Cowbell 2026 Cyber Claims Report: Ransomware Attacks Rose 45% in 2025 While Average Ransom Payments Fell About 44% Since 2022

Ransomware attacks went up in 2025, but the amounts paid to the attackers went down. That is the central finding of Cowbell's 2026 claims report, a cyber insurance claims analysis from the managing general agent Cowbell, as reported by Claims Journal in May 2026. According to the report, ransomware attacks rose 45% last year, while average ransom payments fell by roughly 44% between 2022 and 2025. This article summarises the Claims Journal coverage. An earlier version of this article described the figures as an industry-wide trend. They come from Cowbell's own claims data, so they reflect its portfolio and not the whole market, and the article now says so. Other figures sometimes quoted alongside this report, from Resilience and IBM X-Force, come from separate sources and are not part of the Cowbell report.

Why have payments fallen? Cowbell's director of claims, Stephanie Hewerdine, credits better negotiation, stronger claims handling and insureds' preparedness, including incident response plans and robust backups. In plain terms, if a business can restore its systems from backups, it has less reason to pay, and if it has a negotiator experienced in dealing with criminals, the sum agreed can be lower. The report's figure compares 2022 and 2025, so it describes a three-year trend and not a single year's change. The report as covered does not give the dollar amounts of average payments, so we cannot say what they were.

What are the claims about? In the past 18 months, according to the coverage, data breaches accounted for 33.5% of claims, cybercrime for 31.8% and extortion events for 18.3%. Together, those three categories make up about 84% of claims. Cybercrime in this context refers to financial crimes such as fraudulent funds transfers or business email compromise, though the coverage does not define each category in detail. The coverage also does not give claim severity figures, so we cannot say how large the average claim is.

How are attackers changing tactics? The report says extortion is shifting from encryption toward data-only schemes and double extortion. In a traditional ransomware attack, criminals encrypt a victim's files and demand payment for the key. In data-only extortion, they steal data and threaten to publish it. In double extortion, they do both. This shift matters because good backups, which can defeat encryption, do not stop a threat to publish stolen data. The report also says smaller, less sophisticated groups are emerging, and that some do not honour their agreements with victims. That makes negotiation riskier, because paying does not guarantee deletion of stolen data.

Who are the main threat actors? More than two-thirds of cases in which the attacker was identified involved seven groups. Akira accounted for 38.8% and Qilin for 14.2% of those cases, together more than half. The coverage does not describe how the groups operate, and this article does not add details beyond the report. Concentration among a few groups suggests that law enforcement action against one group could change the picture.

Which sectors are exposed? The report says that professional services, construction, manufacturing, healthcare and wholesale trade depend heavily on systems and sensitive data, which makes preparation especially important for them. It does not give claim rates by sector.

What should businesses do? The report's logic points to several practical steps: maintain tested, offline backups; keep an incident response plan and rehearse it; use multi-factor authentication and patching; and know whom to call, such as an insurer's breach coach, if an attack happens. Insurance does not prevent an attack, but it can pay for response, restoration and legal costs, depending on the policy. Policies differ on whether they cover ransom payments, and some regulators and governments restrict such payments. For instance, Germany's BaFin has confirmed that ransom payments can be insured under its rules, as covered separately on this site.

How does it fit the market? Munich Re and others have reported that global cyber insurance premiums are expected to soften in 2026 even as attack frequency rises, a theme covered elsewhere on this site. Cowbell's report suggests that insurers' claims experience can be better than frequency alone would suggest, if policyholders are prepared.

One more point is about interpretation. A rise of 45% in ransomware attacks sounds dramatic, but the report as covered does not give the underlying number of attacks or Cowbell's number of policyholders, so the percentage should be read as a trend within its book and not as an absolute measure. Similarly, the fall in average ransom payments may reflect changes in the mix of attackers and victims as well as better handling. Even so, the direction is encouraging for businesses that invest in preparation, and it fits with the logic that criminals have less leverage over a victim that can recover without them.

What about insurers? A falling average payment helps insurers if they cover ransoms, but rising attack frequency raises the number of claims for response, restoration and business interruption, which are separate from the ransom itself. Insurers therefore watch frequency, severity and the quality of customers' controls together, and many require minimum security measures before offering cover.

This article summarises one insurer's published claims analysis and is not insurance or security advice.