Newsletters
Risk Central
Digital EditionCyber Insurance Claims Drop 53% in H1 2025, as Ransomware Attacks Grow More Expensive
Evolving Threat Landscape Transforms Risk Profile
The cybersecurity environment has undergone a fundamental shift since 2024, when vendor-related incidents exploded from virtually zero to 21% of all incurred losses, according to Resilience. While these third-party breaches have moderated to 15% of incurred losses in early 2025, they remain a critical vulnerability that organizations overlooked in previous years.
Ransomware continues its dominance, accounting for 76% of incurred losses in the first half of 2025, despite representing only 56% of claims, the report said. When including vendor-related ransomware incidents, the figure jumps to 91% of total incurred losses. The manufacturing sector bears the brunt of these attacks, experiencing 23.1% of all ransomware claims, followed by health care and social assistance organizations at 15.4%, and finance and insurance companies and retail companies, each at 15.4%, according to the report.
H1 2025 Cyber Claims Cause of Loss. Source: Resilience
Artificial intelligence has emerged as a game-changer for cybercriminals, Resilience said. AI-generated phishing campaigns achieve a 54% success rate compared to just 12% for traditional attempts, contributing to social engineering attacks that now represent 42% of incurred claims and 88% of incurred losses, the report said. The Resilience Risk Operations Center tracked 1.8 billion compromised credentials in the first half of 2025—an 800% increase since January.
Organizations Face New Pressures and Vulnerabilities
Health care organizations confront the harshest reality, with average losses reaching $1.3 million per claim in 2024 and individual extortion demands escalating as high as $4 million by early 2025, according to the report. The sector’s life-critical operations create unique leverage for attackers—even well-prepared hospitals have paid ransoms to restore radiological and diagnostic imaging systems needed for immediate patient care, the report noted.
Retail businesses discovered their interconnected vulnerabilities during the spring Scattered Spider attacks, which cascaded through entire supply chains affecting manufacturers, distributors and downstream retailers. The 45-day recovery period for one major UK retailer’s online ordering system reportedly cost the company £40 million ($54.2 million) weekly, exposing sector-wide security immaturity despite handling vast amounts of customer data, the report said.
Manufacturing firms face distinct pressures from supply chain dependencies and operational continuity requirements, per the report. Supply chain compromises accounted for 46% of sector losses in 2024, while direct ransomware attacks represented another 43%. Multiple transfer fraud cases pushed actual losses higher than reported figures suggest, given the sub-limited nature of this coverage, Resilience noted.
Building Resilience Requires Strategic Evolution
Organizations must move beyond traditional defenses to address sophisticated multi-vector attacks that can achieve breakout in fewer than 50 minutes, the report recommended.
Key protective measures include treating cyber insurance policies as sensitive documents after threat actors used stolen policies to calibrate ransom demands below coverage limits in at least two recent cases, the report noted.
Payment strategies require careful reconsideration—while only 14% of Resilience clients paid ransoms in early 2025, down from 22% in 2024, organizations should avoid paying for data suppression, Resilience advised. These payments provide no guarantee of data destruction, offer no protection against regulatory investigations or third-party actions, and may actually increase long-term exposure to repeat attacks.
“Financial incentives are driving cyber criminals to be more clever and more creative, and companies are facing larger losses than ever before,” said Vishaal Hariprasad, co-founder and CEO of Resilience. “Cyber crime comes in waves. Attackers exploit a tactic until defenders catch up, then pivot to new weaknesses. Understanding the financial consequences of attacks and the most common points of failure is paramount to stopping that fallout at the root.”
Obtain the full report here. &
