Marsh: UK cyber insurance claims dropped by 20% in 2024

By Rebecca Delaney

May 7 - (The Insurer) - UK cyber insurance claims decreased by 20% in 2024 compared to a spike in 2023, but still remained around one-third higher than the previous three years, a Marsh report said on Wednesday.

Marsh's UK cyber insurance claims trend report found that despite an overall decline in submitted claims, Q3 2024 had

the second-highest level of quarterly activity recorded since 2020 with a year-on-year increase of 14%.

This was partially driven by the CrowdStrike global outage event on July 19, 2024.

"We believe that another factor influencing the slight drop in claims in 2024 compared to 2023, was insurers increasingly requiring companies to implement key cybersecurity controls before offering coverage, which improved their overall cybersecurity posture," said the report.

"The cyber insurance market remained buoyant heading into 2025, with plenty of insurer capacity and competitive pricing."

Financial institutions and professional services firms consistently notify a higher number of cyber incidents, although Marsh added that it is important to note that these sectors also hold a high proportion of cyber insurance policies.

These sectors continue to be targets owing to their extensive data records, as well as their high vulnerability to outages due to complex third-party supply chains.

The report found the extortion (including ransomware) was the primary cause of cyber losses in 2024, accounting for 28% of claims. This was followed by data breaches, both accidental and hostile (17%) and system infiltration (7%).

Ransomware claims decreased by 31% in 2024 compared to 2023, with the latter marked by a "sharp" increase following the MOVEit data breach.

Despite the year-on-year decline, ransomware claims in 2024 still stood at around double the totals recorded for 2020, 2021 and 2022.

In Q1 2024, Marsh described ransomware claims as increasing "substantially," more than doubling the number of claims in the same quarter in 2023.

Ransomware claims decreased by 65% in Q4 compared to the same quarter in 2023, although Marsh noted that an uptick in ransomware claims in January 2025 may indicate that ransomware attacks are still rising, and that another Q1 spike in 2025 may be likely.

The amounts paid by ransomware victims in the UK continued to increase in 2024, although Marsh noted that extortion negotiations often resulted in reductions of more than 60% from the initial demands to the final payment.