SINGAPORE, June 16, 2026 — More than 95% of average data breach losses and 90% of average first-party losses are adequately covered by insurance, according to the latest report by Willis, a WTW business (NASDAQ:WTW). Cyber claims in Focus – Getting value from cyber insurance analyses 5,500 cyber claims occurring from January 2013 to January 2026 across 95 countries, and around US$1 billion in insurer payments.
Data breaches are the most frequently reported cyber insurance loss, with malicious data breaches accounting for the majority of incidents. Ransomware losses register the highest financial severity, predominantly driven by the disrupted productivity and prolonged downtime that follows incidents. Third-party vendors are responsible for an increasing proportion of losses and systemic risk from single‑vendor incidents impacting multiple organisations remains a critical concern.
Other key findings include:
- The average ransomware event lasts 25 days and the average loss is US$5.3 million, with the largest single loss now exceeding US$500 million.
- Events where attackers target organisations’ systems directly account for 58% of ransomware notifications and 95% of total costs, while vendor-led incidents account for 42% of notifications but only 5% of costs.
- Business interruption losses and ransom payments represent the two largest cost elements for ransomware events. Average ransom demands are now US$3.8 million versus an actual payment of US$1.5 million.
- Third parties are responsible for nearly 50% of data breach losses and 29% of first-party losses. Among the third parties responsible for breach events, 50% fall into the IT, tech or telecom categories, 17% involve financial institutions and 11% come from administrative services.
- Pixel-tracking litigation is the hidden cyber insurance risk, with some cases leading to substantial losses across the wider cyber insurance market.
“Across our data set, certain industries are facing increased claims activity, with Healthcare businesses accounting for 20% of all cyber policy notifications, followed by Financial Institutions and Manufacturing, accounting for 16% and 13% respectively.
“In Asia, the cyber risk landscape is becoming more complex as businesses digitise, automate and rely more heavil on interconnected technology ecosystems.”Conor KeatingHead of Cyber, Asia
“In Asia, the cyber risk landscape is becoming more complex as businesses digitise, automate and rely more heavily on interconnected technology ecosystems. While AI has not yet emerged as a stand-alone driver of cyber insurance claims, it is already amplifying existing threats, from social engineering and deepfake phishing to ransomware.
“With the average ransomware event now costing businesses over $5 million, insurance limit adequacy is becoming increasingly scrutinised across Asia. We are seeing more clients looking for in-depth cyber risk quantification analysis to help guide their insurance buying, adding greater confidence to their cyber risk transfer strategy.
“At the same time, insureds are turning to their cyber brokers to support them in embedding a cyber policy within their existing incident response plans. Regular testing and pre-agreed vendor engagement enables insureds to act quickly during an event, saving valuable time and often serving to mitigate losses.
“For companies in Asia, the message is clear: cyber insurance should not be viewed as a static policy purchase. It should form part of a broader resilience strategy that helps to quantify exposures, test response plans and incorporate coverage that is aligned to real-world claims scenarios most likely to affect the business,” said Conor Keating, Head of Cyber in Asia at Willis.
“To get the strongest value from cyber insurance, consideration must reflect the claims patterns seen across the market.”Peter FosterChairman, Global FINEX Cyber and Cyber Risk Solutions
Peter Foster, chairman, global FINEX cyber and cyber risk solutions at Willis, added: "Cyber insurance cover varies widely, which is why organisations must understand what they have in place and ensure it aligns with their risk exposures. When cover doesn’t reflect reality, organisations risk critical gaps where protection is needed most, while paying for cover that offers little real value. To get the strongest value from cyber insurance, consideration must reflect the claims patterns seen across the market. Our analysis of claims and loss data provides hints to understand how cyber losses occur and what that means for organisations, helping them to prioritise the most material scenarios and design coverage around these realities.”
Download the report.
About WTW
At WTW (NASDAQ: WTW) we provide data-driven, insight-led solutions in the areas of people, risk and capital. Leveraging the global view and local expertise of our colleagues serving 140 countries and markets, we help organizations sharpen their strategy, enhance organizational resilience, motivate their workforce and maximize performance.
Working shoulder to shoulder with our clients, we uncover opportunities for sustainable success and provide perspective that moves you.