Why Managers Are the Top Target for Ransomware Attacks

Cybercriminals are increasingly shifting their focus to mid-level and senior managers, leveraging their accounts to access critical data. A Zscaler study by ThreatLabz revealed that in one ransomware campaign, 62% of victims held managerial positions. Most worked in finance, marketing, and IT departments, where they had access to payments, contracts, and internal systems.

Attacks on managers are particularly dangerous as they enable cybercriminals not only to steal data but also to disrupt business processes. For example, compromising a sales manager’s account could lead to order cancellations and client losses, while hacking a finance specialist’s credentials might delay supplier payments. The study highlights real-world cases, including a regional sales manager at an industrial company and a supplier payments department head at an IT firm.

To mitigate such risks, experts advise restricting external communications via corporate messengers like Microsoft Teams* and Slack*, while training employees to recognize phishing attempts. Implementing multi-factor authentication, using AI-driven tools to detect suspicious activity, and segmenting networks are also critical. Network segmentation helps prevent lateral attack spread across systems.

Special attention should be given to the principle of least privilege: employees should only have access to data and systems necessary for their roles. This minimizes potential damage if an account is compromised. Adopting a Zero Trust approach—verifying every access request, even from within the network—is also strongly recommended.