Cybersecurity

Cyber Insurance Losses Spike as Claim Costs Soar

Analyst 207||Source: InfoSecMag
A softly lit conference room with a large wooden table, stack of files, and neutral-colored documents in the foreground.

“In a suit involving 10,000 claimants, for example, these non-refundable fees can exceed $10m before the merits of the case are even heard,” Chubb wrote.

Chubb’s headline: fewer claims but much higher average losses in 2025

Chubb’s 2026 Cyber Claims Report, published on August 25, says that for large and middle-market companies the average cost per cybersecurity insurance claim surged in 2025 even as the overall number of claims fell. The insurer reports a pronounced rise in claim severity across regions and company sizes, driven by a mix of legal exposure and business-interruption damage.

United States: steep jumps in severity tied to litigation and interruption

In the US, Chubb recorded a 22% increase in the average cost of claims for middle-market firms in 2025 compared with 2024. For large companies the change was far larger: an increase of 100% in average claim cost year-over-year. The insurer attributed the growing severity in the US largely to rising costs of both data-breach and privacy-related litigation alongside higher business-interruption expenses.

UK and Europe: fewer filings, rising per-claim costs without third-party litigation expenses

Across the UK and Europe, Chubb observed the same pattern of declining claim volumes but higher average costs per claim in 2025 versus 2024. Severity rose by 34% for middle-market companies and by 98% for large firms. Chubb pointed out that the average cost per claim remained far higher in the US than in the UK and Europe, which the insurer said can be explained by “the absence of any material third-party litigation expenses from either data breach or non-data breach privacy claims” in the latter region.

SMEs diverge: frequency up, costs fall in US but rise in UK/Europe

Small and medium-sized enterprises bucked the large-company pattern on costs while mirroring it on frequency. Chubb reported that the frequency of claims increased for SMEs in both the US and UK/Europe in 2025. Average claim costs for US SMEs fell from $215,297 to $141,931 during the same interval, while in the UK and Europe average SME claim costs rose from $51,095 to $82,621.

Privacy laws, ransomware leaks, and administrative fees

Chubb highlighted a growing body of privacy laws in both the US and the EU that impose “complex, layered obligations” on companies that store or transfer personal data. The insurer cited new obligations that include the right to opt out of profiling or automated decision-making and disclosure requirements for AI-driven processing. Chubb also warned that ransomware actors increasingly combine encryption with intentional data leakage after successful attacks, a tactic that raises the risk of litigation under data-protection regimes.

On procedural costs in the US, Chubb noted companies are often required to pay substantial upfront administrative fees “for each individual filing, regardless of the merit of the claim.” The report gave the concrete example that, in a suit involving 10,000 claimants, those non-refundable fees can exceed $10m before case merits are addressed.

What this means for technologists, policymakers, and procurement leaders

  • Technologists and security teams: rising business-interruption and litigation costs — and the specific threat of combined encryption-plus-data-leak ransomware tactics — mean incident response planning must account for legal exposure and public-disclosure risk as well as technical recovery.
  • Policymakers and regulators: the report underscores how layered privacy obligations, including opt-outs for profiling and AI-processing disclosures, are changing the legal landscape companies must navigate when personal data is exposed or processed.
  • Procurement and risk managers at affected enterprises: higher average claim costs and sizable administrative fees in the US highlight the need to revisit insurance terms, limits, and the potential for significant outlays before litigation merits are determined.

Chubb’s figures present a clear, numeric picture: 2025 brought fewer claims but larger bills for many insured organizations, especially in the US and among large firms. The interplay of evolving privacy law obligations, procedural fee structures, and ransomware tactics that combine theft with encryption is changing not just incident response but the economics of cyber risk transfer. The report leaves a pointed question for insurers, buyers and regulators alike: if claim severity continues to climb, how will the market and the regulatory frameworks adapt to contain legal and financial exposure?

https://www.infosecurity-magazine.com/news/cyber-insurance-losses-increase/

Cyber InsuranceEmerging ThreatsRisk ManagementUnited StatesFinancial SectorLitigationInsurance LossesBusiness InterruptionClaim SeverityCyber Claims
Related Intelligence

Continue Reading

Security analysts work amidst multiple computer screens in a monitoring room with subtle signs of disarray.

CISA Red Team Tests Expose Organizational Vulnerabilities

CISA's red team tests revealed some eye-opening vulnerabilities, with the team slipping past security operations centers undetected, gaining access to workstations, escalating privileges, and moving freely between systems. This simulated cyber attack exposed weaknesses in critical infrastructure organizations, highlighting areas for improvement in detecting and responding to threats.

Analyst 207
Government facility with industrial and security elements under daylight.

CISA Red Team Exposes Gaps in Critical Infrastructure Defenses

The CISA red team uncovered alarming gaps in critical infrastructure defenses, revealing that even with detection tools in place, the real vulnerability lies in the people, processes, and procedures supporting them. In a striking example, a recent red-team exercise showed that detection tools can be ineffective if not backed by robust supporting systems.

Analyst 207
Empty office cubicle with laptop, smartphone, and papers, surrounded by blurred coworkers' spaces and a large window.

AI Tools Operate Largely Unchecked, Heightening Security Risks

Most AI tools are flying under the radar, with a staggering 80% operating without IT oversight in enterprise ecosystems, leaving organizations vulnerable to security risks. This alarming lack of governance is even more pronounced in smaller organizations, according to Reco's latest findings.

Analyst 207
Rows of server racks and networking equipment in a shared data center with technicians in the background.

Unpatched Kaltura Flaws Expose Servers to Remote Code Execution

A pair of unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library could put servers at risk of remote code execution, allowing attackers to read sensitive files and run malicious code - and affecting not just individual customers, but also every tenant on shared hosting infrastructure. This critical security gap, tracked as CVE-2026-19913 and CVE-2026-19912, remains unpatched, leaving countless systems exposed.

Analyst 207