Coalition’s 2026 Cyber Claims Report Finds Initial Ransom Demands Surged 47% — But Most Businesses Refuse to Pay

Business email compromise and funds transfer fraud still comprise the majority of cyber insurance claims, data shows

Vancouver, BC (Mar. 5, 2026) — Coalition, the world’s first Active Insurance provider designed to help prevent digital risk before it strikes, has released the findings of its 2026 Cyber Claims Report, revealing that initial ransom demands in the full-year 2025 surged 47% year-over-year (YoY). However, while ransomware actors substantially increased their demands, a record 86% of businesses refused to pay, suggesting that organisations have improved their cyber resiliency with viable data backups and incident response plans.

“The data suggests a turning point in the economics of ransomware: while threat actors escalate their demands to push for higher, seven-figure payouts, cyber insurer support is helping businesses limit losses and is starting to help tip the scales back in favor of defenders,” said Rob Jones, Coalition’s Global Head of Claims. “Ultimately, we’re seeing the continuous partnership that Active Insurance offers between Coalition and our policyholders is reshaping the loss profile of cyber insurance and creating better outcomes.”

While ransomware was the most costly type of claim in 2025 with an average loss of USD $269,000, business email compromise (BEC) and funds transfer fraud (FTF) still accounted for the majority (58%) of cyber incidents that Coalition observed. Further, among all 2025 FTF claims, 52% originated from BEC, indicating that BEC is a catalyst for FTF, but not a prerequisite, and businesses must adequately prepare to defend against both email-enabled and email-independent pathways to financial fraud.

“Understandably, ransomware generates headlines, and while we’re encouraged to see more organisations willing to walk away from extortion demands, our claims data shows that old-fashioned email-based crime hasn’t gone anywhere,” continued Jones. “BEC and FTF are still powered by social engineering, which targets the individual, and those attacks can be just as damaging to businesses.”

Additional key takeaways from the report include:

• In 2025, overall global claims frequency rose 3% YoY; meanwhile, global claims severity decreased 19% YoY to an average loss of USD $116,000. This suggests that while attackers are knocking on the door more often, businesses are becoming more effective at limiting the damage if a breach occurs.
• BEC claims frequency rose 15% YoY, and severity decreased 28% YoY to an average loss of USD $27,000. What makes BEC especially dangerous is that it often serves as a gateway to more severe cyber attacks, such as FTF.
• FTF was the second-most common type of cyber event, accounting for 27% of claims. FTF claims frequency decreased 18% YoY, and severity decreased 14% YoY to an average loss of USD $141,000. Coalition clawed back USD $21.8 million in stolen funds for policyholders, with an average recovery of USD $202,000. The sooner policyholders report suspicious activity, the more likely Coalition is to recover some of the stolen funds or the full amount.
• In 2025, dual extortion ransomware, in which threat actors simultaneously encrypt systems and exfiltrate data, was the dominant threat, accounting for 70% of all ransomware claims. Additionally, ransomware attacks involving data theft were more than two times more expensive.
• Businesses with more than USD $100 million in revenue continue to experience cyber claims more often than any other business segment. These businesses faced a claims frequency five times higher than that of smaller organisations. Larger organisations present a massive attack surface, yet also possess more resources to contain threats. Claims severity for this group fell 7% YoY to an average loss of USD $268,000. While still the highest loss amount of any revenue band, the steady decline from 2024 suggests that large businesses are becoming more effective at containment.
• Active Insurance is proven to help businesses by shifting from a passive policy to an active relationship. In 2025, 64% of closed claims received by Coalition were resolved with no out-of-pocket loss for the policyholder.

This report presents statistics, charts, and risk insights derived from data collected from Coalition’s more than 100,000 policyholders in the United States, Canada, the United Kingdom, Australia, and Germany. All financial numbers are presented in US dollars.

To learn more, download the full 2026 Cyber Claims Report from Coalition.

About Coalition

Coalition is the world’s first Active Insurance provider designed to help prevent digital risk before it strikes. Active Insurance combines comprehensive insurance coverage and proven cybersecurity tools to make cybersecurity easier to manage and less costly for businesses. Leveraging its relationships with leading global insurers and capacity providers, including Coalition Insurance Company, Coalition offers its Active Insurance products to businesses around the world. Coalition customers can receive AI-informed security alerts, expert advice, and other cybersecurity tools through its cyber risk management platform, Coalition Control®. Customers can also access incident response services through its affiliate Coalition Incident Response, which also offers additional security products and services, including automated Managed Detection and Response by Wirespeed™. Founded in 2017, Coalition is a remote-first company with employees supporting over 100,000 policyholders worldwide. For more information, visit www.coalitioninc.com.

Insurance products are offered in Canada by Coalition Insurance Solutions Canada, Inc. (“CIS Canada”), a licensed insurance producer in all Canadian provinces, with a principal place of business in Vancouver, British Columbia (Canada) (license #LIC-2020-0020925-R01), acting on behalf of a number of unaffiliated insurance companies. Insurance products offered through CIS Canada may not be available in all provinces. See licenses and disclaimers.

Coalition is the marketing name for the global operations of affiliates of Coalition, Inc.

Copyright © 2026. All rights reserved. Coalition, Coalition Control, and the Coalition logo are trademarks of Coalition, Inc.

SOURCE: Coalition via Omnia Partners

Tags: Coalition Inc., cyber attacks, InsurTech, InsurTech Spotlight