Moving your agency management system, email and files to the cloud took the office server off the table, but it didn't take your agency off the target list. Today's attackers don't need to lock up your computers. They log in with a stolen password, copy your policyholder data, and threaten to release it. For a multi-location agency, the question isn't where your data lives. It's who can sign in to it.
We support independent insurance agencies across Northwest Ohio and Northeast Indiana, and most of them run almost entirely in the cloud. Here's what has changed in ransomware, and what it means for an agency owner.
Ransomware No Longer Needs to Lock Your Files
The old ransomware playbook was simple: encrypt your files and charge you for the key. Good backups beat that. So attackers changed the playbook.
Now many of them skip the encryption step entirely and just steal the data. Cyber insurer Resilience reported that 65% of the extortion claims it handled in the second half of 2025 involved no encryption at all, up from 49% earlier that year. Your systems keep running. Your quoting and servicing keep working. And someone still has a copy of your policyholders' driver's license numbers, Social Security numbers and claims history.
Cloud platforms are not immune. In 2025, attackers used stolen access tokens from a trusted connected app to pull customer data out of Salesforce environments at multiple companies. Nobody broke into a server. They walked in through an integration that already had permission.
The price of getting caught is rising, too. Blockchain analysis firm Chainalysis found the median ransom payment jumped from $12,738 in 2024 to $59,556 in 2025.
They Will Contact Your Policyholders and Carriers
When an agency won't pay, today's extortion groups widen the pressure. They contact the victim's customers, business partners and even regulators directly, threatening to publish the stolen data.
For an insurance agency, that means calls and emails to your policyholders and your carrier partners. Your business runs on trust built over years, sometimes generations. That's the leverage attackers are counting on.
In the Cloud, Your Login Is the Front Door
When everything lives in Microsoft 365, your agency management system and your carrier portals, a username and password is all that stands between an attacker and your data.
Verizon's 2025 Data Breach Investigations Report found that 54% of ransomware victims had their domains show up in infostealer logs or marketplace postings, and 40% of those logs contained corporate email addresses. In other words, the logins were already for sale before the attack.
And once someone is in, things move fast. Google's Mandiant found that the time between an attacker getting in and handing that access to a ransomware group collapsed from more than 8 hours in 2022 to just 22 seconds in 2025. No one on your team will catch that in real time.
Being in the cloud also doesn't make your backups untouchable. If an attacker gets an administrator login, that account can often delete, change or expire backups the same way an administrator could. That's why it matters not to assume your backups are safe just because they're stored somewhere else.
More Offices Means More Ways In
A multi-location agency has more staff, more devices, and more people who might plausibly call asking for a password reset. Attackers know it.
The 2023 attack on MGM Resorts, which MGM estimated cost about $100 million, reportedly began with a phone call to the IT help desk from someone impersonating an employee. It's not a one-off. Mandiant found that voice phishing accounted for 23% of the intrusions it investigated in 2025, more than any other way in.
If a caller says they're your CSR at the Lima office and they're locked out, what does your IT provider do to confirm it's really them?
5 Questions Every Multi-Location Agency Owner Should Ask
- If someone stole an administrator password, could they delete our backups? If the answer is "yes" or "I'm not sure," that's your biggest gap.
- Is multi-factor authentication turned on for every email account and every system we can control? Stolen passwords are the most common way in.
- How does our help desk verify a caller before resetting a password or MFA? "They sounded like Susan" is not a process.
- Which apps are connected to our Microsoft 365 and agency management system, and does anyone review them? Old integrations keep their permissions long after anyone remembers them.
- When was the last time we restored data from backup, and did it work? A backup that has never been restored is a hope, not a plan.
If you'd like a broader checklist for evaluating your IT provider, see 21 questions every insurance agency should ask before choosing an IT provider.
Your Insurance Coverage Depends on the Answers
You know better than anyone that E&O and cyber applications now ask detailed questions about MFA, backups and security training. An answer that turns out to be wrong after a claim is a problem no agency owner wants. Here's what to know about cyber insurance before a claim happens.
How We Help Insurance Agencies Close These Gaps
- Multi-factor authentication required on every email account, and on everything else within our control.
- A human-staffed Security Operations Center watching for signs of compromise across computers, email and the cloud.
- Dark web monitoring for leaked credentials, reviewed with you at your quarterly meeting.
- Security awareness training with practice phishing emails, so your team learns to spot the calls and messages that start these attacks.
- Backups restore-tested every other week, so you know your agency's data can come back when it matters.
- Technicians who answer the phone live during the business day.
We've supported independent agencies since 2011 and local businesses for more than 20 years, from our headquarters in St. Henry, Ohio. See how we support insurance agencies across Ohio and Indiana.
Not sure how your agency would answer those five questions? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.