Cyber Claims Frequency Rises but Severity Falls as Businesses Improve Defensive Posture

Despite a 3% increase in global cyber claims frequency, average losses in 2025 dropped 19% year over year as organizations became more effective at limiting breach damage, according to Coalition.
By: | April 14, 2026
Topics: Claims | Cyber | Cyber Risks | News
using a laptop

Cyber insurance claims became more frequent but less costly in 2025, with the average claim falling 19% to $116,000 even as the overall claims rate rose to 1.54%, according to Coalition’s 2026 Cyber Claims Report.

The report, drawing on data from more than 100,000 policyholders across five countries, credited stronger security practices and faster incident response. Coalition also noted that 64% of closed claims resulted in no out-of-pocket loss for policyholders, and $21.8 million in stolen funds was recovered during the year, with an average recovery of $202,000 per incident.

Email-Based Attacks Dominate the Claims Landscape

Business email compromise (BEC) and funds transfer fraud (FTF) together accounted for 58% of all cyber claims in 2025, the report found. BEC was the most common event type at 31% of claims, with frequency rising 15% year over year to 0.47%. However, BEC severity dropped 28% to an average loss of $27,000.

BEC poses particular danger because it can serve as a staging ground for more severe downstream attacks, according to the report. Among all FTF claims, 52% originated from a BEC event, carrying an average loss of $112,000. FTF was the second-most common claim type at 27%, though its frequency declined 18% year over year to 0.42%, with average losses falling 14% to $141,000.

Social engineering drove 71% of FTF claims with an average loss of $127,000. A more costly tactic — fraudulent instructions sent directly to banks — accounted for 20% of FTF events and carried a higher average loss of $218,000, suggesting attackers are increasingly bypassing employees to target financial institutions directly, the report said.

Ransomware Demands Surge but Fewer Victims Pay

Ransomware accounted for 21% of claims and remained the costliest event type, though average severity declined 19% year over year to $262,000. Claims frequency was essentially flat at 0.32%. The average ransom demand surged 47% to more than $1 million, with some demands reaching as high as $16 million, according to the report.

Despite escalating demands, 86% of ransomware victims refused to pay, the report found. For the 14% that did, negotiators reduced initial demands by an average of 65%, bringing the average payment down to $355,000 from roughly $873,000.

Dual extortion — where attackers both encrypt systems and exfiltrate data — dominated ransomware tactics, accounting for 70% of ransomware claims with an average loss of $299,000. That figure was more than double the average for encryption-only attacks, which carried an average loss of $138,000.

Virtual private networks were the primary technology targeted in ransomware attacks, accounting for 59% of incidents where a specific technology was confirmed by forensic investigators. SonicWall was the most frequently targeted VPN vendor, followed by Fortinet, Cisco, Citrix and Palo Alto Networks.

Size Matters: Larger Companies Face More Frequent Attacks

Coalition’s report revealed a clear correlation between company size and attack frequency. Businesses with more than $100 million in revenue experienced a 5.72% claims frequency — nearly five times higher than that of businesses with less than $25 million in revenue, which saw a 1.21% rate. However, severity trended downward across all segments, with average losses for the largest companies falling 7% to $268,000 and losses for the smallest declining 15% to $77,000.

By industry, materials companies saw the highest claims frequency at 2.37%, while information technology firms experienced the highest average loss at $182,000. Financial services firms, despite being high-value targets, had among the lowest average losses at $64,000 — a finding the report attributed to the sector’s mature cybersecurity strategies and robust incident response planning.

The report also flagged an emerging area of legal exposure: 72% of privacy rights violation allegations in 2025 cited the California Invasion of Privacy Act, originally a 1967 anti-wiretapping statute now being applied to modern web-tracking technologies.

Obtain the full report here. &

The R&I Editorial Team can be reached at [email protected].

More from Risk & Insurance