CNA Financial: The $40 Million Ransom Lesson

A billion-dollar insurer and weeks of compromised operations

In March 2021, CNA Financial, one of the largest commercial insurers in the United States, publicly announced that it had suffered a sophisticated cyberattack. The company reported that it disconnected systems as a precaution, and the disruption reached basic corporate functions, including email and the corporate website, with impact reported over the course of weeks.

Reporting by Bloomberg, republished by security-focused outlets, indicated that the insurer had paid roughly US$ 40 million to regain access to its own environments, one of the largest ransom payments ever reported (BleepingComputer). Meses depois, a empresa notificou aproximadamente 75 mil pessoas de que dados pessoais poderiam ter sido acessados durante o incidente (BleepingComputer), and the episode continued to reverberate in the technical press (SecurityWeek).

An honest caveat is in order before any technical reading. Publicly, the organization stated that it worked with outside specialists and authorities, and the internal details were never fully disclosed, so no outsider can state which systems failed or exactly how the initial access happened. The case serves as a hook for reflection for decision-makers, without serving as a diagnosis of the victim.

What makes the episode uncomfortable is the maturity involved, since a commercial insurer makes its living pricing risk and typically operates with a budget, team, and governance above the market average. If an environment of that size faced weeks of operational impact, the relevant question becomes how long your structure would hold up under similar conditions. IBM's Cost of a Data Breach 2024 report points to a global average cost of US$ 4.88 million per data breach, a figure that comfortably exceeds the cash reserves of most midsize companies.

The vectors that incidents of this type tend to exploit

Although the internal details of the incident are not public, attacks like this one generally exploit known vectors, and the first of them continues to be phishing combined with social engineering. Verizon's Data Breach Investigations Report 2024 points out that 68% of the breaches analyzed involved a human element, someone who clicked, approved, or handed over a credential without realizing it. In practical terms, an email that mimics a known supplier arrives in the finance department with an invoice attachment, the file is opened during a busy morning, and the attacker begins moving around with the digital badge of a legitimate user inside your network.

The second recurring vector brings together compromised credentials and poorly configured remote access, which became a preferred entry point after the expansion of distributed work. All it takes is a remote access console published on the internet without multi-factor authentication (MFA, verification in two or more steps) for an attacker to test, in an automated fashion, thousands of combinations leaked in previous incidents. From a single valid session, the attacker usually escalates privileges and moves between servers, because the internal network rarely imposes barriers on someone who has already gotten in with an authorized user.

The third vector is the known vulnerability that remains unpatched, a common situation in environments with many servers and contested maintenance windows. That same Verizon report recorded 180% growth in the exploitation of vulnerabilities as an initial path to breaches between 2023 and 2024. In practice, the interval between the publication of a critical flaw and the mass automated scanning looking for it is measured in hours, while many companies still treat system updates as a quarterly task.

What you can do to protect your structure

The first layer is endpoint protection with EDR (Endpoint Detection and Response), a technology that observes behavior instead of relying solely on signatures of already cataloged threats. When a process starts encrypting files in sequence or deleting the system's shadow copies, EDR isolates the device automatically and preserves the rest of the environment. This capability only delivers value when combined with continuous proactive monitoring with prioritized alerts, because an alert nobody reviews produces the same practical effect as an alert that never existed.

The second layer is backup that is isolated, encrypted, and tested regularly, and here lies the point that most separates recovery from catastrophe. Sophos's State of Ransomware 2024 report shows that in 94% of the organizations hit, attackers tried to compromise the backups, and the attempt succeeded in 57% of cases. A copy connected to the same domain, with the same administrative credentials as the production environment, tends to be encrypted right along with it. Immutable copies, logically segregated and subjected to periodic restoration tests, turn a ransom negotiation into an engineering decision, and that is the design of backup and disaster recovery that sustains business continuity.

The third layer combines continuous patch management, multi-factor authentication, and network segmentation, three controls that significantly reduce the surface available to the attacker. An up-to-date asset inventory, a defined remediation cycle prioritized by criticality, and MFA on all administrative and remote access shorten the window of opportunity. Segmentation, in turn, ensures that the compromise of a user's workstation does not reach database servers on the next hop.

The fourth layer is human and procedural, formed by ongoing user training and by a documented, tested incident response plan. Periodic phishing simulations and short awareness tracks turn the team into a detection sensor, while a rehearsed plan defines who authorizes shutting systems down, who speaks with clients and in what order services come back. Mature programs of managed cybersecurity treat these layers as a single system, with documented evidence and review on a fixed calendar.

Questions every decision-maker should be asking right now

1. Would my backups actually work in a disaster like this one? How long until my operation is back up and running?
2. Does my team have the right tools to identify and block an attack like this immediately, before it causes the full disaster? How am I investing in preparing my technical team?
3. How long would my company survive without access to its systems and files?

Would my backups actually work in a disaster like this one?

The honest answer depends on the date of the last full restoration test, with the time clocked until the system is operating again with its integrations. A reliable routine combines immutable copies, credential isolation between production and the backup repository, and sample restorations on a fixed calendar. Formally defining RTO (Recovery Time Objective, the maximum acceptable time to resume) and RPO (Recovery Point Objective, the maximum acceptable volume of data loss) for each critical system turns a vague expectation into a measurable recovery commitment.

Does my team have the right tools to block an attack before disaster strikes?

Immediate detection depends on three elements working together: EDR on every endpoint and server, continuous proactive monitoring with qualified alert triage, and a clear escalation path when something anomalous appears. A tool without a process generates noise, and a process without technical preparation generates hesitation at the very moment when minutes determine the size of the loss. Investing in the team means funding certifications, tabletop exercises and response simulations, as well as supporting the in-house team with specialized backup that sustains technical vigilance and patch management, freeing your professionals for the business's strategic initiatives.

How long would my company survive without access to its systems and files?

Essa conta é mais simples do que parece e costuma ser mais dura do que se imagina. Multiplique o faturamento médio por hora pelo número provável de horas de parada, some folha ociosa, multas contratuais, horas extras de recuperação e o custo reputacional de comunicar clientes sobre exposição de dados, como nas cerca de 75 mil pessoas notificadas pela CNA Financial. Levantamentos da Coveware sobre negociações de ransomware indicaram períodos médios de indisponibilidade superiores a 20 dias em diversos trimestres, prazo que poucas operações atravessam sem sequelas permanentes. Se o número assustar, ele já cumpriu a função de orientar o orçamento de proteção.

If your company does not yet have an integrated layered protection strategy, consider a Strategic IT Assessment, with no obligation, to identify vulnerabilities before they become headlines.

Frequently asked questions