Estimated reading time: 8 minutes
Every month this year has brought more attacks than the last, says Kroll’s Max Henderson. Not even the arrest of a ShinyHunters leader slowed it. Encryption is no longer needed, he told Cyber Insurance News. AI has opened extortion to lone attackers.
Max Henderson is Global Head of Digital Forensics and Incident Response at Kroll. His teams arrive on day zero of a breach. “We’re the ones who are effectively trying to get the company back up and running,” he said. Kroll sells incident response. It has a commercial interest in the trend he describes.
Henderson spoke with Cyber Insurance News at the Zywave Cyber Risk Conference in New York on Oct. 29. He joined Kroll from Pondurance and has led more than 1,000 incident response cases, according to Kroll.
“I think in the last six months, this industry has changed more than the last six years combined,” Henderson said. He credits AI, from tools that simply inform attackers to AI that carries out an entire attack.
Ransomware Trends: A Climb With No Peak In Sight
Henderson compared the year to a spin class. Most years bring intervals and flat stretches. “This year’s just been a climb the entire year. Every month is more than the previous month,” he said.
“From what we’re seeing right now on the incident response side, this is an unprecedented level,” he said. Kroll has not yet published its 2026 numbers. Henderson expects them to show “a huge uptick, especially the last few months.”
Arrests have not slowed it. Dutch police arrested an alleged ShinyHunters leader on Sept. 15, Security Affairs reported. A second alleged member was detained in Jordan on Sept. 29, GuidePoint’s research team noted, citing Reuters. Henderson expected a dip after the first arrest. “It did not. It still went up,” he said.
Outside data points the same way. GuidePoint’s research team counted 2,760 victims on ransomware leak sites in the third quarter. That is up 21% from the second quarter and 75% from a year earlier. Active groups reached a record 112. “We still have not hit peak ransomware,” the GRIT report says. GuidePoint sells security services.
Why Encryption Stopped Mattering
Ten years ago, two jobs were hardest in hacking, Henderson said. One was building the encryption malware. The other was laundering the money afterward. Laundering is still hard. Encryption is now optional.
“We’re talking about ransomware, encryption is not even needed,” he said.
That removes the reason many criminal groups formed. They supplied an encryptor that others could not build. Big brands still exist, Henderson said. Victims recognize their names when it comes time to pay.
“But the reality is we are seeing many lone wolves operate with this. And that’s what AI creates,” he said.
The activity is “absolutely bigger than it ever has been,” Henderson said. It is “not necessarily tied to the largest enterprises that we’ve ever seen.” AI is also bringing in attackers from countries that “haven’t traditionally been hotbeds for hacking,” especially where economies are struggling.
Other recent findings fit that picture. SOCRadar found one crew whose AI coding agent wrote hundreds of its attack tools.
Extortion Without Encryption, Led By The US
In the US, Kroll mostly sees “extortion via data theft,” Henderson said. Canada and EMEA run closer to 50-50 between data theft and encryption. Attacks in Asia-Pacific still lean heavily on encryption.
He gives two reasons for the US lead. US rules force companies to notify and decide fast after data is accessed. US companies have also adopted the controls defenders pushed for years. He named endpoint detection, managed detection and response, and multi-factor authentication. Cyber insurance “plays a hand” too, he said.
Those controls work, Henderson said. That is why attackers changed tactics. “We’ve forced their hand to adapt,” he said.
The rest of the world is following. Data theft is rising in Canada and EMEA. “It’s catching up; it’s just not there yet,” he said.
Ransomware Trends And The New Business Interruption
Data theft still stops businesses. The cause is new. Customers and partners now want proof that a breached company is safe before they resume work.
Kroll gets “a lot of requests to provide a letter of attestation,” Henderson said. “That is now a leading cause of business interruption for us.”
The letter depends on fast answers. How did the attacker get in? Can it happen again? Many companies rush to learn what data was taken instead, he said.
The stakes can be existential. Picture a company with 85% of its revenue tied to two partners, Henderson said. If those partners won’t resume business without answers, “that becomes an existential situation.”
Logs decide how fast those answers come. “We love all the logging data you can possibly get,” he said.
For insurers, that means business interruption can run on after systems are back up. Kroll has put a price on that kind of loss before. Its survey of private equity firms found an average hit of $2.1 million per cyber event.
Agentic AI Attacks Start With An Overprivileged Account
Kroll has worked on “over a dozen” agentic AI attacks so far, Henderson said. Each began the same way. “The very first piece they’re able to get their hands on is a non-human identity that’s overprivileged,” he said.
The novelty is mostly on the surface. “What appears to be a novel attack with the agentic AI is very, very simple,” Henderson said. The cause is “often pretty poor identity hygiene.”
The attackers use underground models with no restrictions, he said. They simply tell the model to hack a company and get its data.
These agentic AI attacks are loud. Henderson compared older intrusions to a Navy SEAL raid: quiet, precise and gone before anyone noticed. The new style is “blitzkrieg,” he said. It touches every system at once. “What if every alert that you have fires off at once everywhere?” he asked. “I fear analysts will almost freeze when they see that.”
AI also works on the stolen data. Attackers run it over their haul to count what they took, such as 10,000 Social Security numbers. That shows them the value fast. “It used to be blind before,” Henderson said.
Kroll’s own survey this year tied AI incidents to weak fundamentals. 89% of companies with very low cyber maturity reported an AI security incident in the past two years.
What Underwriters Should Ask Now
Henderson sees underwriters “handcuffed by the state of the market.” In a soft market, they are limited in what they can ask, he said.
For years, the focus was endpoint detection and multi-factor authentication. “The piece now is identity,” he said.
He would probe what each account can reach and whether it has too much access. That covers human and non-human identities alike. Getting into “the maturity of the identity program itself” would do the most to limit incidents, he said.
Most cases still start the old way. Phishing and voice phishing remain “incredibly successful,” Henderson said. Attackers use them to take over identities and reach SharePoint and OneDrive.
Insurance often drives change. Insurers push controls at renewal, Henderson said. A surge in losses and claims usually tightens those questions.
AI On The Defense
Defenders are behind. Their use of AI is “nowhere close” to the pace attackers have set, Henderson said. That covers in-house security teams, forensic firms and the tools themselves.
He sees AI easing the first 72 hours of a response. Agentic attacks touch everything. They leave far more evidence to review. AI can help “rip through that data and get quick wins,” he said.
It still needs checking. “I don’t think we’re at a point where we can just blindly trust it,” Henderson said.
Asked whether it would take a catastrophic event to change behavior, he pointed to his caseload. “In terms of a catastrophic event, I feel like we’re already there,” he said.
On the CINI podcast: Office printers ship with open ports, built-in servers and default admin passwords. Symphion CEO Jim LaRoe explains why they’re one of the least protected devices on corporate networks. He also covers how one printer can take down a whole company, and what cyber insurance applications miss. Listen: One Printer Can Take Down A Company
FAQ – Ransomware Trends
Are ransomware attacks still rising in 2026?
Yes. Kroll’s Max Henderson says every month this year has brought more attacks than the last. GuidePoint counted 2,760 leak-site victims in Q3 2026, up 75% from a year earlier.
What is extortion without encryption?
Attackers steal data and threaten to publish it without locking any systems. Henderson says this is now the main form of extortion Kroll sees in the US.
Why are there more ransomware groups?
Henderson says encryption is no longer needed and AI does much of the work. That lets lone attackers and small crews run extortion themselves. GuidePoint counted a record 112 active groups in Q3.
How can a breach cause business interruption without encryption?
Customers and partners often demand a letter of attestation before they resume business. Henderson says that is now a leading cause of business interruption in Kroll’s cases.
How do agentic AI attacks get in?
In more than a dozen cases Kroll has worked, the first foothold was an overprivileged non-human identity, such as a service account, Henderson says.
What should cyber underwriters ask about now?
Identity. Henderson points to what accounts can reach and whether they have too much access, for both human and non-human identities.
Related Cyber Insurance Posts
- The Printer Is A Door. Most Companies Leave It Unlocked.
- Retail Ransomware Demands Double to $2M — Why Ransomware Cyber Insurance Matters Now(Opens in a new browser tab)
- Global Network Encryption Market Surges to USD 8.56B** by 2032 Amid Escalating Cyber Threats and Innovations – Report(Opens in a new browser tab)
- Kroll Appoints Katherine Keefe to Lead Global Cyber Insurance Capabilities(Opens in a new browser tab)
1 thought on “Every Month This Year Has Brought More Attacks, Kroll’s Incident Chief Says. He Sees No Peak Yet.”