Cyber Insurance Claims Statistics: 2026 Report

Bottom Line

The average loss per reported US cyber claim fell to $67,053 in 2025, down from $104,524 in 2022, while the share of closed claims that closed without payment rose from 62% to 72%. The cost of a claim rises steeply with company size: in NetDiligence's five-year data, claims from companies with $2 billion or more in revenue averaged $11.2 million, against $266K for companies below that size.

How Many Cyber Insurance Claims Are Filed in the US?

This section sets out our year-by-year count of US cyber insurance claims and the policies they came from. Claim counts come from the NAIC supplement, either as reported by the NAIC or as extracted by Aon.

Source: CyberReviewed, Cyber Insurance Claims Study (Source 1). Our study compiles claim counts from NAIC market reports for 2023 to 2025 and Aon extracts of NAIC data for 2019, 2021 and 2022. Claims per 1,000 policies is our calculation. The 2024 claim count, and the 2024 rate built on it, are derived from NAIC closed-claim data (see Methodology). Data: us-cyber-claims-policies-2019-2025.csv

• The count rose in every year shown with a count, and the 2024 figure is our derived estimate. The NAIC says 2025 claims were more than six times the 2017 level.
• On our derived 2024 count, claims rose about 40% in 2024 (our calculation) while policies in force were flat, which would lift claims per 1,000 policies from 7.7 to 10.7. The NAIC describes 2024 claims as "nearly 50,000," an increase of "almost 40%."
• The NAIC reports that policies in force rose 33% in 2025 to 5.84 million, mostly through endorsement coverage added to other commercial policies, which rose 53.8%. Claims grew more slowly than policies, so claims per 1,000 policies eased to 9.6, and the lower rate partly reflects a wider pool of policyholders.

How Often Do Policyholders File, and What Does a Claim Cost?

This section uses Aon's analysis of the NAIC supplement to show frequency and average severity per claim across the US market. Aon's 2025 extract covers 225 insurers.

Source: Aon, U.S. Cyber Market Update, August 2026, Exhibits 17 to 19, based on NAIC Cybersecurity Insurance Supplement data. Data: aon-us-frequency-severity-2021-2025.csv

• Average severity across all reported claims fell 36% between 2022 and 2025, from $104,524 to $67,053 (our calculation), while frequency rose from 0.007 to 0.011 claims per policy.
• Aon ties lower severity to the rising share of claims closed without payment, which went from 61% in 2021 to 72% in 2025, and suggests stricter coverage terms and wording as one possible cause.

Aon's counts and the NAIC's counts do not match exactly. Aon reports that claim counts in its extract grew 25% in 2025, while the NAIC reports 20%. Aon's claims-per-policy figure for 2025 is also higher than the 9.6 per 1,000 in Table 1, because the two use different extracts and policy bases. Aon also cautions that claim counts vary widely by insurer and that per-claim analysis should be read with care. Both sources show more claims and a lower average cost per reported claim.

How Many Claims Close Without Payment?

This section breaks down US claims closed in 2024 by policy type, using the most recent year for which the NAIC published closed-claim counts.

Source: NAIC, 2025 Report on the Cybersecurity Insurance Market (2024 data). Total closed is our sum. Closure rate is the NAIC's share of reported claims that were closed. Data: naic-2024-closed-claims-by-policy-type.csv

• About three in four closed claims in 2024 closed without payment: 28,555 of 38,496, or 74% (our calculation), matching Aon's figure in Table 2.
• Excess policies, which pay only after a primary layer is used up, closed 514 claims with payment and 10,802 without.
• Primary policies produced 8,838 of the 9,941 paid closed claims, or 89% (our calculation).

The NAIC counts closed claims by policy type and by whether the insurer made a payment. A claim closed without payment can be a denied claim, an incident that stayed under the deductible or an excess claim that never reached the excess layer.

Frequency and Severity by Account Size

This section uses Chubb's US claims data to show how claim frequency and severity differ for small businesses, the middle market and large companies.

Source: Chubb, 2026 Cyber Claims Report, US frequency and severity tables. SME: $0 to $99 million in revenue. Middle market: $100 million to $999 million. Large: $1 billion or more. Data: chubb-us-frequency-severity-by-account-size-2020-2025.csv

• Large-account severity doubled in 2025, from $2,216,645 to $4,428,494, and is 586% above the 2021 level. Chubb points to rising business interruption costs and the cost of data breach and privacy litigation.
• Large-account frequency fell from 15.16 to 9.95 claims per 100 policies in the same year, so the rise in large-account losses came from the cost of each claim.
• SME severity fell 34% to $141,931 (our calculation), and SME frequency rose for a second year, to 1.39 claims per 100 policies.

Frequency for every segment is well below 2020 and 2021. Chubb links the drop between 2020 and 2022 to better security and resilience among its clients. Large companies still file about seven times as often per policy as SMEs, based on the 2025 figures in Table 4 (our calculation).

Claim Severity by Revenue Band

This section compares average claim cost by company revenue in two other datasets: NetDiligence's five-year study of claims submitted by cyber insurers and At-Bay's 2025 claims data. Their revenue bands differ, so we show each separately.

Source: NetDiligence, Cyber Claims Study 2026 Report, Table 3. Claims with total incident cost of $1,000 or more, incidents from 2021 to 2025. Incident cost includes self-insured retentions. Data: claims-severity-by-revenue-band.csv

• Companies with $2 billion or more in revenue account for 282 of the 9,519 claims in the table, about 3%, and about $3.15 billion of the $5.62 billion in total incident cost, or 56% (our calculation).
• The 3,872 claims from companies under $50 million in revenue averaged $141K, close to Chubb's 2025 SME figure of $141,931.
• The study holds 12 claims above $100 million, and two came from organizations with less than $700 million in revenue. A company well below the largest revenue bands can still face a nine-figure claim.

Source: At-Bay, 2026 InsurSec Report, Figures 5 and 6. At-Bay's top band includes insureds with up to $5 billion in revenue. Data: claims-severity-by-revenue-band.csv

• Severity for At-Bay's smallest insureds rose 26% in 2025 to $180K, the third straight annual increase. Their ransomware severity rose 40% to $422K.
• Severity in the top band fell from $522K in 2023 to $314K in 2025, while frequency in that band rose 14% in 2025.
• At-Bay's overall average severity reached $221K in 2025, up from $216K in 2024, after falling from $213K in 2021 to $197K in 2023.

In NetDiligence's data, companies under $2 billion in revenue filed most of the claims, while a small number of claims from larger companies accounted for most of the cost. At-Bay's and Chubb's average claim costs also rise with company size.

What 2025 Insurer Claims Reports Show

This section places the headline 2025 frequency and severity figures from each insurer report side by side with the market-wide NAIC data. The reports cover different policyholders and define severity differently, so the table shows scope next to each figure.

Source: Aon U.S. Cyber Market Update (August 2026); Chubb 2026 Cyber Claims Report; At-Bay 2026 InsurSec Report; Coalition 2026 Cyber Claims Report; NetDiligence Cyber Claims Study 2026. NetDiligence figures are five-year averages. Data: carrier-claims-reports-2025.csv

• The market-wide NAIC average of $67,053 is lower than any insurer report because it spreads losses across every reported claim, including the 72% of closed claims that closed without payment.
• At-Bay reports its highest average severity on record, while Coalition reports a 19% drop. Coalition also reports that 64% of its closed claims involved no out-of-pocket loss for the policyholder.
• Coalition reports that policyholders with more than $100 million in revenue had a claims frequency five times higher than smaller organizations, with average severity down 7% to $268K.

Coalition's breakdowns of ransomware and business email compromise claims appear in our ransomware payment statistics and business email compromise statistics.

Claim Cost by Cause of Loss

This section compares average claim cost by cause of loss in NetDiligence's SME data and At-Bay's 2025 data.

Source: NetDiligence, Cyber Claims Study 2026 Report, Figure 5 (SMEs under $2 billion in revenue, claims of $1,000 or more). At-Bay, 2026 InsurSec Report, Figure 4. The two reports use different cause categories; n/a means the report does not use that category. Data: claims-severity-by-cause.csv

• Ransomware is the costliest cause in both datasets. At-Bay's ransomware average of $508K is more than twice its overall average of $221K.
• Email-driven fraud is frequent and cheaper per claim. Financial fraud made up about 30% of At-Bay's claims in 2025, and its average severity rose 21% to $123K. The average amount of stolen funds was $285K, and the largest single theft was $9.7 million.
• At-Bay's third-party liability claims rose 70% in number in 2025 while their average severity fell to $175K. At-Bay attributes most of the increase to class action suits, many tied to the California Invasion of Privacy Act.

NetDiligence reports that ransomware and business email compromise together accounted for 51% of SME claims of $1,000 or more over five years and nearly 64% in 2025. Across all ransomware claims in 2025, At-Bay's policyholders faced an average ransom demand of $980K and paid an average of $370K, and paid in 32% of incidents where there was a demand.

Claim Cost by Sector and Cost Component

This section uses NetDiligence's five-year claims data to show how average claim cost varies by business sector and which parts of a claim carry the most cost. All figures cover claims from incidents between 2021 and 2025. The full study analyzed 10,309 claims, including 1,780 from incidents that occurred in 2025, and its largest single claim topped $500 million.

Source: NetDiligence, Cyber Claims Study 2026 Report, Figure 4 (SMEs under $2 billion in revenue), values read from the figure's data labels. Data: netdiligence-sme-cost-by-sector-2021-2025.csv

• Professional services firms filed the most SME claims, 1,777, at an average close to the overall SME figure.
• Healthcare and financial services claims averaged about twice the overall SME average, at $516K and $519K.
• Retail had the lowest average of the five sectors, $238K.

Business interruption is the most expensive component when it appears. Among the 313 SME claims that included a business interruption loss, the average business interruption cost was $1.3 million and the average total incident cost was $1.9 million, about seven times the overall SME average (our calculation). For the 23 large-company claims with business interruption, the averages were $47.7 million for business interruption and $67.6 million in total.

Crisis services, which cover forensics, notification, credit monitoring, breach coach counsel and public relations, appear in far more claims at a lower cost. NetDiligence reports an average crisis services cost of $159K across 4,665 SME claims and $2.4 million across 179 large-company claims. Among SMEs over the five years, forensics accounted for 17% of total crisis services cost and legal guidance for 8%.

Claims of $1 million or more are rare at small companies and common at large ones. NetDiligence counts 381 such claims at SMEs, 4% of the total, against 92 at large companies, 28% of theirs. Counted by cost band across the full dataset, it holds 403 claims between $1 million and $10 million and 68 between $10 million and $99 million. The size-based and cost-band counts come from different cuts of the data, so their totals differ.

Litigation costs are concentrated in a few claims. NetDiligence found 145 SME claims that reported legal or litigation expense, covering settlements, legal defense, regulatory fines and regulatory defense. At large companies, 24 claims reported at least one type of legal expense, with an overall average of $22.2 million. The average settlement in those claims was $41.4 million and the average defense cost on settlements was $411K. Two settlements, of $100 million and $500 million, drove those averages up, and the large-company data held no regulatory fines over the five years.

The number of records exposed in a breach tells little about its cost in this data. The 2021 to 2025 period holds 354 claims that reported more than one record exposed, down from 436 in the 2020 to 2024 study, and together they exposed more than 720 million records. NetDiligence reports that the number of records exposed does not correlate well with either company size or total incident cost.

How US Claims Compare With Europe and FBI Crime Data

This section adds two comparisons: Chubb's Europe and UK claims, and the cyber crime losses reported to the FBI's Internet Crime Complaint Center (IC3).

Chubb reports that average claim severity is lower in every Europe and UK segment than in the US. Its 2025 averages for Europe and the UK were 82,621 for SMEs, 318,820 for the middle market and 2,219,129 for large accounts. Chubb reports similar claim frequency for SMEs, at 1.58 claims per 100 policies in Europe and the UK against 1.39 in the US, and much lower frequency for the middle market (1.51 against 5.22) and for large accounts (1.75 against 9.95). Chubb attributes most of the gap to the near absence of third-party litigation costs from data breach and privacy claims in Europe and the UK.

Crime reports to the FBI show cyber crime losses reported by victims, whether or not they had insurance. IC3 received 1,008,597 complaints in 2025 with reported losses of $20.877 billion. Business email compromise accounted for 24,768 complaints and $3,046,598,558 in reported losses. Ransomware drew more than 3,600 complaints with reported losses above $32 million, a figure the FBI says excludes lost business, time and remediation costs and is understated because many victims report no loss amount. IC3 complaints and insurance claims count different things and should not be added together.

What the Claims Data Means

Most closed US cyber claims now close without a payment. The market-wide average cost per claim therefore understates what a paid claim costs, and pricing, reserving or advice built on that average will understate it too.

Smaller companies file most cyber claims, and ransomware and business email compromise cause the largest share of them. A small business that has to stop operating after a ransomware attack can face business interruption costs far above the average claim for its size, which makes the business interruption section of a policy worth reading closely.

Large companies now file less often per policy than they did a few years ago, and their claims cost more. Chubb ties the rising cost of large-company claims to business interruption and to data breach and privacy litigation, and its comparison of the US with Europe and the UK points to litigation as the main reason claims cost more in the US. So if you are reviewing a cyber policy, compare its third-party liability and business interruption limits with the claim costs reported for companies of your revenue size.

Sources

1. CyberReviewed, Cyber Insurance Claims Study: analysis of US cyber insurance claims reported and policies in force from 2019 to 2025 in NAIC market reports and Aon extracts of NAIC Cybersecurity Insurance Supplement data, with NAIC closed-claim counts by policy type, Aon frequency and severity figures, and the 2026 claims reports of Chubb, At-Bay, Coalition and NetDiligence compiled by company size, revenue band, cause of loss and sector, conducted October 2026. Data: us-cyber-claims-policies-2019-2025.csv
2. NAIC, 2026 Report on the Cybersecurity Insurance Market (2025 data)
3. NAIC, 2025 Report on the Cybersecurity Insurance Market (2024 data)
4. NAIC, 2024 Report on the Cybersecurity Insurance Market (2023 data)
5. Aon, U.S. Cyber Market Update, August 2026 (2025 data)
6. Aon, U.S. Cyber Market Update, September 2023 (2022 data)
7. Aon, U.S. Cyber Market Update, August 2022 (2021 data)
8. Aon, US Cyber Market Update, June 2020 (2019 data)
9. Chubb, 2026 Cyber Claims Report, APAC edition (US and Europe and UK tables) and EMEA edition
10. At-Bay, 2026 InsurSec Report
11. Coalition, 2026 Cyber Claims Report and announcement, March 5, 2026
12. NetDiligence, Cyber Claims Study 2026 Report
13. FBI Internet Crime Complaint Center, 2025 IC3 Annual Report
14. Insurance Journal, "Chubb: Cyber Claim Severity Nearly Doubled for Large Businesses," March 30, 2026

Data Collection and Methodology

Scope. Claim counts and policies in our study cover insurers that file the NAIC Cybersecurity Insurance Supplement. Chubb's US tables and At-Bay cover those insurers' own policyholders, and NetDiligence covers claims contributed by participating insurers. NetDiligence's dataset is 98.6% US organizations (10,166 of 10,309 claims, our calculation). Coalition's figures cover its policyholders in the US, Canada, the UK, Australia and Germany. We show Chubb's Europe and UK severity amounts as plain numbers, without a currency sign or conversion.

Claim counts. In our study, the 2023 and 2025 counts are as reported by the NAIC. The 2019, 2021 and 2022 counts are the totals in Aon's annual extracts of NAIC supplement data. For 2024, our study derives a count of about 46,900 by dividing the 38,496 claims closed in 2024 by the NAIC's 82.05% closure rate, which gives 46,918. Every figure built on that count, including the 2024 rate of 10.7 claims per 1,000 policies and the 2024 increase of about 40%, is marked as derived. The derived count is consistent with the NAIC's description of "nearly 50,000" claims, an increase of "almost 40%," and with the 2025 count of 56,323 being a 20% rise. Aon and NAIC figures can differ because of extraction date and insurer coverage.

Calculations. Claims per 1,000 policies divides claims by policies in force. Percentage changes, shares and multiples marked "our calculation" are computed from the cited figures and rounded once from the raw value. The 33% rise in 2025 policies in force is the NAIC's figure.

Severity. Severity definitions differ by source. Aon's NAIC-based severity spreads losses across all reported claims. Chubb, At-Bay and Coalition report average cost per claim in their own books; At-Bay's figures include losses developed to ultimate. NetDiligence reports total incident cost per claim, including self-insured retentions, pooled across 2021 to 2025. Figures from different reports should be compared only for direction and should not be added or averaged.

NetDiligence bases. Table 5, Table 8, Table 9 and the SME and large-company averages cover claims with incident cost of $1,000 or more (9,519 claims, of which 9,235 are SME and 284 large company). NetDiligence's statement that large companies filed 3% of claims (324) and accounted for 56% of total incident cost ($3.2 billion of $5.7 billion) counts all 10,309 claims in the study. Its counts of claims of $1 million or more by company size (381 SME and 92 large) and by cost band (403, 68 and 12) come from different cuts of the data and do not sum to the same total. The revenue-band table (Table 5) and the SME and large-company split differ by two claims. Table 5 counts 282 claims at $2 billion or more and 9,237 below that size or of unknown size, while the split counts 284 large-company and 9,235 SME claims. Both total 9,519.

Revenue bands. Each report uses its own bands: Chubb US (under $100 million, $100 million to $999 million, $1 billion or more), At-Bay (under $25 million, $25 million to $100 million, $100 million to $500 million including insureds up to $5 billion), NetDiligence (seven bands, with SMEs under $2 billion). Chubb's APAC edition labels its Europe and UK bands 0 to 10 million (SME), 11 million to 499 million (middle market) and 500 million or more (large), while its EMEA edition labels them with the US bands.