware and ransomware appeared more often in energy claims than in other industries.

Resilience found attackers bypassed active security controls by tricking employees into revealing passwords and one-time codes or by hijacking authenticated sessions. In specific cases reviewed, attackers defeated controls that clients had already deployed. One method involved convincing an employee to enter credentials on a fake login page, while another took over a live session that was already authenticated. The report recommends organizations test their controls by simulating attacker tactics and recording the results.

Resilience reported that vendors contributed to 17% of energy and utilities cyber claims, compared to 24% across its broader portfolio. About one-third of these vendor-related claims involved HR, payroll, benefits, or accounting firms, while others included engineering, brokerage, energy-services, billing, payments, IT, and web-hosting providers. One client lost income after ransomware hit a vendor operating its equipment, and a single incident at a shared service generated claims from two utility clients. The report advises organizations to verify vendor access scopes, assess revenue risks during vendor downtime, and confirm whether vendors hold customer data—and if so, what data they store, where it flows, and how they would notify customers after a breach.

Resilience reported that the 2026 water utility campaign further illustrates operational technology vulnerabilities. By July 30, 2026, water and wastewater utilities in at least seven states had reported incidents to the FBI, with attackers changing controller IP addresses and passwords in some cases, leaving operators without visibility or control. At least one organization detected modified controller project files after spotting discrepancies in ladder logic (the programming used on controllers) across sites. Separately, Minnesota IT Services reported a coordinated OT attack on more than 30 community water systems on July 26 and 27, 2026, though the state agency did not attribute the incident to any actor.

It remains unclear whether this attack connects to the FBI’s reporting.

Federal agencies have repeatedly warned of operational technology risks. In late November 2023, CISA flagged attackers exploiting internet-exposed controllers in water and wastewater systems, noting devices still used default passwords. An April 2026 joint advisory from the FBI, CISA, NSA, EPA, the Department of Energy, and US Cyber Command’s Cyber National Mission Force expanded these warnings to include energy facilities and government sites, later widening the scope to three controller manufacturers by July 22, 2026. The FBI also observed that third parties had set up victims’ networks similarly, potentially enabling attackers to replicate successes across customers.

Resilience cautioned that claims data provides an incomplete picture of operational technology risk. Control-system intrusions may go undetected or cause no immediate disruption, meaning they rarely trigger insurance claims. For example, an intruder who accesses a controller and waits without demanding a ransom or encrypting data leaves no trace in claims records. Similarly, espionage actors can remain inside a utility for months without triggering a filing obligation if actors take no regulated personal data.

The report’s Risk Operations Center independently reached the conclusion that claims data undercounts operational technology risk.

Resilience recommends organizations inventory internet-facing assets, compare controller logic against known-good baselines, and monitor for unauthorized remote changes to devices. For multifactor authentication, they should identify which factor types their systems accept and how they handle authenticated sessions, while also checking for applications that fall back to weaker authentication. Legacy mail protocols like IMAP and POP should be reviewed to ensure they require MFA, and users should not grant third-party apps mailbox access without oversight. Backups must be offsite, immutable, and tested from copies attackers cannot access or delete.

Resilience advises organizations to identify third parties their peers depend on and assess whether a single event could disrupt entities. Practicing manual operation of operational technology systems, as recommended by the FBI and EPA, can help maintain resilience.

Cyfirma’s first-quarter 2026 report found that ransomware cartels Qilin and Akira drew 3.4% and 4.8% of their victims from energy and utilities, respectively, characterizing the targeting as opportunistic. Meanwhile, tested backups and network segmentation proved effective in some cases, allowing organizations to recover without paying ransoms and keep production running despite corporate IT compromises. Resilience’s report emphasizes that organizations should assume full corporate IT compromise and verify whether operational systems—including engineering workstations and vendor remote access routes—remain functional.