H1 2025 brought fewer cyber insurance claims, more severe ransomware attacks

Sir Isaac Newton found that what goes up must come down, and though he was thinking about objects under the force of gravity, that very same thing happened for cyber insurance claims in the first half of this year.

According to a new report from cyber risk management firm Resilience, cyber insurance claims fell 53% in the first half of 2025 compared to the same period last year. During this period, the average loss incurred from claims fell 11%. Resilience’s findings are based on analysing its internal insurance claims.

While Resilience said the decline in cyber claims indicate a “stabilization in the cyber risk environment,” the firm found that the severity, or the incurred losses of ransomware attacks, grew 17% YOY in H1 2025.

The good, the bad, and the ugly. Ann Irvine, Resilience’s chief data and analytics officer, said the findings illustrate some highs and lows in cyber insurance claims for the year so far.

“The good news is more companies are successfully weathering these ransomware attacks,” Irvine said. “The bad news is for the companies that aren’t successfully able to keep them contained and get through with a zero loss amount, the losses are going up.”

Irvine also warned companies to not get their hopes up on fewer incoming vendor-related incidents. Vendor-related claims made up 26% of claim notifications in H1 2025, compared to 37% in 2024. These types of claims were the cause of 15% of incurred losses in Resilience’s portfolio in H1, down from 22% in 2024.

“That does not mean that those are going away,” Irvine said. “That just means there wasn’t a big one the first half of this year, but it continues to be something that we work with our customers to help them understand the risk and mitigate the risk.”

How’s the rest of the year looking? Irvine said she doesn’t expect to see any major changes in cyber insurance claim trends for the remainder of the year. She does, however, believe ransomware will continue to be the catalyst of most losses and concerns about vendor-related incidents.

“On that front, I worry all the time about, what’s the next Change Healthcare? What’s the next CrowdStrike outage?” Irvine said. “What’s the next company that has an issue that really has a lot of downstream impact on a lot of a lot of companies?”