Cowbell 2026 Cyber Claims Report: Ransomware Attacks Rose 45% While Ransom Payments Fell 44%

A new claims report from cyber insurance managing general agent (MGA) Cowbell offers one of the clearest pictures yet of how the cyber threat landscape is evolving — and how the insurance industry is adapting. The 2026 report, drawing on real claims data from the past 18 months, found that the number of ransomware attacks rose approximately 45% in 2025, even as the average ransom payment fell by roughly 44% between 2022 and 2025.

This apparent paradox — more attacks but smaller payouts — reflects a meaningful shift in defensive capability. Cowbell's directors of claims attributed the decline in payments to several factors, with insured preparedness chief among them: more organizations now maintain incident response plans and robust data backups, enabling them to restore operations without needing to pay for a decryption key. Stronger negotiation strategies and more effective claims handling also contributed.

The report breaks down the composition of cyber claims over the past 18 months: data breaches accounted for 33.5% of reported claims, cybercrime represented 31.8%, and extortion events made up 18.3%. Ransomware itself has represented a consistent 19% of Cowbell claims between 2022 and 2025. A notable trend is the shift in attacker tactics — away from encryption-only models toward data-only extortion schemes and double-extortion attacks. In data-only schemes, hackers do not encrypt systems but instead steal data and threaten to release it, lowering the technical barrier to entry and enabling smaller, less sophisticated threat groups to participate. More than two-thirds of cases with identified threat actors involved just seven groups, with Akira (38.8%) and Qilin (14.2%) together accounting for more than half.

Business Email Compromise (BEC) remains one of the most financially damaging cybercrimes, with attackers exploiting human trust through impersonation, AI-generated content, and social engineering — and between 74% and 95% of breaches involving the human element. Industries handling sensitive information — professional services, construction, manufacturing, healthcare, and wholesale trade — face higher-than-average ransom demands and longer recovery periods. Looking ahead, Cowbell expects artificial intelligence to be used increasingly to automate attacks, raising the stakes for both insurers and policyholders.