The claims data behind the headlines: what the 2026 cyber claims reports mean for insurers and insureds
Ransom demands rose sharply, yet most victims refused to pay and average losses fell. Social engineering, not malware, still drives the majority of claims. What the numbers mean for underwriting, incident response and the forensic record.
Cyber claims reports are among the best data sources in the industry because they are grounded in money actually paid, not in survey sentiment. Coalition's 2026 Cyber Claims Report, published on 5 March 2026 and covering 2025 activity, is a useful lens on where losses come from and how response quality shapes outcomes. The findings align with what our responders see across insurer panels in Europe and the Gulf.
The headline numbers
- Initial ransom demands rose 47 percent year over year in 2025.
- A record 86 percent of affected businesses refused to pay.
- The average overall loss fell 19 percent to about 116,000 US dollars.
- Ransomware remained the most costly claim type at an average of about 269,000 US dollars, while business email compromise averaged about 27,000 US dollars (down 28 percent) and funds transfer fraud about 141,000 US dollars (down 14 percent).
- Business email compromise and funds transfer fraud together accounted for 58 percent of all incidents. BEC frequency rose 15 percent; FTF frequency fell 18 percent but still represented 27 percent of claims.
- Dual extortion, combining encryption with data theft, featured in 70 percent of ransomware claims, and ransomware with data theft was twice as expensive as encryption-only events.
- 52 percent of funds transfer fraud claims originated from a business email compromise.
- 64 percent of closed claims were resolved with no out-of-pocket cost to the policyholder, and 21.8 million US dollars in stolen funds were recovered, an average of about 202,000 US dollars per recovery.
- Large enterprises with revenue above 100 million US dollars had five times the claim frequency of smaller organisations.
What the numbers say about response
Refusing to pay is now the norm, and it works when backups and response are ready. The rising demand figure and the falling payment rate point in the same direction: extortion groups ask for more because fewer victims pay. Organisations that can restore from immutable backups, prove what data was taken and communicate confidently with regulators have the leverage not to pay. That capability is built before the incident, and it is what underwriters increasingly price.
Data theft is the cost driver. Dual extortion doubles the cost of a ransomware claim because it adds notification, legal, regulatory and reputational workstreams to the recovery. Precise exfiltration assessment is therefore not an academic exercise: it determines whether a notification covers 2,000 records or 2 million, and whether an extortion decision is made on evidence or on a threat actor's claims.
Social engineering still wins. Email compromise and payment diversion dominate claim frequency. They are cheap for attackers and effective against organisations with weak authentication, loose payment controls and no mailbox monitoring. The fact that half of funds transfer fraud starts with BEC means mailbox forensics is often the key to recovering money, not just to understanding the breach.
Recovery of funds is possible when the response is fast. The recovery figures show that quick engagement with banks, supported by evidence of the fraud, brings money back. Every hour of delay reduces the odds.
Implications for insurers and brokers
- Underwrite the controls that change outcomes: immutable backups, MFA on email and remote access, payment verification procedures, EDR coverage and a tested incident response arrangement.
- Measure response partners on evidence quality, not only on hourly rate. A report that establishes exfiltration scope precisely can reduce notification costs by orders of magnitude.
- Treat BEC as a primary peril. Its frequency is rising, and the forensic work to support fund recovery pays for itself.
- Prepare insureds for the extortion decision before it arrives, including sanctions screening and a decision framework agreed with counsel.
Implications for insureds
If you are an insured, the practical takeaways are to know your policy's response obligations, to have a retainer or panel provider that can be activated in an hour, to keep backups that an attacker with domain administrator rights cannot destroy, and to make sure that your email tenant generates the audit logs that a forensic team will need. The cheapest claim is the one that is scoped quickly and accurately.
Sources
- Coalition: 2026 Cyber Claims Report announcement (5 March 2026)
- Huntress: 2026 cyber insurance trends report
