Energy workers: check for session hijacking and phishing in utility cyber claims
Insurance analysis reveals ransomware drives most losses in the energy sector, with email compromise rates doubling the industry average.
Key points
- Ransomware accounts for 70% of losses in the energy and utilities sector despite being a small fraction of claims.
- Email compromise rates are 21% in this sector, significantly higher than the 10% average across other industries.
- Attackers bypass security by tricking staff into revealing credentials or by hijacking already authenticated sessions.
Employees in the energy and utilities sectors face elevated cyber risks, according to an analysis of insurance claims by Resilience. The report indicates that email compromise drives a disproportionate number of incidents in this industry compared to other sectors. Workers may encounter sophisticated attempts to steal login details or take over active digital sessions, putting corporate and operational data at immediate risk.
Why are energy sector losses so high?
Ransomware incidents generated approximately 70% of the financial losses incurred by the energy and utilities sector between January 2023 and September 2026. This figure includes reserves set aside for future payments. Despite representing only 9% of the total claims filed during this period, ransomware caused the majority of the monetary damage. This disparity suggests that when ransomware strikes this sector, the operational and financial impact is significantly more severe than in other industries.
How are attackers bypassing security controls?
Attackers frequently circumvent existing security measures by exploiting human error and session vulnerabilities. In specific cases, adversaries tricked employees into entering passwords and one-time codes on fake login pages. Other incidents involved hijacking live sessions that were already authenticated, allowing attackers to move laterally without needing additional credentials. These methods bypass traditional perimeter defences, meaning that even if a user has strong passwords, their active sessions can still be compromised if not properly monitored or secured.
What role do vendors play in these breaches?
Seventeen percent of cyber claims in the energy and utilities sector originated with vendors, which is lower than the 24% average across Resilience’s broader portfolio. However, ransomware incidents affecting equipment service providers and shared third-party infrastructure caused significant operational and financial losses. These supply chain vulnerabilities highlight that securing internal networks is insufficient if external partners lack robust defences. A breach at a vendor can cascade into the primary organisation, disrupting critical operations even when the main entity’s own security holds.
How can organisations recover from these attacks?
Organisations with recently tested backups were able to recover systems without paying ransoms, according to the report. Network segmentation also proved effective, allowing some companies to maintain production despite corporate IT compromises. By separating operational technology from general corporate networks, utilities could continue essential services even when other parts of their digital infrastructure were locked out. These technical controls proved vital in mitigating the impact of ransomware and other intrusions.
What affected people can do
Teams should regularly verify that backup systems are functional and can restore critical data quickly. Employees must treat unexpected login requests with extreme caution, especially if they involve one-time codes or appear on unfamiliar web pages. Users should check whether their organisation has separated operational technology from corporate networks to limit blast radius. Individuals ought to report any suspicious session behaviour or unexpected access prompts immediately. Awareness of social engineering tactics remains the first line of defence against credential theft.
Background: Network segmentation
Divide your network into smaller, isolated zones using VLANs or separate routers. This prevents an attacker who compromises one device, such as a guest laptop, from accessing your main file servers or payment systems. It reduces the blast radius of any security incident.
Read the full guide: Network Segmentation for Small Business: Stop Lateral Movement
What to do and how to stay safe: Resilience
- Verify that multifactor authentication is tested against social engineering attempts and session hijacking techniques.
- Ensure that backup recovery processes are validated regularly so systems can be restored without paying ransoms.
- Check internet-facing controllers and operational technology for unauthorised access or unusual activity.
- Assess whether critical operations can continue manually if digital systems are compromised or locked out.
Step-by-step guide: Endpoint Detection and Response for Small Teams
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does the rate of email compromise in the energy sector compare to other industries?
Email compromise accounted for 21% of claims in the energy and utilities sector, which is more than double the 10% rate seen across other sectors in the portfolio.
Did any clients file claims related to the 2026 campaign against water utilities?
No, none of the clients in the report filed a claim tied to the 2026 campaign targeting water and wastewater utilities.
Why might insurance claims not show the full picture of OT risk?
Intrusions into industrial control systems may go undetected or cause no immediate disruption, meaning no claim is filed even if an attacker remains in the system for months.
