Privacy Litigation Emerges As A Standout Risk In Chubb’s 2026 Cyber Claims Report

Estimated reading time: 6 minutes

The jump-out fact in most reporting is clear. Cyber claim frequency stabilized, but severity rose. That pattern hit large U.S. companies hardest. Chubb’s report shows average large-account claim severity in the U.S. rose to $4.43 million in 2025, up from $2.22 million in 2024. That’s about a 100% year-over-year jump. Middle-market severity also stayed elevated, while SME severity declined.

That headline matters. It explains premium pressure and underwriting caution. It also fits the report’s central theme: cyber risk now moves faster, spreads wider, and costs more when it lands. Chubb calls this “the velocity of risk.” The report ties that shift to artificial intelligence, litigation, and supply-chain interdependence.

Why Privacy Litigation Deserves More Attention

We noticed several other key points in the report. Privacy litigation stood out the most. Chubb notes that a cyber incident now often leads to legal action within days. The report describes a growing “litigation-first reflex.” This is important because it means companies face legal risks early, sometimes before all the technical details are clear.

Chubb privacy litigation graphic with a digital spider web background showing cyber claims, cyber insurance risk, privacy claims, cyber litigation, tracking pixel litigation, and data privacy lawsuit exposure in the 2026 Cyber Claims Report

Chubb ties this surge to old wiretapping laws, video privacy laws, tracking tech, and mass arbitration. Plaintiff firms weaponize statutes like the California Invasion of Privacy Act against ordinary web tools, such as pixels. Companies now face staggering “substantial upfront administrative fees” in mass arbitration, $10 million in cases with 10,000 claimants, even before courts intervene.

This is a major concern for cyber insurance. Even a simple website script can now lead to legal costs as high as those from a major breach. The main point is that everyday digital tools can create big financial risks if they are not managed carefully.

The Pixel Problem Gets Expensive Fast

Chubb’s example from the middle market shows how quickly privacy litigation can grow. The company ran a subscription website and app that used cookies and pixels, which shared user data with third parties. Law firms sent thousands of pre-arbitration demands under California privacy law. Chubb said this case could have cost over $40 million, but it was eventually settled for about $6.5 million.

The takeaway: privacy claims now erupt from routine digital operations. No ransomware, encryption, or network breach required. Fail at analytics or consent, and litigation lands fast.

AI Changes The Speed Of Attack And Defense

The report highlights AI as a central issue. Chubb says that attackers now use advanced AI to break into systems in just minutes. The report warns that there is less time for people to respond. It points out that AI-powered malware can adapt quickly and describes ‘digital locusts’ that swarm networks with targeted attacks.

Chubb also warns about deepfakes that impersonate executives and lead to fraudulent money transfers. The insurer recommends using AI-powered security, strong AI rules, and thorough employee training to fight deepfake and phishing threats. The report also points out other AI risks, like employees uploading sensitive data to public AI tools.

The point: faster attacks require faster detection, tougher governance, and intensive user training.

Watch Our Podcast: Willis’ Peter Foster on Pixels, Privacy and Claims

Ransomware Still Hurts, Especially In Smaller Organizations

Ransomware continues to cause big losses. Chubb’s example involving a small or medium-sized business shows this clearly. Although endpoint detection stopped full encryption, attackers still stole health data and Social Security numbers for more than 4 million people. Chubb reported a total reimbursed loss of $4.7 million. Just notifying victims cost $2.4 million, and credit monitoring added another $1.2 million.

The lesson: Partial technical wins still drive major losses. Data theft, notification, and remediation hammer organizations regardless.

Supply Chains Keep Spreading Losses Across Markets

Interconnectedness increases risk. Companies now view their vendors as major sources of risk. According to the World Economic Forum, 65% of large firms see third-party and supply chain vulnerabilities as a top concern for 2026, up from 54% in 2025.

Recent events paint the picture. The Jaguar Land Rover incident in the UK halted production for five weeks. The U.K. economy lost an estimated £1.9 billion; JLR alone posted a £485 million pre-tax loss.

In the U.S., Chubb points to the Oracle Health breach. Attackers got into old Cerner migration servers that had not yet moved to Oracle Cloud, exposing records from about 80 hospitals. This incident highlights the dangers of neglected legacy systems.

Phishing Still Leads Initial Access

Chubb’s data is clear: Phishing was still the main way attackers started ransomware events in 2025. Remote service exploitation was the next most common method. Attacks using severe vulnerabilities dropped from 22% in 2022 to 9.5% in 2025.

Critical patching has improved, but social engineering remains the primary everyday threat.

Get The Cyber Insurance News Upload Delivered
Subscribe to our newsletter!

What The Report Says About The Market

The outlook is still serious. After 2021, the number of incidents went up in many areas. The cost per incident kept rising, especially for large U.S. companies. In Europe and the UK, costs were lower, mainly because third-party litigation was less expensive. Australia and New Zealand showed a similar pattern, with fewer incidents and only small increases in severity.

The main takeaway from the report is that cyber losses now come from technical problems, legal issues, and business connections all at once. This means that even if the number of incidents seems steady, the costs can still go up.

FAQ: Privacy Litigation And Cyber Claims

1. What is privacy litigation in this report?

It refers to lawsuits and arbitration tied to privacy, tracking, consent, and data handling.

2. Why does privacy litigation matter to cyber insurance?

It can create defense costs, settlements, arbitration fees, and regulatory exposure.

3. What technologies create this risk?

Chubb highlights pixels, cookies, tracking tools, and data-sharing practices.

4. Did Chubb provide a major example?

Yes. One middle-market privacy dispute carried potential exposure above $40 million.

5. How much did that case resolve for?

Chubb says the claims resolved globally in the range of $6.5 million.

6. What does the report say about AI?

AI speeds both attacks and defenses. It also creates new governance and data leakage risks.

7. What was the biggest U.S. severity change?

Large-account average severity rose to $4.43 million in 2025.

8. What initial access method led to ransomware cases in 2025?

Phishing and social engineering led the list.

9. Why do supply chains matter so much?

Third-party failures can trigger broad business interruption and legal fallout.

10. What is the main editorial takeaway?

Privacy litigation has become one of the most important drivers of cyber claims.

Martin Hinton

Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.