Resilience’s analysis of cyber insurance claims in the energy and utilities sector found that email compromise accounted for 21% of claims filed between Jan. 1, 2023, and Sept. 5, 2026, compared with 10% across other sectors in its portfolio. Ransomware accounted for about 70% of the sector’s incurred losses, including reserves, despite representing 9% of claims. The report found that attackers bypassed existing security controls in several incidents, including by tricking employees into disclosing passwords and one-time codes or hijacking authenticated sessions.
In its report titled ‘Cyber risk in energy and utilities,’ Resilience detailed that 17% of energy and utilities cyber claims originated with vendors, compared with 24% across the rest of Resilience’s portfolio, while ransomware incidents affecting equipment service providers and shared third-party infrastructure caused operational and financial losses. In reviewed cases, tested backups enabled organizations to recover without paying ransoms, while network segmentation helped some companies maintain production despite corporate IT compromises.
Resilience cautioned that insurance claims provide an incomplete picture of operational technology risk because intrusions into industrial control systems may go undetected or cause no immediate disruption. The report recommends testing multifactor authentication against social engineering and session hijacking, verifying backup recovery, checking internet-facing controllers, and assessing whether operations can continue manually.
“In the specific cases we took a look at, attackers beat controls clients had already switched on. One talked an employee into entering a password and a one-time code on a fake login page,” Resilience reported. “Another took over a live session that was already authenticated. Clients with recently tested backups recovered without paying, and clients who had separated their operational systems from corporate IT kept production running. None of our clients has filed a claim tied to the 2026 campaign against water and wastewater utilities. An attacker can also sit in a control system for months without disrupting anything, and then nobody has a reason to file a claim.”
It added, “When a control holds, nobody files a claim, so claims can’t tell you how often that happens. But when a claim does come in, we can usually see what failed. To find out whether your controls will hold, test them against the failures we see in real claims. Use the multifactor authentication (MFA) workarounds that show up in our claims, try to restore files from a backup an attacker couldn’t have reached, and for operational systems, check that no controller is reachable from the internet and see how long you can keep operations running manually. And ask each vendor what it would cost you if it went down or got breached. For one that runs or maintains your equipment, start with your revenue.”
Email compromise, malware, and ransomware each make up a larger share of energy claims than of claims across the rest of the portfolio. Energy sector cyber risk, as measured here, covers oil and energy, utilities, and renewables accounts together.
Email compromise shows the largest gap in the loss mix, at 21% of energy account claims compared to 10% elsewhere, a difference of 11 points. Malware is a small share in both segments, but energy’s is five points higher, at 7% compared to 2%. The gap is smallest for ransomware, at 9% compared to 6%. Yet when weighted by dollars across all claims on record, email compromise accounts for only 2% of energy’s incurred losses including reserves, compared to 4% for the rest of the portfolio.
In several email compromise claims reviewed, attackers worked around MFA that was already switched on, largely through social engineering. In the ransomware claims, recently tested immutable backups let clients recover without paying, and in two cases segmentation kept production running.
Vendor incidents account for a smaller share of energy’s claims. In 17% of energy claims, the incident started at a vendor, compared to 24% across the rest of the portfolio. About a third of those vendors were HR, payroll, benefits, or accounting firms, while the rest included engineering, brokerage, energy-services, billing, payments, IT, and web-hosting providers. In one claim, a client lost income when ransomware hit the vendor that operated its equipment, and a single incident at a shared service produced claims from two utility clients.
None of the energy claims involve control system manipulation, including those from water and wastewater utility clients, even as attackers in the 2026 campaign hit utilities in at least seven states. Anyone sizing operational technology risk from claims data is working from an undercount, so clients need to test their controls directly.
“In several intrusions, MFA was switched on and working, so attackers targeted an employee or a session instead. One attacker talked an employee into entering a password and a one-time code on a fake page they controlled, and captured both at once,” Resilience reported. “Another hijacked a session that had already passed the MFA check and used it to register a new MFA method of their own, so they could sign back in later. Ransomware makes up about 70% of energy’s incurred losses, and the ransomware claims show a mixed record on controls.”
At two companies, clients had recent backups they had tested and found clean, so they had little reason to pay, and they recovered from those copies. In one claim, ransomware reached supervisory control and data acquisition (SCADA), knocked out communications, and left the client without visibility over equipment that was still physically running. In the other two cases, the operational systems ran on a separate, segmented network the attacker never reached, so production carried on through an IT compromise.
Resilience noted that attackers in the 2026 water utility campaign used the same basic mechanism seen in large mass-victim software breaches, with exposed controllers in place of servers. In 2023, a flaw in one widely deployed file transfer product let unauthenticated attackers reach its database at any organization running an affected version, and the company’s own vendor claims from that single event span unrelated clients in unrelated sectors. When many organizations run the same product, attackers can exploit one flaw at many of them at once. The company’s Risk Operations Center has been tracking a campaign against water and wastewater utilities that follows this pattern, with attackers compromising utilities across the sector through the same exposed equipment and similar third-party network setups.
By July 30, 2026, water and wastewater utilities in at least seven states had reported incidents to the FBI, and in some cases attackers disrupted water operations. They reached controllers exposed directly to the public internet and changed their IP addresses and passwords, leaving operators without a view of connected equipment and sometimes without control of it.
At least one organization found modified controller project files after noticing discrepancies in ladder logic across several sites. How much an attacker could do depended on what the controller ran and whether the utility could fall back on manual operation. The FBI noted that third parties had set up several victims’ networks in similar ways, which may let an attacker who succeeds at one customer repeat it at others. Separately, Minnesota IT Services reported a coordinated attack on operational technology at more than 30 community water systems on July 26 and 27, 2026, without attributing it to any actor, and it is unknown whether that attack is part of the activity in the FBI’s reporting.
Federal agencies have warned of the same pattern before. CISA flagged it in late November 2023, when attackers were exploiting one manufacturer’s controller line in water and wastewater systems and reaching internet-exposed devices that still used the default password. In April 2026, six federal agencies (the FBI, CISA, NSA, EPA, the Department of Energy, and US Cyber Command’s Cyber National Mission Force) issued a joint advisory that Iranian-affiliated actors were exploiting internet-exposed controllers at water and wastewater systems, energy facilities, and government sites, and on July 22, 2026, they widened it from one manufacturer’s controllers to three. Despite this activity, none of the claims from the company’s utilities clients, which include water and wastewater utilities, involve control system manipulation.
Another interesting finding in the Resilience report is that control system attacks rarely generate insurance claims, because claims data only captures events reported under a cyber policy. An attacker who gets onto a controller and waits makes no ransom demand and encrypts nothing. If no regulated personal data is taken, the utility also has no notification obligation. An intruder running an espionage operation can sit inside a utility for months, however serious the breach, and leave nothing for anyone to file.
On the IT side, claims show clearly where the money goes: ransomware makes up about 70% of energy’s incurred losses. Threat intelligence firm Cyfirma’s first-quarter 2026 energy and utilities report found that the two most active ransomware groups in the sector, Qilin and Akira, drew only 3.4% and 4.8% of their victims from energy and utilities, a pattern Cyfirma reads as opportunistic targeting.
Anyone sizing OT risk from claims data, whether Resilience’s or any other portfolio’s, is therefore working from an undercount. Resilience’s Risk Operations Center reached the same conclusion independently of the claims review.
Organizations should test a control by trying to beat it the way an attacker would and recording what happens. For MFA, that means knowing which factor types an implementation accepts and how systems treat a session that is already authenticated. Each failure point seen in the claims can be tested. An attacker can talk a staff member into entering a one-time code on a lookalike page, or use a stolen session token to get past a login that never reprompts. A person using an already signed-in account can often register a new MFA method, and so can a help desk agent following a reset script.
Attackers can relay push approvals and one-time codes but struggle to relay phishing-resistant factors, so organizations should find out which applications still fall back to weaker ones. They should also check whether older mail protocols such as IMAP and POP still accept a password without MFA, and whether users can grant third-party apps mailbox access without review.
Backups and segmentation deserve the same scrutiny. Organizations should restore from a copy that an attacker holding domain credentials could not have reached or deleted, under conditions close to a live incident. The copy needs to be offsite and immutable, because a backup an attacker can reach can be encrypted along with everything else. They should then assume corporate IT is fully compromised and watch whether operational systems keep running, including the paths people reach for under pressure, such as the engineering workstation, the vendor’s remote access route, and the shared credential kept so someone can fix things at two in the morning.
Vendor questions should depend on what the vendor does. A vendor that holds data should be able to say what data it has, where that data goes, and how it would notify the customer of a compromise. For a vendor that operates or maintains equipment, organizations should establish how much revenue they lose while the vendor is down, how long their own staff can run the equipment without it, and whether the vendor’s access is limited to the job it performs. Many vendors will need to answer both sets of questions. For shared sector infrastructure, organizations should ask which third parties their peers also depend on and whether a single event at one of them has already disrupted several organizations at once. They should also practice running operational systems manually, as the FBI and EPA recommend.
As claims cannot show whether an attacker is already inside control networks, organizations need to look there directly. That means inventorying what is reachable from the public internet and comparing controller logic against a known-good baseline, which is how the organization in the FBI and EPA reporting caught its modified project files. Configuration and credential changes on devices nobody should be touching remotely are also worth watching.
Several failures in these claims involved controls the client had already deployed, and a controls inventory would have listed them as in place. The takeaway is to ask when a team last watched one of its controls fail under test, and whether anybody was in the room.
