5 Essential Insights From Our 2026 Cyber Claims Report
In an era of record-breaking cybersecurity spending, the threat landscape continues to shift at an unprecedented pace. Businesses are investing more than ever in their digital defenses, yet many find themselves caught in the Cyber Protection Paradox:
More security tools and increased spending isn’t making businesses any safer. In fact, businesses are now two times more likely to experience a cyber incident than they were five years ago.
Attackers are working smarter, pivoting from simple encryption to complex data extortion and system-level financial fraud. To break this cycle, businesses need more than just shiny new tools; they need a clear-eyed understanding of how losses are actually occurring across the digital economy.
Today, we’re releasing our 2026 Cyber Claims Report, derived from our analysis of Coalition’s 100,000+ global policyholders and real-world claims. Below, we’ve identified five essential insights that illustrate how Coalition is helping businesses overcome the Cyber Protection Paradox and prioritize resilience with Active Insurance.
1. 64% of Closed Claims Resolved with No Out-of-Pocket Loss
Perhaps the most powerful proof of the benefits of Active Insurance is how it helps protect policyholders’ bottom lines. In 2025, 64% of closed claims were resolved with zero out-of-pocket loss for the policyholder.*
Our goal isn't simply to help cover losses after an incident, but to identify, intercept, and stop threats before they ever touch our policyholders' capital. By intervening at the moment of impact and providing in-house expertise, we’re redefining what it means to be "covered."
2. Data Exfiltration is the New Ransomware Multiplier
Encryption alone is no longer the primary driver of ransomware severity. Attacks involving data exfiltration and encryption accounted for 70% of all ransomware claims in 2025.
When an attacker steals sensitive data, the claim typically doesn't end with a system restore. It can ignite a long-tail cycle of forensic mining and legal liability. These dual-extortion incidents were 2x more expensive than those involving encryption alone, reaching an average cost of $302,000.
3. A Record 86% of Businesses Refused to Pay Ransoms
While initial ransom demands jumped 47% year over year to more than $1 million, businesses are finally reclaiming the leverage. In 2025, a record 86% of Coalition policyholders hit by ransomware attacks refused to pay the demand.
This milestone signals a massive shift in defensive maturity. By utilizing robust recovery protocols and specialized negotiation teams, businesses are proving that they no longer have to be passive payers.
4. New Pathways to Funds Transfer Fraud
Business inboxes remain the primary battlefield for financial loss, but our report reveals a technical evolution: 20% of all funds transfer fraud (FTF) events were driven by fraudulent instructions sent directly to banks, bypassing employee interaction entirely.
Perhaps even more surprising: 39% of FTF events occurred without any confirmed email compromise. Rather than spending weeks manipulating an employee through social engineering, attackers are increasingly using compromised credentials to directly target financial systems, a shift toward faster, more silent fraud.
5. $21.8M in Wire Fraud Clawed Back for Policyholders
When funds are stolen, the first 48 hours often determine whether that money is lost forever or successfully recovered in whole or in part. In 2025, Coalition successfully recovered $21.8 million in stolen funds on behalf of policyholders, with an average recovery of $202,000 per incident.
Clawbacks are one of the more tangible examples of how Active Insurance can help policyholders recover from financial fraud. Through rapid coordination with financial institutions and law enforcement, we’ve clawed back over $158 million to date.*
From Passive Coverage to Active Insurance
The findings in our 2026 Cyber Claims Report make one thing clear: The legacy playbook of traditional cyber insurance isn’t enough in a risk landscape where attackers move at machine speed and ransom demands are more aggressive than ever.
The data proves that the Cyber Protection Paradox doesn’t have to be an inevitability for businesses that take an active approach to cyber risk. When businesses embrace Active Insurance by acting on real-time risk alerts and leveraging expert incident response, they don't just survive attacks — they can stop them in their tracks.
Want to go deeper on claims insights? The 2026 Cyber Claims Report features new data on pathways to financial fraud, ransomware attack tactics, emerging web privacy risks, and more.
DISCOVER THE POWER OF ACTIVE INSURANCE
2026 Cyber Claims Report
Download the full report today >