Loading story…
CNA Financial reportedly paid $40 million to regain access to systems following a ransomware attack disclosed in March, a sum described as potentially the largest publicly known ransom payment at the time. The insurer said it worked with federal law enforcement during the response, disconnected affected systems, and conducted due diligence on the threat actor before making any payment. CNA said the actor was identified as Phoenix and was not found on the Treasury Department's Office of Foreign Assets Control (OFAC) sanctions list.
After the incident, CNA said it deployed additional endpoint detection and monitoring tools, removed the attacker from its environment, and found no evidence that external customers faced infection or cross-contamination. The case drew wider attention because CNA is a major cyber insurer, making it a high-value target for ransomware groups seeking both sensitive client data and leverage over ransom negotiations, while also underscoring the legal and financial risks of payments involving sanctioned groups such as Evil Corp or REvil.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
CNA later stated that the threat actor was no longer present in its environment. It also said there was no evidence that external customers faced infection or cross-contamination risk from the incident.
By the time of its May 2021 public response, CNA said it had coordinated with federal law enforcement and followed OFAC guidance during its handling of the incident. The company said its due diligence identified the threat actor as Phoenix and that it was not on OFAC's prohibited entities list.
Following the March ransomware attack, CNA Financial reportedly paid attackers $40 million to regain access to its files and systems. Bloomberg described the payment as potentially the largest publicly known ransom payment at that time.
In March 2021, CNA Financial disclosed a ransomware incident and disconnected affected systems to contain the attack. The company later deployed additional endpoint detection and monitoring tools as part of its response.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A court issued a first-of-its-kind cyber insurance ruling blocking insurer **HSB** from applying a ransomware sub-limit to a claim tied to a 2022 ransomware incident at CiCi. The attack involved system encryption and threats to publish allegedly exfiltrated data; CiCi reported the incident via **At-Bay** (HSB’s agent), retained outside counsel and incident response firm **Arete Advisors**, and negotiated a ransom demand from **$2 million** down to **$400,000**. CiCi claimed total losses exceeding **$1.2 million** under a policy with a **$3 million** aggregate limit and **$50,000** retention. Separately, **Indiana University Health** sued **Change Healthcare** in U.S. federal court (District of Minnesota), alleging Change’s 2024 ransomware incident disrupted critical billing and payment operations and caused **$66 million** in damages. The filing underscores continued downstream legal exposure from ransomware-driven outages in healthcare supply chains, where third-party service disruptions can translate into large, quantifiable financial claims.
Jun 29, 2026
**Norton Healthcare** agreed to pay **$11 million** to settle a class-action lawsuit tied to a 2023 **ALPHV/BlackCat** ransomware-related data theft that reportedly involved **4.7 TB** of stolen data and impacted nearly **2.5 million** people. The preliminary settlement provides for reimbursement claims (up to **$2,500** for unreimbursed expenses), compensation for time spent responding to the incident (up to **$80**), and **three years of medical identity monitoring**, pending final court approval. Separately, Ohio-based **Kettering Health** began notifying current and former patients and affiliates about a **May 2025** ransomware and data theft incident claimed by the **Interlock** cybercrime group. Reporting indicates Interlock publicly listed Kettering Health on its leak site and claimed roughly **941–950 GB** of data, and Kettering previously warned patients about **scam calls** from fraudsters impersonating medical bill collectors seeking credit card payments—activity consistent with post-breach social engineering and fraud attempts.
Jun 29, 2026
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026