{"id":23486,"date":"2025-05-08T15:49:53","date_gmt":"2025-05-08T15:49:53","guid":{"rendered":"https:\/\/www.insurance-canada.ca\/?p=83012"},"modified":"2025-05-08T15:49:53","modified_gmt":"2025-05-08T15:49:53","slug":"coalition-2025-cyber-claims-report-finds-ransomware-stabilized-but-remains-costly-for-businesses","status":"publish","type":"post","link":"https:\/\/blog.lifeinsurance-orleans.ca\/index.php\/2025\/05\/08\/coalition-2025-cyber-claims-report-finds-ransomware-stabilized-but-remains-costly-for-businesses\/","title":{"rendered":"Coalition 2025 Cyber Claims Report Finds Ransomware Stabilized but Remains Costly for Businesses"},"content":{"rendered":"

Majority of 2024 Cyber Insurance Claims Stemmed from Business Email Compromise or Funds Transfer Fraud<\/h3>\n

San Francisco, CA (May 7, 2025) \u2014 Coalition, the world\u2019s first Active Insurance provider designed to prevent digital risk before it strikes, has published its 2025 Cyber Claims Report<\/strong><\/em>, which details emerging cyber trends and their impact on Coalition policyholders throughout the full year of 2024. The report found that ransomware claims stabilized in 2024 despite remaining the most costly and disruptive type of cyberattack. The majority of 2024 claims (60%) originated from business email compromise (BEC) and funds transfer fraud (FTF) incidents, with 29% of BEC events resulting in FTF.<\/p>\n

\u201cOver the past year, our claims data clearly demonstrates one thing: Active Insurance works,\u201d said Robert Jones, Global Head of Claims at Coalition. \u201cCombining Coalition\u2019s Active Data Graph, which provides a massive amount of data insights, with security tools and incident response helps Coalition prevent claims from happening in the first place. And, when matters were reported to Coalition, 56% were handled without any out-of-pocket payments by the policyholder. We believe that this proactive engagement is a critical aspect of reducing global cyber risk.\u201d<\/p>\n

Ransom demands from threat actors decreased in 2024, dropping 22% year-over-year (YoY) to an average of $1.1 million. Notably, the average demand in the latter half of 2024 fell below $1 million for the first time in more than two years. Of all ransomware claims, Akira ransomware was the most prolific variant for Coalition policyholders, accounting for 13% of claims in 2024. The Black Basta variant accounted for just 3% of all ransomware claims, but was the highest in terms of demand, with an average of $4 million.<\/p>\n

\u201cWhile overall claims have stabilized, cyber attackers, and ransomware actors in particular, still pose a tremendous threat to businesses, with the average demand still in the millions of dollars. Unfortunately, ransomware is already back with a vengeance in 2025, as March held the highest volume of public ransomware cases of all time,\u201d continued Jones. \u201cCoalition continues to be an active partner in the fight against bad actors. We alert our policyholders to vulnerabilities in their networks, risky security practices, and the best ways to mitigate threats to reduce the impacts of cyber attacks.\u201d<\/p>\n

In 2024, Coalition\u2019s cooperative efforts with authorities and panel partners contributed to the successful clawback of $31 million for policyholders, with an average recovery of $278,000. Coalition has firsthand knowledge that policyholders that quickly report FTF events have a greater likelihood of recovery. Last month, Coalition introduced a new financial incentive in its Active Cyber Policy<\/a>.[1<\/a>]<\/sup> Clients can receive lower retentions when they report FTF incidents within 72 hours of the initial fraudulent transfer, encouraging prompt action to improve the odds of recovery.<\/p>\n

Other key findings from the report include:<\/p>\n