Moving your agency management system, email and files to the cloud took the office server off the table, but it didn't take your agency off the target list. Today's attackers don't need to lock up your computers. They log in with a stolen password, copy your policyholder data, and threaten to release it. For a multi-location agency, the question isn't where your data lives. It's who can sign in to it.
We support independent insurance agencies across Northwest Ohio and Northeast Indiana, and most of them run almost entirely in the cloud. Here's what has changed in ransomware, and what it means for an agency owner.
The old ransomware playbook was simple: encrypt your files and charge you for the key. Good backups beat that. So attackers changed the playbook.
Now many of them skip the encryption step entirely and just steal the data. Cyber insurer Resilience reported that 65% of the extortion claims it handled in the second half of 2025 involved no encryption at all, up from 49% earlier that year. Your systems keep running. Your quoting and servicing keep working. And someone still has a copy of your policyholders' driver's license numbers, Social Security numbers and claims history.
Cloud platforms are not immune. In 2025, attackers used stolen access tokens from a trusted connected app to pull customer data out of Salesforce environments at multiple companies. Nobody broke into a server. They walked in through an integration that already had permission.
The price of getting caught is rising, too. Blockchain analysis firm Chainalysis found the median ransom payment jumped from $12,738 in 2024 to $59,556 in 2025.
When an agency won't pay, today's extortion groups widen the pressure. They contact the victim's customers, business partners and even regulators directly, threatening to publish the stolen data.
For an insurance agency, that means calls and emails to your policyholders and your carrier partners. Your business runs on trust built over years, sometimes generations. That's the leverage attackers are counting on.
When everything lives in Microsoft 365, your agency management system and your carrier portals, a username and password is all that stands between an attacker and your data.
Verizon's 2025 Data Breach Investigations Report found that 54% of ransomware victims had their domains show up in infostealer logs or marketplace postings, and 40% of those logs contained corporate email addresses. In other words, the logins were already for sale before the attack.
And once someone is in, things move fast. Google's Mandiant found that the time between an attacker getting in and handing that access to a ransomware group collapsed from more than 8 hours in 2022 to just 22 seconds in 2025. No one on your team will catch that in real time.
Being in the cloud also doesn't make your backups untouchable. If an attacker gets an administrator login, that account can often delete, change or expire backups the same way an administrator could. That's why it matters not to assume your backups are safe just because they're stored somewhere else.
A multi-location agency has more staff, more devices, and more people who might plausibly call asking for a password reset. Attackers know it.
The 2023 attack on MGM Resorts, which MGM estimated cost about $100 million, reportedly began with a phone call to the IT help desk from someone impersonating an employee. It's not a one-off. Mandiant found that voice phishing accounted for 23% of the intrusions it investigated in 2025, more than any other way in.
If a caller says they're your CSR at the Lima office and they're locked out, what does your IT provider do to confirm it's really them?
If you'd like a broader checklist for evaluating your IT provider, see 21 questions every insurance agency should ask before choosing an IT provider.
You know better than anyone that E&O and cyber applications now ask detailed questions about MFA, backups and security training. An answer that turns out to be wrong after a claim is a problem no agency owner wants. Here's what to know about cyber insurance before a claim happens.
We've supported independent agencies since 2011 and local businesses for more than 20 years, from our headquarters in St. Henry, Ohio. See how we support insurance agencies across Ohio and Indiana.
Not sure how your agency would answer those five questions? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.