25 Cyber Insurance Statistics Every Business Owner Should Know
What cybercrime costs U.S. businesses, what a data breach really runs, how many firms carry cyber coverage, and where ransom payments are heading, in 25 cited statistics from the FBI, IBM, NAIC, Verizon, and the U.S. Treasury.
Cyber losses rarely start with a hacker in a hoodie. Most begin with a spoofed invoice, a stolen password, or an unpatched router, and a single fraudulent wire transfer can cost a small business six figures. This report gathers 25 cited statistics on what cybercrime costs, what a breach really runs once the claim is paid, how many businesses carry cyber liability insurance, and how ransomware payments are changing. Every figure comes from a federal agency, a regulator, or a carrier’s own claims data, and each one states the year it describes.
Key Takeaways
- Reported cybercrime losses keep climbing - the FBI logged $20.877 billion in losses in 2025, up 26% in a single year.
- Breaches are most expensive in the U.S. - the average U.S. data breach cost $11.5 million in IBM’s 2026 study, more than double the global average.
- Small firms absorb most ransomware attacks - about 96% of ransomware victims with a known size were small or midsize businesses.
- The insurance market just paused - U.S. cyber premiums fell to $9.14 billion in 2024, the first decline regulators have recorded.
- Coverage is spreading, unevenly - 70% of companies now report buying cyber insurance, but only half of small businesses do.
- Fewer victims pay the ransom - 69% of ransomware victims did not pay, and the median payment fell to $139,875.
How much cybercrime costs U.S. businesses
1. The FBI received more than 1 million cybercrime complaints in 2025
The FBI’s Internet Crime Complaint Center logged 1,008,597 complaints in 2025, which the bureau says now works out to almost 3,000 reports a day. For comparison, IC3 logged 49,711 complaints in 2001. Phishing and spoofing led all categories with 191,561 complaints, a reminder that most attacks begin with a message, not a break-in. Every one of those complaints represents a person or business that decided the loss was serious enough to report, so the true volume is likely higher.
2. Reported losses reached $20.9 billion, up 26%
Victims reported $20.877 billion in losses to IC3 in 2025, a 26% jump from the $16.6 billion reported for 2024. The average reported loss per complaint was $20,699. Losses have roughly quintupled since 2020, when victims reported $4.2 billion. For a business owner, the trend line matters more than any single year: reported losses have risen every year since 2020, and so has the cost of facing an incident without coverage.
Data
| 2020 | $4.2B |
|---|---|
| 2021 | $6.9B |
| 2022 | $10.3B |
| 2023 | $12.5B |
| 2024 | $16.6B |
| 2025 | $20.9B |
3. Business email compromise cost victims $3.05 billion
Business email compromise, where a criminal impersonates a vendor or executive to redirect a payment, produced $3.05 billion in reported losses from 24,768 complaints in 2025. That made it the second-costliest crime type behind investment fraud. The good news is that speed helps: IC3’s Recovery Asset Team froze $679 million of the $1.16 billion in attempted thefts it acted on in 2025, a 58% success rate. Claims data tell the same story, with business email compromise and funds transfer fraud making up 58% of incidents one cyber insurer handled in 2025.
4. Ransomware complaints topped 3,600, but reported losses badly understate the damage
IC3 received 3,611 ransomware complaints with $32.3 million in reported losses in 2025, and identified 63 new ransomware variants during the year. The FBI cautions that the loss figure normally excludes lost business, time, wages, files, equipment, and third-party remediation, and that many victims report no loss amount at all. In other words, the $32 million reflects only what victims chose to report, not the cost of a week offline. That gap is exactly what business interruption coverage in a cyber policy is designed to fill.
5. Law firms and contractors top the small-business ransomware list
Of the more than 1,400 ransomware complaints IC3 received from organizations outside critical infrastructure, legal services accounted for 18%, contracting services 17%, engineering and architectural services 10%, and consulting 7%. These are small, professional firms that hold client files, bank details, and deadlines, which makes them attractive and pressured targets. Firms like these usually carry professional liability insurance for mistakes in their work, and the Treasury notes that some cyber coverage is written as errors and omissions coverage, so it is worth confirming which policy would respond to a breach.
What a data breach actually costs
6. The global average data breach cost hit a record $4.99 million
IBM and the Ponemon Institute put the global average cost of a data breach at $4.99 million in the 2026 study, a 12% increase over the prior year and a record high. The research studied 602 organizations, and IBM notes that detection, escalation, and lost business made up 63% of breach costs. Put another way, the average breach runs about $1,100 an hour. Whatever the size of the business, that breakdown shows where the money goes: detection and downtime, not just the ransom or the stolen data.
7. A U.S. breach costs more than twice the global average
The average cost of a data breach in the United States was $11.5 million in IBM’s 2026 report, more than double the $4.99 million global figure. Litigation is part of the reason: Chubb’s claims data show cyber incidents increasingly escalate to legal action, often within days. For a U.S. business, that legal environment is why third-party liability coverage carries so much weight in a cyber policy.
8. Healthcare breaches have been the costliest for 15 straight years
The average healthcare data breach cost $6.64 million in 2026, the highest of any industry for the 15th consecutive year. IBM notes that breaches hit hardest in heavily regulated fields like healthcare, finance, and the public sector, where fines and penalties compound the cost. Clinics, dental offices, and therapy practices are small businesses too, and they carry the same type of data on a smaller scale.
9. AI-driven attacks rose 56% and add about $1 million per breach
IBM found that AI-driven attacks increased 56% in its 2026 study, adding an average of $1 million to the cost of a breach. Deepfake impersonation and AI-assisted malware led the increase. The same research shows the defense works both ways: organizations that used security AI and automation extensively saved $1.93 million per breach compared with those using none. For smaller firms the lesson holds at a lower scale: controls that speed up detection shrink the bill.
10. Half of paid cyber insurance claims top $83,000
Verizon’s first Breach Impact Study, built from 69,683 U.S. cyber insurance claims for incidents from 2019 through October 2025, found that half of paid-out claims had a financial impact above $83,000. The top 10% exceeded $920,000, and the most extreme 2.5% topped $5 million. Because the study counts only insured losses, the authors describe these figures as a floor, not a ceiling. It is one of the most direct public looks at what a real claim costs once deductibles and payouts are added up.
11. The median claim rose 80% in five years
Comparing 2019 with 2024, the median impact per claim rose about 80%, from roughly $60,000 to roughly $110,000. Consumer prices rose about 23% over the same span, so breaches got genuinely more expensive, not just inflated. The study’s authors warn that businesses that set their cyber limits before 2023 may hold coverage calibrated to a loss mix that no longer reflects current claims. That is a strong argument for reviewing limits at every renewal rather than rolling them over.
12. A typical small-business claim runs about $38,000
The same claims data split by revenue show a median impact of about $38,000 for businesses under $25 million in revenue, roughly $96,000 for mid-market firms, and about $283,000 for companies above $250 million. The smaller number does not mean smaller risk. In the most severe 2.5% of small-business claims, losses exceeded 7% of annual revenue, a hit that can erase a year of profit for a thin-margin firm.
Why small businesses are a prime target
13. About 96% of ransomware victims are small or midsize businesses
Verizon’s 2026 Data Breach Investigations Report found that, among ransomware cases where the victim’s size was known, about 96% hit organizations with fewer than 1,000 employees. The report counted 7,152 confirmed breaches at those smaller organizations. Attackers cast wide nets, and the report found victims often had a compromised credential (38%) or an unpatched edge device (29%). In other words, small firms tend to be hit because they are easier targets, not because they are richer.
14. Ransomware now appears in 48% of breaches
Ransomware was involved in 48% of breaches in the 2026 DBIR, up from 44% the year before. The report analyzed more than 31,000 security incidents, of which more than 22,000 were confirmed data breaches. It also dominates insured losses: Chubb data show ransomware accounted for nearly 72% of all cyber claim dollars in 2023 and 2024.
15. Third-party involvement in breaches jumped 60%
Breaches involving a vendor, partner, or software supplier rose 60% year over year and now account for 48% of all breaches. For smaller organizations, third parties were involved in 55% of breaches. A business can do everything right and still be hit through its payroll provider, IT contractor, or cloud host. Insurance claims data now track contingent business interruption, meaning losses from an outage at a vendor, which made up 13% of known losses in 2024.
How big the cyber insurance market is
16. U.S. cyber premiums fell to $9.14 billion, the first decline on record
Insurers wrote about $9.14 billion in U.S. cyber direct premiums in 2024, down 7.11% from $9.84 billion in 2023, according to the NAIC. It was the first reduction regulators have recorded. The market had grown from about $4.07 billion in 2020, with a peak jump of nearly 61% in 2021, before prices softened. The Treasury’s insurance office, citing Fitch Ratings, notes that growth returned in 2025, driven by a surge in policies in force despite softer pricing.
17. Cyber is still less than 1% of the U.S. property and casualty market
Despite its growth, cyber insurance makes up less than 1% of direct written premiums in the U.S. property and casualty market, the Treasury reported in June 2026. The U.S. still accounts for roughly 60% of the worldwide cyber market. Insurers responding to Treasury’s data call reported only $1.9 trillion in total cyber limits, compared with about $159 trillion in property limits subject to the federal terrorism program. Cyber remains a young line whose limits are a small fraction of what businesses carry on property and liability.
18. About 4.4 million cyber policies were in force
Insurers reported 4,368,614 policies in force in 2024, essentially flat from the year before. The mix is revealing. Endorsements, where cyber is added onto another policy such as a business owners policy, made up 55.1% of policies but only 4% of premium. Primary standalone policies produced 65% of premium. The NAIC describes endorsements as high-volume, low-premium products, so many small businesses may hold far thinner cyber protection than a standalone policy provides.
19. Most closed cyber claims ended with no payment
Insurers reported nearly 50,000 cyber claims in 2024, up almost 40% from the year before. Among closed claims at U.S.-domiciled insurers, 9,941 closed with a payment and 28,555 closed without one, a ratio of nearly three to one. Verizon’s claims study notes that a zero-dollar claim typically means the insurer’s adjusted loss came in under the policy deductible. Whatever the reason, reading the deductible and the exclusions before a loss matters as much as the limit.
- Closed with payment 26%
- Closed without payment 74%
How many businesses carry cyber insurance
20. 70% of companies now report buying cyber insurance
In the 2026 Travelers Risk Index, 70% of companies reported having purchased cyber insurance, up seven percentage points from 2025 and the highest share since the survey began focusing on cyber in 2018. Cyber threats were again the top business concern, cited by 58% of the 1,202 U.S. decision makers surveyed. Travelers reported that coverage gains showed up across every company size it tracks.
21. Only half of small businesses carry cyber coverage
The take-up gap is widest at the bottom of the market. Travelers found that 50% of small businesses had cyber insurance in 2026, up from 43% in 2025, while 82% of large businesses did, up from 73%. That leaves half of small firms uninsured in a threat landscape where smaller organizations make up most ransomware victims. Interest is rising further up the market too: 47% of middle-market leaders in a Chubb survey said they were considering adding or increasing cyber coverage.
What cyber policies actually pay for
22. Business interruption is now the largest loss driver
Cyber policies pay first-party costs (your own losses) and third-party costs (claims against you). On the first-party side, business interruption had the highest median loss in the Breach Impact Study at about $90,000, and its share of known losses grew from 21% in 2023 to 32% in 2024. Incident response showed up in more than 60% of claims, with a median of about $25,000. Policies sized only around forensics and notification can leave the costliest piece, lost income, underinsured.
23. Third-party liability appears in few claims but can run into the millions
External liability losses, which include lawsuits, regulatory penalties, and payment card fines, appeared in only 6.4% of claims in the Breach Impact Study, with a median of about $22,000. The extreme cases exceeded $4.1 million. These claims often surface years after the breach, once lawsuits are filed, so they are undercounted in recent data. At large U.S. companies, Chubb reported that average claim severity doubled to more than $4.4 million in 2025, with litigation among the top cost drivers.
Where ransomware payments are heading
24. Most ransomware victims now refuse to pay
In Verizon’s 2026 data, 69% of ransomware victims did not pay, and the median ransom paid fell to $139,875 from $150,000 the year before. Insurer data point the same way: Coalition found that initial ransom demands rose 47% in 2025, yet a record 86% of businesses refused to pay. Ransomware was still that insurer’s costliest claim type, at an average loss of $269,000, a reminder that downtime and recovery cost money even when no ransom changes hands.
25. Insurers paid $139 million in ransoms in 2025
Cyber insurers reported paying $139 million in ransom payments in 2025 across 2,198 claims, down from $198 million in 2024, according to the Treasury’s June 2026 report. Ransom payments made up only about 10% of insurers’ total cyber extortion losses once defense, containment, and other direct losses were counted. Payment behavior also differs by country: Chubb data showed 35% of U.S. companies paid ransoms in 2024, compared with 8% outside the U.S.
How to protect your business and price cyber coverage
The numbers point to a short list of steps that lower the odds of a loss and make your coverage go further when one happens:
- Put the basics in place before you apply. The FBI recommends offline, encrypted backups and multifactor authentication on every service that supports it. Travelers found 72% of companies now use multifactor authentication for administrative users.
- Report payment fraud within hours. IC3’s recovery team froze 58% of the money in fraud cases it acted on in 2025, so call your bank and file a complaint immediately.
- Size business interruption limits realistically. Interruption is now the largest loss driver in cyber claims, so check that your limit covers several weeks of lost income.
- Know whether you hold a policy or an endorsement. Endorsements are 55.1% of policies but a sliver of premium, so confirm your limits before you rely on one.
- Compare insurers and quotes. Start with our carrier comparison, then compare quotes for your business, and check coverage in your state through the location directory.
- Check our sources. We explain how we gather and verify figures on the methodology page.
Frequently Asked Questions
How much does a data breach cost a small business?
Insurance claims data give the clearest answer. The median insured impact for businesses under $25 million in revenue was about $38,000, but the worst 2.5% of small-business claims exceeded 7% of annual revenue. Large-organization averages are far higher, with the average U.S. breach costing $11.5 million in IBM’s 2026 study.
What percentage of businesses have cyber insurance?
In the 2026 Travelers Risk Index, 70% of companies reported buying cyber insurance, including 82% of large businesses and 50% of small businesses. Regulators counted about 4.4 million policies in force in 2024, more than half of them endorsements added to other policies.
What does cyber insurance cover?
A cyber policy typically pays first-party costs such as incident response, data restoration, extortion, and business interruption, plus third-party costs such as lawsuits and regulatory penalties. In paid claims, business interruption had the highest median loss at about $90,000, while liability losses appeared in 6.4% of claims. Exact coverage depends on the form, so compare the details on our cyber liability insurance page.
Does cyber insurance pay ransoms?
Many cyber policies include extortion coverage, though Treasury data show ransom payment limits sit well below overall policy limits. Insurers reported paying $139 million in ransoms across 2,198 claims in 2025, but most victims now decline to pay at all: 69% did not pay in Verizon’s 2026 data.
How big is the cyber insurance market?
U.S. insurers wrote about $9.14 billion in cyber premiums in 2024, down 7% from 2023 after several years of rapid growth. Even so, cyber remains less than 1% of the U.S. property and casualty market, and the Treasury reports that growth returned in 2025.