Key Findings
The Black Basta variant had the highest average ransom demand at $4 million.
The average ransom demand in 2024 was $1.1 million.
44% of cyber insurance policyholders that experienced a ransomware incident opted to pay the ransom when deemed reasonable and necessary.
Cyber insurance claims frequency decreased by 7% year-over-year (YoY).
Ransom demands from threat actors decreased by 22% year-over-year (YoY) in 2024.
March 2025 held the highest volume of public ransomware cases of all time.
The majority of 2024 cyber insurance claims (60%) originated from business email compromise (BEC) and funds transfer fraud (FTF) incidents.
Akira ransomware was the most prolific variant for Coalition policyholders, accounting for 13% of ransomware claims in 2024.
Black Basta accounted for just 3% of all ransomware claims in 2024.
FTF (funds transfer fraud) claims frequency decreased by 2% YoY.
The average ransom demand in the latter half of 2024 fell below $1 million for the first time in more than two years.
29% of BEC events resulted in funds transfer fraud in 2024.
BEC claims severity increased by 23% in 2024.
Ransomware cyber insurance claims frequency decreased by 3%.
Ransomware claims severity decreased by 7% YoY.
FTF (funds transfer fraud) claims severity decreased by 46% YoY. This sharp decline followed an all-time high in 2023.