Cyber Insurance News report on cyber losses exceeding insurance claims, showing an iceberg with a small tip above the water and a large mass below

Cyber Losses Run Up To 140 Times The Top Insurance Claims, Cyberwrite Finds

by

Estimated reading time: 6 minutes

Major cyberattacks cost victims far more than cyber insurance claims record, new Cyberwrite research finds. Several small firms in its cases closed for good. The company says insurers should size limits to the full economic loss.

Cyber insurance claims capture only part of what an attack costs. New research from Cyberwrite measures how far the full losses run beyond them.

“Many organizations are underinsured against cyber,” Cyberwrite says.

Cyberwrite compared 26 documented incidents from 2013 to 2025 with claim figures from the 2026 Breach Impact Study. Verizon’s Data Breach Investigations Report (DBIR) team produced the study. CyberAcuView supplied claims data from its member insurers. The study covers 69,683 claims for incidents from January 2019 through October 2025.

Cyberwrite is a New York cyber risk quantification company. It sells underwriting reports, catastrophe modeling, and vendor risk tools to insurers, brokers, and corporations. Cyberwrite recommends sizing limits to ground-up economic loss, which its models estimate.

Big Company Losses Exceed The Top Cyber Insurance Claims

In the study, half of large-enterprise claims exceeded about $283,000. The top 2.5% exceeded $22 million. Large enterprises are companies with revenue above $250 million.

Every large-company loss in Cyberwrite’s research exceeded that $22 million mark. Change Healthcare’s roughly $3.1 billion impact in 2024 ran about 140 times the mark, based on UnitedHealth Group’s results. Equifax’s 2017 breach cost more than $1.4 billion. Clorox sought about $380 million over its 2023 attack in a lawsuit against Cognizant, its IT help desk provider. Synnovis, which runs pathology services for the NHS, put its impact at £32.7 million. That is about $42 million, roughly twice the mark.

Ten large-enterprise cyber losses, from Synnovis at about $42 million to Change Healthcare at about $3.1 billion, against the 2026 Breach Impact Study’s $283,000 median and $22 million top-2.5% claim figures.

For Small Firms, The Economic Loss Was The Business

The study’s median claim for small and medium-sized businesses is about $38,000. Cyberwrite’s smaller cases show a different scale of loss.

See also  Agent Identity Becomes an Underwriting Question: Can You Account for Your AI Agents?

Lincoln College paid a ransom of under $100,000 in 2022. Its recruitment and fundraising systems stayed down for three months. The Illinois college, which also cited the pandemic, closed after 157 years. “The loss of history, careers, and a community of students and alumni is immense,” President David Gerlach said in a statement reported by NPR. The Heritage Company, a telemarketer, paid a ransom in 2019 but could not restore its systems. It shut down, and about 300 people lost their jobs. Brookside ENT and Hearing Center refused a $6,500 ransom. The attackers wiped its files, and the practice closed.

KNP Logistics, a 158-year-old UK haulier, collapsed after a 2023 Akira ransomware attack. About 730 jobs were lost. Its £1 million cyber policy was not enough to recover, according to Cyberwrite.

Why Cyber Insurance Claims Understate Losses

Cyberwrite gives three reasons. Claims leave out uninsured costs and amounts below the deductible. Sublimits, policy limits, and layered towers cap what a claim records. And claims develop for years as investigations and lawsuits run.

Coverage disputes widen the gap. National Bank of Blacksburg lost $2.4 million in two intrusions in 2016 and 2017. Its insurer offered $50,000 under a debit card rider. The bank sought payment under an $8 million computer crime rider and sued. Merck and Mondelez fought insurers for years over war exclusions after the 2017 NotPetya attack.

Systemic events spread losses across many policyholders. The 2024 CDK Global outage cost about 15,000 US auto dealers an estimated $1.02 billion, according to Anderson Economic Group. The Cyber Monitoring Centre estimated the 2025 Jaguar Land Rover attack cost the UK £1.9 billion. That loss reached more than 5,000 organizations.

See also  2025 Cybersecurity Trends - AI Risks and Soaring Attack Costs

Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!

What The Economic Loss Comparison Leaves Out

The cases are selected examples of severe losses. Cyberwrite says they are not a frequency rate or a survival rate. Failed companies appear more often in public records because failure forces disclosure, Cyberwrite says.

The study itself calls insured losses a potential floor on economic impact. It does not estimate uninsured losses or reputational damage.

Cyberwrite derived the small-business and mid-market benchmarks from statements in the study. The study publishes the $22 million large-enterprise figure directly.

Cyberwrite also sized the benchmark to each company’s revenue. It calls those estimates indicative for the largest firms. On that basis, Maersk’s loss roughly matched its benchmark. Mondelez’s and MGM Resorts’ losses came in below theirs.

Cyberwrite also ran its own loss model on each company. For five of the 10 large enterprises, the documented loss exceeded the model’s 1-in-100 estimate. Change Healthcare’s $3.1 billion compares with a modeled $231 million. Cyberwrite says the model describes a typical company of that size and sector. It does not reconstruct the specific incident.

Cyber Limits Sized To The Full Loss

Cyberwrite says insurers should keep using claims data to estimate what a policy is likely to pay. Limits, pricing and portfolio accumulation should rest on ground-up economic loss. For a small firm, the question is often whether the business survives, it adds.

“A limit sized to the typical claim does not cover a serious incident,” Cyberwrite says.

FAQ – Cyber Insurance Claims

Do cyber insurance claims capture the full cost of an attack?

No. Claims leave out uninsured costs and amounts below the deductible. Sublimits and policy limits cap what a claim records.

See also  Third-Party Cyber Risk Drove Major Financial Losses in 2024, Resilience Finds

How large is the gap at big companies?

In Cyberwrite’s 10 large-enterprise cases, losses ran about 2 to 140 times the Breach Impact Study’s top 2.5% claim figure of more than $22 million.

What happened to the smaller firms in the study?

Several closed. Lincoln College, The Heritage Company and Brookside ENT shut down after ransomware. KNP Logistics collapsed despite a £1 million cyber policy.

What is the 2026 Breach Impact Study?

A study by Verizon’s DBIR team with claims data from CyberAcuView. It covers 69,683 cyber insurance claims for incidents from 2019 through October 2025.

Are Cyberwrite’s cases typical?

No. They are selected examples of severe losses. Cyberwrite says they show the size of the gap, not how often such losses happen.

What does Cyberwrite recommend?

Use claims data to estimate what a policy will pay. Size limits, pricing and portfolio accumulation to the full economic loss.

Martin Hinton
Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.

Leave a Comment

×