Phishing and email-based attacks dropped to 46% of all incidents in 2025, down from 52.3% in 2024.

Threat actors are diversifying their entry points, leading to 26% of ransomware incidents involving compromised endpoints.

Between 2019 and 2023, manufacturing experienced large losses primarily from ransomware (86.7%), followed by other causes (10.0%) and data breaches (3.3%).

Ransomware claims accounted for 54.3% of cyber claims in the sample for the period of 2019 and onwards.

Between 2019 and 2023, retail experienced large losses primarily from ransomware (50.0%), followed by other causes (30.0%) and data breaches (20.0%).

The average duration business operations were affected by ransomware in health care was 70 days.

In 2019, victims paid on average 56.9% of the initial ransom demand.

Before 2023, 62.8% of backups were affected by ransomware.

In 16% of large ransomware claims, attackers leveraged compromised or weak credentials to gain entry.

In 2023, 88.9% of backups were not affected by ransomware.

Average initial ransom demand (based on all cases with ransom demand) in 2020: $11.25 million.

In 2021, victims paid on average 33.9% of the initial ransom demand.

Before 2023, 37.2% of backups were not affected by ransomware.

Manufacturing faced several ransomware incidents, generating cyber insurance claims averaging over $1 million in severity.

2023: 24.0% of large losses came from other causes, 13.3% from data breaches, and 62.8% from ransomware. Ransomware reached a record high, driving almost two-thirds of the largest cyber insurance payouts.

Average initial ransom demand (based on all cases with ransom demand) in 2022: $21.46 million.

2010–2017: 62.3% of large cyber losses came from other causes, 37.7% came from data breaches, and ransomware caused 0.0% of major losses. At this stage, ransomware claims were rare, and most large claims stemmed from breaches and miscellaneous incidents.

In 2023, organizations took an average of 32 days to restore operations after a ransomware attack.

In 2023, only 11.1% of backups were affected by ransomware.

The average duration business operations were affected by ransomware in professional services was 85 days.