This new report from Coalition offers insights into the increasing number of ransomware demands and attacks;
Coalition, the world’s first Active Insurance provider designed to help prevent digital risk before it strikes, today released the findings of its 2026 Cyber Claims Report, revealing that initial ransom demands in the full-year 2025 surged 47% year-over-year (YoY). However, while ransomware actors substantially increased their demands, a record 86% of businesses did not pay, suggesting that organisations benefit from having the rapid resources of Coalition’s Claims Team and its vendor partners in responding to these business impacting events.
Rob Jones, Coalition’s Global Head of Claims said: “The data suggests a turning point in the economics of ransomware: while threat actors escalate their demands to push for higher, seven-figure payouts, cyber insurer support is helping businesses limit losses and is starting to help tip the scales back in favor of defenders. Ultimately, we’re seeing the continuous partnership that Active Insurance offers between Coalition and our policyholders is reshaping the loss profile of cyber insurance and creating better outcomes.”
While ransomware was the most costly type of claim in 2025 with an average loss of GBP 202,000, business email compromise (BEC) and funds transfer fraud (FTF) still accounted for the majority (58%) of cyber incidents that Coalition observed. Further, among all 2025 FTF claims, 52% originated from BEC, indicating that BEC is a catalyst for FTF, but not a prerequisite, and businesses must adequately prepare to defend against both email-enabled and email-independent pathways to financial fraud.
Laura Stewart, Coalition’s UK Head of Claims commented: “We saw significant ransomware headlines in the UK in 2025, and an uptick in clients looking to improve their cyber maturity. Over 80% of UK policyholders engaged with our Coalition Control® cyber risk management platform in 2025. While 86% of our global policyholders did not pay a ransom demand, in 100% of UK ransomware incidents, we were able to help the clients get back up running and return to normal operations without the payment.”
- In 2025, overall global claims frequency rose 3% YoY; meanwhile, global claims severity decreased 19% YoY to an average loss of GBP 87,000. This suggests that while attackers are knocking on the door more often, businesses that partner with Coalition are becoming more effective at limiting the damage if a breach occurs.
- BEC claims frequency rose 15% YoY, and severity decreased 28% YoY to an average loss of GBP 20,320. What makes BEC especially dangerous is that it often serves as a gateway to more severe cyber attacks, such as FTF.
- FTF was the second-most common type of cyber event, accounting for 27% of claims. FTF claims frequency decreased 18% YoY, and severity decreased 14% YoY to an average loss of GBP 106,136. Coalition clawed back GBP 16.4 million in stolen funds for policyholders, with an average recovery of GBP 152,053. The sooner policyholders report suspicious activity, the more likely Coalition is to recover some of the stolen funds or the full amount.
- In 2025, dual extortion ransomware, in which threat actors simultaneously encrypt systems and exfiltrate data, was the dominant threat, accounting for 70% of all ransomware claims. Additionally, ransomware attacks involving data theft were more than two times more expensive.
- Businesses with more than GBP 100 million in revenue continue to experience cyber claims more often than any other business segment. These businesses faced a claims frequency five times higher than that of smaller organisations. Larger organisations present a massive attack surface, yet also possess more resources to contain threats. Claims severity for this group fell 7% YoY to an average loss of GBP 201,700. While still the highest loss amount of any revenue band, the steady decline from 2024 suggests that large businesses leveraging Coalition Control are becoming more effective at containment.
- Active Insurance is proven to help businesses by shifting from a passive policy to an active relationship. In 2025, 64% of closed claims received by Coalition were resolved with no out-of-pocket loss for the policyholder.
This report presents statistics, charts, and risk insights derived from data collected from Coalition’s more than 100,000 policyholders in the United States, Canada, the United Kingdom, Australia, and Germany. All financial numbers in the report are presented in US dollars.
Download the full 2026 Cyber Claims Report from Coalition to learn more: https://www.coalitioninc.com/en-gb/claims-report/2026.
Be the first to comment