Ransoms Above $10m Went From 15 To 59 In Two Years. cyber insurance news coverage

Ransoms Above $10m Went From 15 To 59 In Two Years

by

Estimated reading time: 7 minutes

Two years ago, NetDiligence counted 15 ransom payments of $10m or more across its entire claims dataset. This year it counted 59.

The sixteenth annual Cyber Claims Study, published on 15 September, analyses 10,309 real cyber insurance claims from incidents between 2021 and 2025, contributed directly by cyber insurers. Against the 2024 edition, which covered 2019 to 2023, the tail of the distribution has not just grown. It has changed shape.

Initial ransom demands ran as high as $80m in the 2024 study. This year the highest demand was $500m. The largest payment moved from $50m to $90m.

Total incident cost across the analyzed claims rose from $3.9bn to $5.7bn.

The Bigger The Claim, The Faster The Band Grew

Compare the two studies band by band and the shape of the change becomes clear.

Claims above $100m went from 5 to 12. Claims between $10m and $99m went from 40 to 68. Finally, claims between $1m and $10m went from 361 to 403. That is a 140% increase at the top, 70% in the middle, and 12% at the bottom. The distribution did not shift. It stretched.

One detail cuts against the obvious reading. In both studies, two of the claims above $100m occurred at organizations with less than $700m in annual revenue. The count held at two while the band more than doubled, so mid-market representation in that top tier fell rather than rose.

The point still stands for anyone pricing a mid-market book. A company well under $1bn in revenue has produced a nine-figure claim in each of the past three editions. It is not becoming more common. It was already possible.

Among SMEs, defined here as organizations under $2bn in revenue, there were 381 claims at or above $1m, representing 4% of SME claims. Two years ago, the count was 327. At large companies, 92 claims hit $1m or more, which is 28% of that group, up from 79.

Bar chart showing ransom payments of ten million dollars or more rising from 15 in the 2024 NetDiligence study to 59 in the 2026 study

Scale Still Dominates Cyber Insurance Claims Costs

The concentration story has intensified.

Large companies made up 3% of claims and 56% of total incident cost, at $3.2bn of $5.7bn. In the 2024 study, they were 2% of claims and 51% of cost.

See also  Cyber Insurance Claims Data Shows Criminals Shift To Data Theft And Long-Tail Damage

The size gap explains the arithmetic. The average large company in the dataset carries $10.1bn in annual revenue. The average SME carries $105m. The largest organization, above $290bn, is roughly 29 million times the size of the smallest, which sits under $10k.

SME claims totaled $2.5bn, up from $1.9bn two years ago. Large company claims totaled $3.2bn, up from $2.0bn. Both grew. The larger end grew faster.

Business Interruption Is The Multiplier

For claims practitioners, the most useful figures in the study sit in Figure 3.

SME claims involving business interruption averaged $1.9m in total incident cost. Business interruption alone accounted for $1.3m of that, with crisis services adding $334k. The overall SME average incident cost, across all causes, is $266k.

At large companies, the same comparison runs to $67.6m in total incident cost, with $47.7m of it business interruption.

That is the price of recovery time. Cohesity reported this week that 76% of organizations suffering a material attack exceeded their recovery time objective, with recovery averaging nearly twice as long as planned. NetDiligence shows what those extra days cost once they reach a claims file.

One note on the multiplier. NetDiligence’s press release describes incidents involving business interruption as costing more than five times as much on average. The figures in the report work out closer to seven times against the overall average, which suggests the release compares against claims without business interruption rather than against the whole book. Worth pinning down before quoting a number.

Two Causes Of Loss Now Touch Two Thirds Of SME Claims

Ransomware and business email compromise accounted for 51% of SME claims above $1,000 across the five-year period.

In 2025 alone, they accounted for nearly 64%.

That concentration matters more than the individual figures. Two causes of loss now drive close to two-thirds of the SME book, which narrows where prevention spending has to work and where policy wording has to hold.

The two behave completely differently.

Ransomware produced 2,499 SME claims at an average incident cost of $660k. Business email compromise produced 2,170 claims at an average of $100k. Similar frequency, roughly a sixth of the severity.

The growth curves differ too. Fifty-seven percent of the ransomware claims arose from incidents in 2023 to 2025. For business email compromise, the figure is 69%. BEC is accelerating faster.

See also  Microsegmentation Cuts Risk Fast: Lower Cyber Insurance Premiums, Faster Containment

Below those two sit hacker incidents at 1,063 claims averaging $186k, theft of money at 940 claims averaging $52k, and wire transfer fraud at 345 claims averaging $152k.

Take The Cyber Insurance News Survey

Respondents get the results first.

Cyber insurance survey graphic from Cyber Insurance News asking what the market actually sees and whether loss data is good enough, with an eight minute completion time

What SME Claims Cost By Sector

The sector breakdown is the part of this study with no real substitute elsewhere, because it comes from claims rather than surveys.

Average incident cost for SMEs runs highest in financial services at $519k and healthcare at $516k. Manufacturing follows at $383k. Professional services, which produces the largest number of SME claims at 1,777, averages $260k. Retail sits lowest of the top five at $238k.

The overall SME average across 9,235 claims is $266k.

Read those against the 2024 study and the picture has shifted. Then, NetDiligence president Mark Greisiger noted healthcare and manufacturing SMEs benefiting from a modest drop in incident costs while financial services faced a sharp rise. Financial services has now taken the top spot outright, and healthcare has climbed back.

Get The Cyber Insurance News Upload
Subscribe to our weekly newsletter!

How To Read This Study

Three things are worth stating about what the dataset can and cannot tell you.

It is built from insured claims. Uninsured losses, and losses that fell below deductibles or policy triggers, do not appear. Greisiger’s own framing points to this, noting the need to demonstrate financial impact to the Main Street business that remains uninsured or underinsured.

The five-year window rolls, so year-over-year comparisons between editions involve overlapping data. The 2024 study covered 2019 to 2023. This one covers 2021 to 2025. Three years are common to both, which means the trend figures reflect both new incidents and revalued older ones.

And the study takes contributions from participating insurers rather than the whole market. Sponsors this year are RSM, Experian, Surefire Cyber, and Constangy, Brooks, Smith & Prophete.

None of that undermines the headline movement. Fifteen ransom payments above $10m became 59 in two years. The top demand went from $80m to $500m. Those are counts and maxima from real claims files, and they moved in one direction.

See also  AI-Powered Social Engineering Spikes in 2026, Report Warns of Compressed Attack Timelines

FAQ – Cyber Insurance Claims Costs

How much do cyber insurance claims cost on average?

The average SME incident cost is 266,000 dollars across 9,235 claims. Large companies average 11.2 million. Claims involving business interruption run far higher, averaging 1.9 million at SMEs and 67.6 million at large companies.

How high are ransom demands now?

The highest initial demand recorded was 500 million dollars, up from 80 million in the 2024 study. The largest payment was 90 million, up from 50 million. Payments of 10 million or more rose from 15 to 59 in two years.

Do large companies account for most cyber claims costs?

Yes. Large companies represent 3 percent of claims and 56 percent of total incident cost, at 3.2 billion of 5.7 billion dollars. Two years ago the figures were 2 percent and 51 percent.

Can a mid-sized company suffer a nine-figure cyber loss?

The data says yes. Of the 12 claims above 100 million dollars in the dataset, two occurred at organizations with less than 700 million in annual revenue.

What causes most SME cyber claims?

Ransomware and business email compromise, which together accounted for 51 percent of SME claims over the five-year period and nearly 64 percent in 2025 alone. Ransomware averages 660,000 dollars per claim, BEC 100,000.

Martin Hinton
Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.

Leave a Comment

×