Ransom Payments Drop 44% Even as Cyber Claims Surge, Cowbell Reports

Cowbell's 2026 claims analysis found that stronger negotiation strategies and improved backup practices are driving down ransom payments despite increase in overall cyber claims activity.
By: | May 13, 2026
Topics: Claims | Cyber | Cyber Risks | News
computer monitor screen displaying padlock symbol in a circular light bubble. binary code data bits background. red and blue colour. cyber security concept.

Average ransom payments have decreased by approximately 44% over the past several years, even as U.S. cyber insurance claims rose 40%, according to Cowbell’s 2026 Cyber Roundup Claims Report.

The report, which draws primarily on 18 months of Cowbell’s claims data, paints a picture of a cyber insurance market under growing pressure. For example, U.S. cyber insurance premiums declined for the first time to $9.14 billion, according to an AM Best report cited in the document, while loss activity intensified.

Data Breaches and Cybercrime Dominate Claims

Three incident types account for the vast majority of reported claims, the report said.

  • Data breaches — involving unauthorized access or disclosure of sensitive information — represent 33.5% of claims.
  • Cybercrime, which includes phishing, business email compromise and funds transfer fraud, accounts for 31.8%.
  • Extortion events, primarily ransomware, make up 18.3%.

Business email compromise remains “one of the most financially damaging cybercrimes” as of early 2026, according to the report, with attackers exploiting human trust through impersonation, AI-generated content and social engineering.

Globally, approximately 3.8 million phishing attacks were identified in 2025 based on APWG data cited in the report, and variants such as smishing and vishing are expanding these risks across channels. Between 74% and 95% of breaches involve the human element, the report noted.

Ransomware attacks surged roughly 45% in 2025, with threat actors increasingly employing double-extortion tactics — combining encryption with data theft — and shifting toward data-only extortion schemes where attackers threaten to leak sensitive information rather than simply locking systems.

A Small Number of Threat Actors Drive Outsized Impact

Cowbell’s claims data identifies seven ransomware groups behind more than two-thirds of cases with identified threat actors. Two groups alone account for more than half: Akira at 38.8% and Qilin at 14.2%, the report said. Akira targets small and mid-sized enterprises through VPN and remote access exploitation, while Qilin operates as a ransomware-as-a-service group using data exfiltration and encryption against high-value enterprise targets.

These groups frequently operate from Eastern Europe and exploit unpatched VPNs and remote access vulnerabilities, according to the report. Recent large-scale incidents involving PowerSchools, Change Healthcare, TriZetto and SonicWall illustrate how systemic vulnerabilities can cascade across multiple organizations simultaneously.

The report noted that ransomware dynamics are shifting — decryption payments are declining as organizations improve their backup capabilities, while data extortion and suppression payments are rising due to the proliferation of double-extortion tactics.

Industry Exposure and Forward-Looking Risks

Certain sectors face consistently higher exposure, the report said. Professional services, construction, manufacturing, health care and wholesale trade all rely heavily on systems and sensitive information. Industries handling sensitive information “typically face higher-than-average ransom demands and longer recovery periods,” according to the report. Law firms remain a top target due to sensitive data holdings and often outdated security controls.

Looking ahead through the remainder of 2026, the report anticipates several developments: smaller, financially motivated threat actor groups will continue entering the landscape; advanced social engineering will expand beyond email with AI-enhanced phone-based impersonation; and litigation exposure will grow as third-party claims and class actions increase following cyber incidents.

The report emphasized that practical defenses — including multi-factor authentication, employee training, penetration testing and robust backup strategies — remain among the most effective measures for reducing exposure. Over 95% of policyholders who have used complementary micro penetration testing services have not experienced a claim to date, according to Cowbell’s data.

Obtain the full report here. &

The R&I Editorial Team can be reached at [email protected].

More from Risk & Insurance