Estimated reading time: 9 minutes
Ransomware crews could use AI to find new ways in. Most haven’t needed to, says Travelers’ Lauren Winchester. Vulnerable VPNs and cheap access from brokers still work. Cyber Insurance News sat down with her after she moderated a panel on the year’s threats.
Lauren Winchester leads Cyber Risk Services at Travelers. She moderated “No Standing Still: Cyber Threats Stride Ahead” at the Zywave Cyber Risk Conference in New York last week. Afterward, she talked through what the panel raised and where the threat is heading.
Her read on the attackers is blunt. “The ecosystem right now is still sadly working quite well for them,” she said.
The panel brought together four people who see attacks up close:
- Ashim Kapur, Managing Director at LevelBlue.
- Jill Burkholder, Global Services Business Development at CrowdStrike.
- Don Wyper, Co-Founder, COO and Head of Threat Actor Negotiations at Chaintrax Cyber.
- Gwenn Cujdik, North American Incident Response and Cyber Services Lead at AXA XL.
Travelers and AXA XL sell cyber insurance. LevelBlue and CrowdStrike sell security and incident response. Chaintrax negotiates with attackers on behalf of victims.
Ransomware Groups Hit A Record. The Criminals May Not Have.
Winchester opened the panel with Travelers’ own count. In the second quarter, 2,274 victims appeared on ransomware leak sites. That is down about 5% from the first quarter. It is up 53% from a year earlier, according to Travelers’ Q2 2026 Cyber Threat Report. A record 89 groups were active, up from 84. She told the room the next quarter’s figure is higher still.
More groups does not necessarily mean more criminals, Winchester said. The count “is more indicative of fracturing and just, you know, rebranding and possibly some more developers,” she said. “But I don’t know that it’s necessarily net new individuals to the ecosystem.”
Travelers’ numbers point the same way. Twenty groups posted victims for the first time in the second quarter. Another 21 that were active in the first quarter went quiet. The three busiest groups held about 31% of postings, down from 37% a year earlier.
AI makes the churn easier. Experienced operators already know how to build the infrastructure, Winchester said. “They have AI and other tools to be able to spin up new instances of it,” she said. They can rebrand when they need to.
Not everyone reads the count the same way. Kroll’s Max Henderson told Cyber Insurance News that AI is letting lone attackers run extortion on their own. Both trends can run at once.
Trust And Ransomware
Trust between criminals is eroding too, Wyper said. One group, The Gentlemen, first appeared in September 2025. It “at one time” offered affiliates a “ninety percent payout,” he said. Other groups typically paid 75% or 80%. He pointed to BlackCat as a warning. The group shut down in 2024 after Change Healthcare paid a $22 million ransom. The affiliate behind the attack never got its share. “The trust is starting to fail,” he said.
Asked whether law enforcement takedowns deter attackers, Kapur said, “I don’t think so.” If they did, he said, there wouldn’t be so many more groups and victims. Burkholder said takedowns still help victims. They can yield decryptors and information to share with the wider community, she said.
Why The Old Ways In Still Work
Winchester sees no rush toward fully autonomous attacks. “The tried and true techniques are still working extremely well for threat actors in the space,” she said. “So they haven’t been fast adopters of autonomous attacks from end to end because what they have is easy enough; it’s working.”
Why chase a zero-day with frontier AI? Attackers still have “plenty of VPNs that are still vulnerable,” she said.
Many attackers don’t break in at all. They buy their way in. “They just need to buy the access,” Winchester said. “The access is cheap relative to what they ultimately get when they extort the company.”
The skill levels vary widely. Ransomware-as-a-service tools serve everyone “from the script kiddies” up to skilled operators, she said. Nation-state actors are a different breed. They aim “to gain entry, to hide, to learn, to steal,” she said. On the insurance side, the financially motivated crews dominate.
AI will still change the game, Winchester said. Attackers will use AI in different parts of an attack to work faster and hit more companies, she said.
The Playbook – Ain’t Broke Don’t Fix
On the panel, Burkholder put it plainly. “What hasn’t changed is the playbook still works, especially when we talk about initial access,” she said. She listed edge devices, social engineering, misconfigurations, and identity mismanagement. Speed and volume have changed, she said. CrowdStrike’s 2026 Global Threat Report put average breakout time at 29 minutes. That is how long attackers take to move from the first system they reach to others.
Multi-factor authentication is no longer the gap it was. In “over 90% of the cases that we see, clients have MFA enabled,” Kapur said. Attackers now get around it with stolen session tokens and phishing, he said. CINI covered one of those methods in The MFA Box Is Ticked. Attackers Walk Through It Anyway.
Business email compromise is climbing with it. Travelers’ BEC claims ran 57% higher in the first half of 2026 than a year earlier, its report says.
Paying To Keep Stolen Data Quiet
Encryption is fading from many attacks. “About 40% of our cases, it’s purely data exfil,” Kapur said. He pointed to speed and convenience. “We see more and more organizations actually paying for data suppression,” he said.
Victims who didn’t need a decryptor had stopped paying to keep data quiet, Wyper said. Cases ending in payment fell to 20% to 30%. “This year it’s probably gone up,” he said. Attackers can tell victims care again about being posted, he said.
Law firms are a target, Wyper said. Their contact details and photos sit on firm websites. Attackers aim at partners who may be less tech-savvy, he said. The data at stake can be worth far more than its size. Wyper described a firm that lost only three gigabytes. The files involved a client worth millions to the firm.
“Every single one is going to go into a class action suit now,” Cujdik said. For some victims, that is not the main worry. “If the data is IP information for your company or the IP information that you hold for a business partner, class action is the least of your worries,” she said.
Wyper’s advice is to negotiate hard. Paying too easily teaches attackers to ask for more, he said. Travelers’ Matt Butler explained on the CINI podcast how AI chatbots in negotiations squeeze victims’ time to think.
When The Threats Leave The Screen
Leaked chats from the Luna Moth group, also known as Silent, alarmed the panel. Winchester said they showed a cluster of younger attackers “talking in immature ways and increasingly violent ways.”
“Some of the tactics that they’re using are bleeding into the physical world,” she said. That includes threats against law firms, such as “I’m sending someone into your law firm.” Many of these attackers are not in the United States. The worry is that they will recruit people in the US. Those recruits could “go deliver that message or do that bad thing,” she said.
Cujdik said bomb threats can no longer be dismissed. “You can’t trust that it’s not going to actually happen,” she said.
Winchester urged perspective. The behavior is “luckily not prevalent among the larger groups of ransomware,” she said. “I wouldn’t want folks to worry that this is so prevalent and pervasive. It’s just a trend that we certainly wouldn’t want to see grow.”
Water Systems And Default Passwords
The panel also turned to state-backed attacks. Burkholder worked at CISA before joining CrowdStrike. She said Iranian-affiliated groups targeted programmable logic controllers in US critical infrastructure this year. Water systems drew the most attention. The devices are “public facing, they have default credentials, and there’s no MFA on them,” she said.
Water is hard to defend because it is so fragmented, she said. She cited an EPA count of about 150,000 public water systems. Many serve small communities.
Default credentials are not just a water problem. Symphion’s Jim LaRoe made the same case about office printers on the CINI podcast.
What Will Drive Cyber Losses In 2027
The audience voted on 2027’s biggest loss driver. Business email compromise with AI impersonation led the poll as the panel wrapped up.
Burkholder expects “extortion at scale.” Encryption is something companies can be resilient against, she said. Data theft at scale is harder.
Wyper flagged a newer problem. He described “non-consensual pen tests,” in which security start-ups set AI agents loose on company websites and systems without permission. The start-ups then call the companies to say what their agents got. “You’re probably gonna have to deal with all these agents,” he said.
FAQ – Ransomware Groups
How many ransomware groups are active in 2026?
Travelers counted a record 89 active groups in Q2 2026, up from 84 in Q1. Twenty were new and 21 from the prior quarter went quiet.
Does a rise in ransomware groups mean more criminals?
Not necessarily, says Travelers’ Lauren Winchester. She sees the rise as fracturing and rebranding among existing operators, possibly with some new developers.
Are ransomware attackers using AI to break in?
Mostly not yet, Winchester says. Vulnerable VPNs and cheap access from brokers still work. She expects attackers to use AI to make parts of their attacks more efficient.
What is paying for data suppression?
Victims pay attackers to keep stolen data off leak sites. Panelists at the Zywave Cyber Risk Conference said more organizations are paying for it this year.
How much have business email compromise claims risen?
Travelers says BEC claims in the first half of 2026 ran 57% higher than in the same period of 2025.
Why are law firms being targeted?
Law firms hold sensitive client data, and their partners’ contact details are public. Panelists said some groups are focusing on them and making physical threats.
Related Cyber Insurance Posts
- Every Month This Year Has Brought More Attacks, Kroll’s Incident Chief Says. He Sees No Peak Yet.
- Most Small Firms Still Don’t Buy Cyber Cover. The Lloyd’s Market Is Writing Them A Simpler Policy.
- Travelers Flags Shadow AI as the Cyber Risk Already Inside the Building(Opens in a new browser tab)
- Travelers Launches Cyber Risk Services to Support Policyholders(Opens in a new browser tab)
- Travelers Flags Shadow AI as the Cyber Risk Already Inside the Building(Opens in a new browser tab)