Ransomware is changing in 2026 - and Ontario underwriters know it
Encryption is the old playbook. Extortion - the threat of leaking data, not locking it - is the new one. Here's what that means for your cyber limit.
The shift: encryption to extortion
For a decade, ransomware meant encryption - your files locked, a countdown timer, a ransom in Bitcoin. The playbook was recover-from-backup or pay. Many Ontario startups paid.
In 2026 the threat is data exfiltration. Attackers copy your database, your customer PII, your source code, then threaten to publish it. Locking your systems is almost secondary. Encryption gets you a restore project; extortion gets you a regulator, a class action, and a churn event.
What it actually costs an Ontario startup
The direct ransom is rarely the biggest number. For a 50-person SaaS company caught in a double-extortion event, the real stack looks like: forensics ($80k–$250k), breach-council legal ($40k–$120k), regulator response under PIPEDA / PHIPA ($30k–$90k), notification and credit monitoring at scale ($4–$12 per record), and business interruption from the week of lost deals. A 50,000-record exposure can clear seven figures before you've decided whether to pay.
The cost that surprises founders most is churn. Customers who were mid-renewal leave. Prospects in security review stall. The reputational drag shows up in pipeline six months later - quietly, and irreversibly.
Reading is the start. A short conversation turns it into a plan.
No sales pressure. We'll look at your stage, your contracts, and your AI exposure, and tell you - plainly - where your current coverage won't hold up.
Risk notes, once a month.
One short note on Ontario tech risk - breaches, regulation, and what your policy should actually cover.
How your cyber policy responds
A modern cyber policy has two halves. First-party cover pays your own response costs - forensics, legal, notifications, ransom. Third-party cover defends the claims from customers and regulators whose data you held. Exfiltration-only attacks often trigger both, because the regulatory response and customer notifications are first-party costs even when no system was encrypted.
The trap is sub-limits. Many entry-level policies cap breach-response costs at $250k or cap ransom at a fraction of the limit. For a record-count-driven event, that sub-limit is the first thing to exhaust - and everything above it is your money.
The endorsements that earn the claim
Two endorsements matter most in 2026: full-replacement backup and a broad definition of 'computer system' that extends to your SaaS supply chain. The backup endorsement turns a 'we paid to restore' claim into a 'the carrier paid to restore' claim. The supply-chain extension is what caught MOVEit's downstream customers - without it, your contingent business interruption from a vendor breach can be denied.
Ask your broker for the actual sub-limit schedule, not just the aggregate limit. The number on the declarations page is a ceiling; the sub-limits decide whether you ever reach it.
Keep reading
PHIPA breach windows: what actually counts as 'prompt'
Ontario's IPC has tightened what 'prompt notification' means under PHIPA. The window is shorter than most healthtech founders think - and the fines are personal.
When your AI hallucinates, who pays?
The Air Canada chatbot case is now precedent Ontario tribunals cite. If you ship an LLM feature, your Tech E&O needs an AI endorsement - not a hope.
SLA gaps your Tech E&O won't close
The uptime promise in your MSA is a contract. Your Tech E&O is insurance. They are not the same thing, and founders confuse them at their peril.
Keep exploring
General information only. Not insurance advice.