5 Essential Insights From Our 2026 Cyber Claims Report

In an era of record-breaking cybersecurity spending, the threat landscape continues to shift at an unprecedented pace. Businesses are investing more than ever in their digital defenses, yet many find themselves caught in the Cyber Protection Paradox:

More security tools and increased spending isn’t making businesses any safer. In fact, businesses are now two times more likely to experience a cyber incident than they were five years ago.

Attackers are working smarter, pivoting from simple encryption to complex data extortion and system-level financial fraud. To break this cycle, businesses need more than just shiny new tools; they need a clear-eyed understanding of how losses are actually occurring across the digital economy.

Today, we’re releasing our 2026 Cyber Claims Report, derived from our analysis of Coalition’s 100,000+ global policyholders and real-world claims. Below, we’ve identified five essential insights that illustrate how Coalition is helping businesses overcome the Cyber Protection Paradox and prioritize resilience with Active Insurance.

1. 64% of Closed Claims Resolved with No Out-of-Pocket Loss

Perhaps the most powerful proof of the benefits of Active Insurance is how it helps protect policyholders’ bottom lines. In 2025, 64% of closed claims were resolved with zero out-of-pocket loss for the policyholder.*

Our goal isn't simply to help cover losses after an incident, but to identify, intercept, and stop threats before they ever touch our policyholders' capital. By intervening at the moment of impact and providing in-house expertise, we’re redefining what it means to be "covered."

2. Data Exfiltration is the New Ransomware Multiplier

Encryption alone is no longer the primary driver of ransomware severity. Attacks involving data exfiltration and encryption accounted for 70% of all ransomware claims in 2025.

When an attacker steals sensitive data, the claim typically doesn't end with a system restore. It can ignite a long-tail cycle of forensic mining and legal liability. These dual-extortion incidents were 2x more expensive than those involving encryption alone, reaching an average cost of $302,000.

3. A Record 86% of Businesses Refused to Pay Ransoms

While initial ransom demands jumped 47% year over year to more than $1 million, businesses are finally reclaiming the leverage. In 2025, a record 86% of Coalition policyholders hit by ransomware attacks refused to pay the demand.

This milestone signals a massive shift in defensive maturity. By utilizing robust recovery protocols and specialized negotiation teams, businesses are proving that they no longer have to be passive payers.

4. New Pathways to Funds Transfer Fraud

Business inboxes remain the primary battlefield for financial loss, but our report reveals a technical evolution: 20% of all funds transfer fraud (FTF) events were driven by fraudulent instructions sent directly to banks, bypassing employee interaction entirely.

Perhaps even more surprising: 39% of FTF events occurred without any confirmed email compromise. Rather than spending weeks manipulating an employee through social engineering, attackers are increasingly using compromised credentials to directly target financial systems, a shift toward faster, more silent fraud.

5. $21.8M in Wire Fraud Clawed Back for Policyholders

When funds are stolen, the first 48 hours often determine whether that money is lost forever or successfully recovered in whole or in part. In 2025, Coalition successfully recovered $21.8 million in stolen funds on behalf of policyholders, with an average recovery of $202,000 per incident.

Clawbacks are one of the more tangible examples of how Active Insurance can help policyholders recover from financial fraud. Through rapid coordination with financial institutions and law enforcement, we’ve clawed back over $158 million to date.*

From Passive Coverage to Active Insurance

The findings in our 2026 Cyber Claims Report make one thing clear: The legacy playbook of traditional cyber insurance isn’t enough in a risk landscape where attackers move at machine speed and ransom demands are more aggressive than ever.

The data proves that the Cyber Protection Paradox doesn’t have to be an inevitability for businesses that take an active approach to cyber risk. When businesses embrace Active Insurance by acting on real-time risk alerts and leveraging expert incident response, they don't just survive attacks — they can stop them in their tracks.

Want to go deeper on claims insights? The 2026 Cyber Claims Report features new data on pathways to financial fraud, ransomware attack tactics, emerging web privacy risks, and more.

DISCOVER THE POWER OF ACTIVE INSURANCE

2026 Cyber Claims Report

Download the full report today >

*Every claim is unique. Claim scenarios and outcomes are for illustrative purposes only, and are intended to show how a claim may be (but not necessarily will be) evaluated and handled. These statements are not guarantees of future outcomes or coverage determinations. Whether a specific loss is covered by a policy depends on the unique facts of the event, the actual policy language as issued, and applicable law.

This blog post is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional services are required, the services of a professional should be sought. The views and opinions expressed as part of this blog post do not necessarily state or reflect those of Coalition. The reader is cautioned to consult independent professional advisors and formulate independent conclusions and opinions regarding the subject matter discussed herein. Coalition makes no representations as to the accuracy or completeness of this content. Any action taken based on this information is at the sole discretion and risk of the reader. Coalition and its affiliates expressly disclaim any liability for losses or damages resulting from the use of or reliance on this information, which is used strictly at the reader’s own risk. 

Copyright © 2026. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc.