Cyber Insurance Losses Rise as High-Severity Breaches Offset Falling Claim Volume
New industry data reveals a paradoxical shift: fewer cyber claims are resulting in higher average payouts due to catastrophic breach costs.
Cyber insurance losses for large and middle-market companies increased in 2025, even as the total volume of claims declined. This trend indicates a shift in the threat landscape where the frequency of successful attacks is dropping, but the financial impact of those that break through is becoming more severe.
According to data reported by Infosecurity Magazine, this rise in average loss amounts was observed across both the U.S. and the UK/Europe. The increase is being driven by the escalating severity of successful breaches rather than a higher number of incidents. Specifically, the costs associated with data breach litigation, privacy-related litigation, and business interruption expenses have risen, pushing the average payout higher despite fewer companies filing claims.
The Shift in Risk Profile
This development follows a period of significant hardening in the cyber insurance market. Over the last few years, insurers have demanded stricter security controls from policyholders before granting coverage. While this may have reduced "low-hanging fruit" claims by improving basic security hygiene, the data confirms that the remaining successful attacks are more targeted and devastating.
Implications for the Industry
This trend signals that cyber risk is concentrating into "tail risks"—rare but catastrophic events that can threaten a company's solvency. For businesses, the data suggests that maintaining basic security standards is no longer a sufficient guarantee against catastrophic financial loss. The concentration of risk means that a single breach can now result in far more extensive legal and operational costs than in previous years.
For insurers, these findings necessitate a fundamental shift in how they model risk and price premiums. Because the frequency of claims is no longer a reliable proxy for total potential loss, underwriters must focus more heavily on the potential severity of a worst-case scenario rather than the probability of a common attack.
What to Watch
Industry analysts will be monitoring whether this trend of rising severity continues as attackers refine their methods to bypass advanced security controls. It remains to be seen if the increase in litigation costs will lead to new regulatory pressures or if insurers will further restrict coverage for specific high-cost breach types to manage their exposure.