Majority of cyber insurance ransomware claims are due to BEC

A new report from cyber insurance specialist Coalition finds the majority of 2024 claims (60 percent) originated from business email compromise (BEC) and funds transfer fraud (FTF) incidents, with 29 percent of BEC events resulting in FTF.

Ransomware claims did stabilize in 2024 but they remain the most costly and disruptive type of cyberattack.

"Over the past year, our claims data clearly demonstrates one thing: Active Insurance works," says Robert Jones, global head of claims at Coalition. "Combining Coalition's Active Data Graph, which provides a massive amount of data insights, with security tools and incident response helps Coalition prevent claims from happening in the first place. And, when matters were reported to Coalition, 56 percent were handled without any out-of-pocket payments by the policyholder. We believe that this proactive engagement is a critical aspect of reducing global cyber risk."

Ransom demands from threat actors decreased in 2024, dropping 22 percent year-on-year to an average of $1.1 million. Notably, the average demand in the latter half of 2024 fell below $1 million for the first time in more than two years. In addition ransomware claims frequency decreased by three percent and severity decreased by seven percent YoY.

"While overall claims have stabilized, cyber attackers, and ransomware actors in particular, still pose a tremendous threat to businesses, with the average demand still in the millions of dollars. Unfortunately, ransomware is already back with a vengeance in 2025, as March held the highest volume of public ransomware cases of all time," adds Jones. "Coalition continues to be an active partner in the fight against bad actors. We alert our policyholders to vulnerabilities in their networks, risky security practices, and the best ways to mitigate threats to reduce the impacts of cyber attacks."

The full report is available from the Coalition site.

Image credit: jittawit.21/depositphotos.com