Between 2019 and 2023, technology experienced large losses primarily from other causes (38.0%), followed by ransomware (32.0%) and data breaches (30.0%).

Between 2019 and 2023, financial services experienced large losses primarily from data breaches (40.9%) and ransomware (40.9%), followed by other causes (18.2%).

2018: 46.2% of large losses came from other causes, 37.9% from data breaches, and 15.9% from ransomware. Ransomware started to emerge as a meaningful driver of big cyber claims.

2020: 27.3% of large losses came from other causes, 29.2% from data breaches, and 43.4% from ransomware. Ransomware remained a dominant source of costly claims.

In 2020, victims paid on average 37.4% of the initial ransom demand.

Average initial ransom demand (based on all cases with ransom demand) in 2023: $32.25 million.

In 24.6% of large ransomware claims, attackers used phishing to infiltrate systems.

In 2022, victims paid on average 42.0% of the initial ransom demand.

The average duration business operations were affected by ransomware in other industries was 44 days.

Between 2019 and 2023, healthcare experienced large losses primarily from ransomware (57.1%), followed by data breaches (28.6%) and other causes (14.3%).

The average duration business operations were affected by ransomware in retail was 32 days.

The average cost of an individual ransomware attack rose by 17% in the first half of 2025.

The U.S. accounts for 60% of all ransomware attacks against financial institutions.

The U.S. and U.K. together represent over 70% of ransomware attacks.

The top ten ransomware groups now account for only 50% of attacks, which is down from 69% previously.

Monthly volatility in ransomware attacks increased 50% year-over-year.

42 previously unaffected countries experienced their first-ever ransomware attacks in the last 12 months.

The number of active ransomware groups has doubled over the last three years.

The United States remained the primary target, accounting for 47% of known ransomware attacks.

There has been a 46% increase in targeted countries by ransomware over three years.