Ransomware losses hit $5.3m as insurance payouts fall short

The average ransom demand reached $3.8m whilst actual payments averaged $1.5m.

Cyber insurance has covered the majority of corporate losses, with insurance policies paying out roughly $1b, covering more than 95% of average data breach losses and 90% of direct corporate losses. 

Willis’ analysis, Cyber claims in Focus – Getting value from cyber insurance, of 5,500 cyber insurance claims spanning 95 countries from 2013 to early 2026, found that whilst cyberattacks are growing more severe, companies that buy coverage are largely getting their claims paid.

However, the data reveals a stark gap between what cyber criminals demand and what insurance actually covers. 

Nowhere is this clearer than in ransomware attacks, which now cause the most serious financial damage due to prolonged company downtime. 

Whilst the average ransom demand has climbed to $3.8m, the actual average payout drops to $1.5m. 

When factoring in disrupted productivity and business suspension, the average total cost of a single ransomware event is $5.3m, with the longest disruptions stretching to 25 days. 

The largest single loss recorded in the data exceeded $500m.

The report also clarifies how hackers break into systems. Direct attacks on a company’s own network account for 58% of ransomware reports but represent a massive 95% of all financial costs. 

Conversely, attacks that slip in through a third-party vendor account for 42% of reports but cause just 5% of the total damage.

Outside of ransomware, data breaches remain the most common insurance claim, mostly driven by malicious intent. Third-party vendors are responsible for nearly half of all data breach losses and 29% of direct corporate losses. 

When these outside partners fail, IT, tech, and telecom companies are to blame 50% of the time, followed by financial institutions at 17% and administrative services at 11%. 

Additionally, the report highlighted data-tracking tools, specifically pixel-tracking litigation, as an emerging and underestimated risk triggering widespread insurance losses.

Different industries face heavily skewed risk levels. Healthcare businesses lead the world in cyber insurance claims, accounting for 20% of all notifications. 

Financial institutions follow at 16%, and manufacturing companies make up 13%.

Conor Keating, Willis’s head of cyber in Asia, noted that whilst artificial intelligence has not yet triggered stand-alone insurance claims, it is already making existing threats like deepfake phishing and ransomware more potent. 

Because an average attack now tops $5m, Keating stated that businesses across Asia are increasingly scrutinising whether their insurance policy limits are actually high enough to cover a worst-case scenario. 

Industry executives stress that standard insurance policies vary widely. 

Peter Foster, chairman of global FINEX cyber at Willis, cautioned that companies frequently pay for coverage that does not align with their actual vulnerabilities, leaving them exposed to critical financial gaps when an attack occurs.