Coalition: Cyber insurance claims frequency dropped 7% in 2024

By Michael Loney

May 13 - (The Insurer) - Coalition policyholders reported a 7% decrease in cyber claims frequency and stable severity in 2024, but the insurtech warned that “ransomware is already back with a vengeance in 2025”.

In a new report based on data from Coalition policyholders in the U.S., Canada, the UK and Australia, the insurtech said that ransomware claims stabilised in 2024 despite remaining the most costly and disruptive type of cyberattack.

“In years past, Coalition witnessed this dynamic firsthand with cyber claims increasing in both frequency and severity across various industries and revenue segments. Yet in 2024, despite this ever-changing landscape, we observed remarkable year-over-year stability, a clear testament to the power of active insurance,” the report said.

Global claims frequency decreased 7% in 2024 to 1.48% with a notable dip in the latter half of the year. Claims frequency in the U.S. was higher than the global average in 2024, at 1.54%, while it was lower in Canada (1.13%) and the UK (1.09%).

Global claims severity remained stable in 2024 with an average loss amount of $115,000.

Claims severity in the U.S. was lower than the global average in 2024, at $108,000. Severity in Canada was nearly double the global average ($226,000), while the UK was significantly lower ($35,000).

“Across all regions, severity continued to be driven by ransomware, the most costly and disruptive of all cyber attacks,” the report said.

Sixty percent of 2024 claims originated from business email compromise (BEC) and funds transfer fraud (FTF) incidents, with 29% of BEC events resulting in FTF.

BEC claims severity increased by 23%.

FTF claims frequency decreased by 2% and severity decreased by 46% year on year, but this sharp decline in severity followed an all-time high in 2023.

RANSOMWARE FREQUENCY DOWN 3%, SEVERITY DOWN 7%

Ransomware claims frequency decreased 3% in 2024 to 0.31%, which was consistent with a three-year average of 0.31%.

Ransomware claims frequency in the U.S. was 0.32%, while Canada was at 0.33% and the UK 0.19%.

Ransomware claims severity decreased 7% in 2024 to an average loss of $292,000, which was well below the high point of $393,000 in 2023.

Ransomware claims severity in the U.S. was $294,000, compared with $665,000 in Canada and $82,000 in the UK.

“Perhaps the biggest driver of the dip in ransomware claims severity was the decrease in initial ransom demands,” the report said.

Ransom demands fell 22% in 2024 to an average of $1.1 million. The average demand in the latter half of 2024 fell below $1 million for the first time in more than two years.

Akira ransomware was the most prolific variant in ransomware claims for Coalition policyholders, accounting for 13% of claims in 2024. The Black Basta variant accounted for just 3% of all ransomware claims, but was the highest in terms of demand, with an average of $4 million.

Coalition said that, when deemed reasonable and necessary, 44% of policyholders that experienced a ransomware incident opted to pay the ransom. It added that Coalition Incident Response was able to negotiate ransom payments down by an average of 60%.

Overall, Coalition said that its policyholders experienced 73% fewer claims than the industry average.

“While overall claims have stabilised, cyber attackers, and ransomware actors in particular, still pose a tremendous threat to businesses, with the average demand still in the millions of dollars. Unfortunately, ransomware is already back with a vengeance in 2025, as March held the highest volume of public ransomware cases of all time,” said Robert Jones, head of global claims at Coalition.

The report also said that Coalition’s cooperative efforts with authorities and panel partners contributed to the successful clawback of $31 million for policyholders in 2024, with an average recovery of $278,000.