Coalition
Reports
All Statistics
Business Email Compromise and Funds Transfer Fraud accounted for 58% of cyber incidents.
Among 2025 funds transfer fraud claims, 52% originated from business email compromise.
A record 86% of businesses refused to pay ransom demands.
FTF (funds transfer fraud) claims severity decreased by 46% YoY. This sharp decline followed an all-time high in 2023.
The Black Basta variant had the highest average ransom demand at $4 million.
The average ransom demand in 2024 was $1.1 million.
Across all ransomware claims in 2024, the most common initial access vectors (IAVs) were stolen credentials (47%) and software exploits (29%).
Coalition detected over 5 million internet-exposed remote management solutions in 2024.
When applying for cyber insurance, most businesses (65%+) had at least one internet-exposed web login panel.
BEC claims frequency rose 15% year-over-year in 2025 while severity decreased 28% year-over-year to an average loss of $27,000.
FTF claims frequency decreased 18% year-over-year in 2025 and severity decreased 14% year-over-year to an average loss of $141,000.
Ransomware attacks involving data theft cost more than twice as much as ransomware attacks without data theft.
Dual-extortion ransomware accounted for 70% of all ransomware claims in 2025.
Funds Transfer Fraud was the second-most common cyber event, accounting for 27% of claims.
Initial ransom demands surged 47% year-over-year in 2025.
Businesses with more than $100 million in revenue faced a claims frequency five times higher than smaller organizations.
Ransomware was the most costly type of cyber claim in 2025 with an average loss of $269,000.
Overall global claims frequency rose 3% year-over-year in 2025.
Global claims severity decreased 19% year-over-year in 2025 to an average loss of $116,000.
Claims severity for businesses with more than $100 million in revenue decreased 7% year-over-year to an average loss of $268,000.
44% of cyber insurance policyholders that experienced a ransomware incident opted to pay the ransom when deemed reasonable and necessary.
Cyber insurance claims frequency decreased by 7% year-over-year (YoY).
March 2025 held the highest volume of public ransomware cases of all time.
Ransom demands from threat actors decreased by 22% year-over-year (YoY) in 2024.
The majority of 2024 cyber insurance claims (60%) originated from business email compromise (BEC) and funds transfer fraud (FTF) incidents.
29% of BEC events resulted in funds transfer fraud in 2024.
Akira ransomware was the most prolific variant for Coalition policyholders, accounting for 13% of ransomware claims in 2024.
FTF (funds transfer fraud) claims frequency decreased by 2% YoY.
The average ransom demand in the latter half of 2024 fell below $1 million for the first time in more than two years.
BEC claims severity increased by 23% in 2024.
Black Basta accounted for just 3% of all ransomware claims in 2024.
Ransomware cyber insurance claims frequency decreased by 3%.
Ransomware claims severity decreased by 7% YoY.
Remote desktop products were the second-most exploited vector for ransomware attacks in 2024, at 18%.
The projected software vulnerability rate for 2025 is nearly 4,000 per month.
Most ransomware claims in 2024 started with threat actors compromising perimeter security appliances (58%), like virtual private networks (VPNs) or firewalls.
The total number of published software vulnerabilities will increase to over 45,000 in 2025.
Coalition also detected tens of thousands of exposed login panels across the internet in 2024.
Insurance policyholders received critical alerts for just 0.15% of vulnerabilities published in the first ten months of 2024.
90% of vulnerabilities published in the first ten months of 2024 never triggered an alert for Coalition policyholders.
The predicted increase in software vulnerabilities for 2025 represents a 15% jump over the first 10 months of 2024.