Coalition’s 2026 Cyber Claims Report Finds Initial Ransom Demands Surged 47%

Business email compromise and funds transfer fraud still comprise the majority of cyber insurance claims, data shows

LONDON — 6 March 2026 — Coalition, the world's first Active Insurance provider designed to help prevent digital risk before it strikes, today released the findings of its 2026 Cyber Claims Report, revealing that initial ransom demands in the full-year 2025 surged 47% year-over-year (YoY). However, while ransomware actors substantially increased their demands, a record 86% of businesses did not pay, suggesting that organisations benefit from having the rapid resources of Coalition’s Claims Team and its vendor partners in responding to these business impacting events.

Rob Jones, Coalition’s Global Head of Claims said: “The data suggests a turning point in the economics of ransomware: while threat actors escalate their demands to push for higher, seven-figure payouts, cyber insurer support is helping businesses limit losses and is starting to help tip the scales back in favor of defenders. Ultimately, we’re seeing the continuous partnership that Active Insurance offers between Coalition and our policyholders is reshaping the loss profile of cyber insurance and creating better outcomes.”

While ransomware was the most costly type of claim in 2025 with an average loss of GBP 202,000, business email compromise (BEC) and funds transfer fraud (FTF) still accounted for the majority (58%) of cyber incidents that Coalition observed. Further, among all 2025 FTF claims, 52% originated from BEC, indicating that BEC is a catalyst for FTF, but not a prerequisite, and businesses must adequately prepare to defend against both email-enabled and email-independent pathways to financial fraud.

Laura Stewart, Coalition’s UK Head of Claims commented: “We saw significant ransomware headlines in the UK in 2025, and an uptick in clients looking to improve their cyber maturity. Over 80% of UK policyholders engaged with our Coalition Control® cyber risk management platform in 2025. While 86% of our global policyholders did not pay a ransom demand, in 100% of UK ransomware incidents, we were able to help the clients get back up running and return to normal operations without the payment.”

Additional key takeaways from the report include:

In 2025, overall global claims frequency rose 3% YoY; meanwhile, global claims severity decreased 19% YoY to an average loss of GBP 87,000. This suggests that while attackers are knocking on the door more often, businesses that partner with Coalition are becoming more effective at limiting the damage if a breach occurs.
BEC claims frequency rose 15% YoY, and severity decreased 28% YoY to an average loss of GBP 20,320. What makes BEC especially dangerous is that it often serves as a gateway to more severe cyber attacks, such as FTF.
FTF was the second-most common type of cyber event, accounting for 27% of claims. FTF claims frequency decreased 18% YoY, and severity decreased 14% YoY to an average loss of GBP 106,136. Coalition clawed back GBP 16.4 million in stolen funds for policyholders, with an average recovery of GBP 152,053. The sooner policyholders report suspicious activity, the more likely Coalition is to recover some of the stolen funds or the full amount.
In 2025, dual extortion ransomware, in which threat actors simultaneously encrypt systems and exfiltrate data, was the dominant threat, accounting for 70% of all ransomware claims. Additionally, ransomware attacks involving data theft were more than two times more expensive.
Businesses with more than GBP 100 million in revenue continue to experience cyber claims more often than any other business segment. These businesses faced a claims frequency five times higher than that of smaller organisations. Larger organisations present a massive attack surface, yet also possess more resources to contain threats. Claims severity for this group fell 7% YoY to an average loss of GBP 201,700. While still the highest loss amount of any revenue band, the steady decline from 2024 suggests that large businesses leveraging Coalition Control are becoming more effective at containment.
Active Insurance is proven to help businesses by shifting from a passive policy to an active relationship. In 2025, 64% of closed claims received by Coalition were resolved with no out-of-pocket loss for the policyholder.

This report presents statistics, charts, and risk insights derived from data collected from Coalition’s more than 100,000 policyholders in the United States, Canada, the United Kingdom, Australia, and Germany. All financial numbers in the report are presented in US dollars.

Download the full 2026 Cyber Claims Report from Coalition to learn more: https://www.coalitioninc.com/en-gb/claims-report/2026.

About Coalition

Coalition is the world's first Active Insurance provider designed to help prevent digital risk before it strikes. Active Insurance combines comprehensive insurance coverage and proven cybersecurity tools to make cybersecurity easier to manage and less costly for businesses. Leveraging its relationships with leading global insurers and capacity providers, including Coalition Insurance Company, Coalition offers its Active Insurance products to businesses around the world. Coalition customers can receive AI-informed security alerts, expert advice, and other cybersecurity tools through its cyber risk management platform, Coalition Control. Customers can also access incident response services through its affiliate Coalition Incident Response, which also offers additional security products and services, including automated Managed Detection and Response by Wirespeed™. Founded in 2017, Coalition is a remote-first company with employees supporting over 100,000 policyholders worldwide. To learn more about Active Insurance, visit: www.coalitioninc.com/en-gb.

The descriptions contained in this communication are for preliminary informational purposes only. Coalition is a trading name of Coalition Risk Solutions Ltd., which is an appointed representative of Davies MGA Services Limited, a company authorised and regulated by the Financial Conduct Authority (FCA), registration number 597301, to carry on insurance distribution activities. You may check this on the FCA register by visiting the FCA website www.fca.org.uk. Coalition Risk Solutions Ltd. is registered in England and Wales: company number 13036309. Registered office: 34-36 Lime Street, London, United Kingdom, EC3M 7AT. See Terms of Service and Disclaimers. Coalition is the marketing name for the global operations of affiliates of Coalition, Inc. Copyright © 2026. All rights reserved. Coalition, Coalition Control, and the Coalition logo are trademarks of Coalition, Inc.