INSIGHTS
Evidence-led analysis for underwriters, brokers, reinsurers, claims professionals and risk managers.
Five cyber events from the week of 7 to 14 November 2026, from Expedia hit through a supplier's data platform to Maersk, the Brenner Base Tunnel, Nitori and Vanderbilt University, linked by peripheral, inherited or outsourced systems. With the insurance impact and the questions to bring to renewals.
Nov 15, 2026
ReadFrom 6 to 12 November 2026 there were 374 ransomware claims on leak sites, 47% above the average of the previous four weeks, and CISA added 11 exploited vulnerabilities to its KEV catalog, including a Barracuda email gateway and the SonicWall VPN. The bulletin covers vulnerabilities, the most active groups and sectors, Italian and European advisories and the questions to put to applicants.
Nov 14, 2026
ReadSince 12 November 2026 a server failure at Microsoft 365 has stopped Outlook, Exchange Online and other services in at least 74 countries, with no sign of an attack. The analysis: why many cyber policies do not trigger, waiting periods and quantification, aggregation on a single supplier and questions for renewals.
Nov 13, 2026
ReadOn 4 November 2026 Crédit Mutuel Arkéa disclosed that attackers who got in through a supplier's platform used the bank's own account to transfer more than 100 million euros, later converted into cryptocurrency. The analysis: loss of funds between crime and cyber policies, aggregation on the supplier, the speed of conversion, controls and questions for renewals.
Nov 11, 2026
ReadFive cyber events from the week of 31 October to 7 November 2026, from the new wave of attacks on European supermarket refrigeration systems to Crédit Mutuel Arkéa, Chainalysis, DigiCert and Queens Public Library, linked by exposed systems and suppliers used as the way in. With the insurance impact and the questions to bring to renewals.
Nov 08, 2026
ReadFrom 30 October to 5 November 2026 there were 277 ransomware claims on leak sites, 21% above the average of the previous four weeks, and CISA added two new Ivanti Connect Secure flaws to its KEV catalog. The bulletin covers exploited vulnerabilities, the most active groups and sectors, Italian and European advisories and the questions to put to applicants.
Nov 06, 2026
ReadOn 29 October 2026 a vendor's monitoring script loaded on Polymarket was replaced and took about 2.7 million dollars from more than 700 accounts. The analysis: which policy responds, aggregation across third-party scripts, controls and the questions to bring to renewals.
Nov 04, 2026
ReadWhat cyber catastrophe risk is, how insurers and reinsurers protect themselves against accumulation and how cyber cat bonds work: triggers, the main issues from 2023 to 2026, pricing, limits and outlook.
Nov 01, 2026
ReadOn 11–12 October 2026 the refrigeration controllers of hundreds of French supermarkets were taken over remotely and heated to about 50 °C. What is known, why it is a typical OT case, how to protect these systems, which policies respond and why the new product liability directive does not apply.
Nov 01, 2026
ReadFive cyber events from the week of 17 to 24 October 2026, four of them linked to the supply chain: PHP2Shell, ConnectWise, LiteLLM and Railway, n0n and Capcom. With the insurance impact and the questions to bring to renewals.
Nov 01, 2026
ReadSix cyber events from the week of 24 to 31 October 2026, from the 6.3 billion dollar theft at Binance to Amadeus, GMO Internet, PHP2Shell, UNM Health and Sony Network Communications, linked by dependence on shared suppliers and platforms. With the insurance impact and the questions to bring to renewals.
Nov 01, 2026
ReadOn 10 September 2026 IDScan, an identity document verification supplier to venues, casinos and dispensaries, confirmed data theft from its cloud systems, while a dark web site was selling more than 153 million driver's licences. The analysis: the invisible supplier, documents that cannot be changed, liability towards customers and questions for renewals.
Sep 30, 2026
ReadOn 29 July 2026 an attack on CEVA Logistics stopped at least eight European warehouses, blocking goods of customers such as Bol, de Bijenkorf and Valve and exposing their customers' data. The analysis: goods stuck in someone else's warehouse, customer data at the supplier, aggregation in logistics and questions for renewals.
Aug 31, 2026
ReadOn 16 July 2026 Hugging Face disclosed that an autonomous AI agent, entering through a malicious dataset, had stolen credentials and internal data with thousands of actions in a few days. The analysis: the automated attacker, the AI supply chain, policy wording on AI and questions for renewals.
Jul 31, 2026
ReadBetween 27 May and 9 June 2026 ShinyHunters exploited an unknown Oracle PeopleSoft vulnerability against more than 100 organisations, two thirds of them universities, stealing personal data including sensitive data. The analysis: the MOVEit pattern for the third time, aggregation in education and questions for renewals.
Jun 30, 2026
ReadBetween late April and early May 2026 ShinyHunters breached Instructure twice, maker of the Canvas platform used by thousands of schools and universities, and on 11 May the company paid to prevent publication of the data. The analysis: paying for extortion alone, one supplier for many insureds and questions for renewals.
May 31, 2026
ReadOn 2 April 2026 CERT-EU attributed to TeamPCP the theft of data from the European Commission's cloud, entered with a key stolen through a compromised version of the open source tool Trivy: at least 30 EU bodies involved. The analysis: the security tool as the way in, shared infrastructure and questions for renewals.
Apr 30, 2026
ReadOn 11 March 2026 an attack claimed by the Iran-linked group Handala remotely wiped thousands of Stryker devices, disrupting orders, shipping and production for nearly a month. The analysis: destruction without ransom, the state and war exclusions, interruption in healthcare and questions for renewals.
Mar 31, 2026
ReadOn 6 February 2026 ransomware stopped the US payment platform BridgePay for at least four days: merchants forced to go cash-only, municipalities and water utilities unable to collect online. The analysis: the hidden supplier, waiting periods and deductibles, aggregation on payments and questions for renewals.
Feb 28, 2026
ReadOn 20 January 2026 an eScan antivirus update server distributed for two hours a malicious program that blocked updates and downloaded more code, hitting hundreds of computers in South Asia. The analysis: the trusted channel, aggregation on a security vendor, who pays and questions for renewals.
Jan 31, 2026
ReadIn December 2025 Denmark attributed to Russia an attack on a waterworks that had burst pipes, ransomware encrypted 1,000 systems at Romania's water authority and a destructive attack hit more than 30 energy plants in Poland. The analysis: physical damage, state-actor exclusions, aggregation and questions for renewals.
Dec 31, 2025
ReadOn 24 November 2025 an attack on the shared IT systems of Kensington and Chelsea, Westminster and Hammersmith and Fulham led to data theft and services still down eight months later. The analysis: one infrastructure for several insureds, the public sector as a long-tail risk and questions for renewals.
Nov 30, 2025
ReadOn 15 October 2025 F5 disclosed that a state actor had stolen portions of BIG-IP source code and information on unpublished vulnerabilities, and CISA issued an emergency directive. The analysis: the theft that prepares the claims, state-actor exclusions, the loss to the vendor and questions for renewals.
Oct 31, 2025
ReadOn 1 September 2025 an attack stopped Jaguar Land Rover's factories for five weeks, with an estimated cost of 1.9 billion pounds to the UK economy and more than 5,000 businesses affected. The analysis: the production outage, the supplier chain, the cost of not being insured and questions for renewals.
Sep 30, 2025
ReadBetween 8 and 18 August 2025 tokens stolen from Salesloft's Drift assistant gave access to the Salesforce data of more than 700 organisations, many of them security vendors. The analysis: OAuth authorisations, secrets in the CRM, aggregation, supplier liability and questions for renewals.
Aug 31, 2025
ReadOn 3 July 2025 ransomware stopped ordering and licence provisioning at Ingram Micro, one of the largest technology distributors, for about six days. The analysis: dependent business interruption for resellers and managed service providers, waiting periods, aggregation in the IT channel and questions for renewals.
Jul 31, 2025
ReadOn 12 June 2025 Aflac contained within hours an intrusion that had already taken health and claims data on 22.65 million people, as Google warned that Scattered Spider had moved to insurance. The analysis: containment and breach, the sector as a target, help desks and agents, questions for renewals.
Jun 30, 2025
ReadIn May 2025 Coinbase disclosed that support staff at an outsourced supplier, paid by criminals, had copied data on tens of thousands of customers, with a 20 million dollar demand refused and 307 million in costs. The analysis: dishonesty at the supplier, voluntary reimbursements, D&O and questions for renewals.
May 31, 2025
ReadIn April 2025 an attack that began with a password reset at an outsourced help desk stopped Marks & Spencer's online orders for 46 days, with an estimated impact of 300 million pounds and cyber cover of up to 100 million. The analysis: limit and loss, the help desk, aggregation by actor and questions for renewals.
Apr 30, 2025
ReadOn 14 and 15 March 2025 the tj-actions/changed-files component, used by more than 23,000 repositories, was altered to print CI/CD secrets into logs; the first target was a Coinbase project. The analysis: costs without theft, the pipeline as a supplier, liability, aggregation and questions for renewals.
Mar 31, 2025
ReadOn 21 February 2025 Bybit lost about 1.5 billion dollars in ether during a transfer from its cold wallet, through a signing interface manipulated at the supplier Safe{Wallet}. The analysis: cyber, crime and custody policies, state attribution and questions for renewals.
Feb 28, 2025
ReadIn January 2025 PowerSchool warned school districts of a data theft affecting tens of millions of students and teachers, which started from a support account. The analysis: supplier privileged access, ransom, notification, lawsuits and questions for renewals.
Jan 31, 2025
ReadIn December 2024 two vulnerabilities in Cleo's file transfer products were exploited at scale by Clop, with hundreds of claimed victims and confirmations such as Hertz and Chicago Public Schools. The analysis: data theft, insufficient patches, aggregation and questions for renewals.
Dec 31, 2024
ReadOn 21 November 2024 ransomware hit Blue Yonder's managed environment, stopping staff pay at Starbucks and fresh-food warehouses at Morrisons. The analysis: dependent business interruption, perishable stock, retail aggregation and questions for renewals.
Nov 30, 2024
ReadOn 22 October 2024 Change Healthcare reported about 100 million notices for February's attack; the final count is 192.7 million. The analysis: concentration, dependent business interruption, notification, ransom and questions for renewals.
Oct 31, 2024
ReadBetween 31 August and 3 September 2024 Scattered Spider broke into Transport for London's network: 148 systems down, 27,000 passwords reset in person, 29 million pounds in costs. The analysis: identity, public services, data, aggregation and questions for renewals.
Sep 30, 2024
Read