Ransomware costs ease but email-based attacks dominate, Coalition reports

Coalition, a cyber insurance provider known for its Active Insurance model that aims to prevent digital threats before they cause harm, has published its 2025 Cyber Claims Report, offering a comprehensive view of cyberattack trends affecting its policyholders throughout 2024.

According to the report, ransomware incidents remained the most expensive and disruptive form of cyberattack, even though both the frequency and severity of claims showed modest declines.

Ransom demands dropped by 22% year-over-year, with the average demand falling to $1.1 million. For the first time in over two years, average demands in the second half of 2024 dipped below the $1 million mark.

Despite the easing of ransomware costs, email-related cybercrime dominated the claims landscape. Coalition’s report states that 60% of all cyber insurance claims in 2024 stemmed from business email compromise (BEC) and funds transfer fraud (FTF).

Furthermore, nearly 29% of BEC incidents led to a financial loss through fraudulent transfers, making email compromise a significant gateway for financial exploitation.

The Akira ransomware strain was the most frequently encountered among Coalition’s clients in 2024, responsible for 13% of all ransomware-related claims, while Black Basta, though involved in just 3% of claims, posted the highest ransom demands, averaging $4 million.

Coalition also reported notable success in recovering stolen funds, thanks to coordination with law enforcement and external partners.

According to the report, $31 million was recovered on behalf of clients, with an average recovery amount of $278,000. The report emphasises that faster reporting significantly boosts the chances of recovery. As part of its response strategy, Coalition introduced a financial incentive through its Active Cyber Policy, reducing client retentions for those who report FTF incidents within 72 hours of the initial transfer.

While the overall frequency of claims dropped by 7% year-over-year, the report shows that claims severity remained largely stable.

Ransomware claims saw a 3% decline in frequency and a 7% reduction in severity, while FTF claims dropped 2% in frequency and 46% in severity, marking a significant improvement from the record-high losses in 2023. On the other hand, BEC claim severity increased by 23%, highlighting the growing financial damage caused by compromised business communications.

When ransomware attacks did occur, 44% of affected Coalition policyholders opted to pay the ransom when it was deemed necessary. Coalition’s Incident Response team negotiated average reductions of 60% off initial ransom demands, according to the report.

Perhaps most notably, the report highlights that Coalition policyholders faced 73% fewer cyber claims than the industry average, which the company attributes to its proactive approach to managing digital risk.

“Over the past year, our claims data clearly demonstrates one thing: Active Insurance works,” said Robert Jones, Head of Global Claims at Coalition.

“Combining Coalition’s Active Data Graph, which provides a massive amount of data insights, with security tools and incident response, helps Coalition prevent claims from happening in the first place. And, when matters were reported to Coalition, 56% were handled without any out-of-pocket payments by the policyholder. We believe that this proactive engagement is a critical aspect of reducing global cyber risk.”

“While overall claims have stabiliSed, cyber attackers, and ransomware actors in particular, still pose a tremendous threat to businesses, with the average demand still in the millions of dollars. Unfortunately, ransomware is already back with a vengeance in 2025, as March held the highest volume of public ransomware cases of all time,” continued Jones.

“Coalition continues to be an active partner in the fight against bad actors. We alert our policyholders to vulnerabilities in their networks, risky security practices, and the best ways to mitigate threats to reduce the impacts of cyber attacks.”

The post Ransomware costs ease but email-based attacks dominate, Coalition reports appeared first on ReinsuranceNe.ws.

Coalition, a cyber insurance provider known for its Active Insurance model that aims to prevent digital threats before they cause harm, has published its 2025 Cyber Claims Report, offering a comprehensive view of cyberattack trends affecting its policyholders throughout 2024. According to the report, ransomware incidents remained the most expensive and disruptive form of cyberattack,…