During the first half of 2025 ransomware was the biggest loss driver, accounting for 60% of the value of large cyber claims over EUR1mn according to a recent analysis by Allianz Commercial.
The 33-page Cyber security resilience 2025 Claims and risk management trends report reveals that threats posed by supply chains, privacy regulation and social engineering also require attention, especially as an uptick in loss activity is expected from Black Friday (28 November 2025) onwards.
The analysis, however, reveals that despite the increasing level of attacks the severity is down by 50% and large claims frequency is down by 30% during the period under review. This is primarily driven by larger companies’ elevated detection and response capabilities.
The expanding risk landscape is broadening the potential scope of claims for all, while the gap between insured and uninsured widens. The cyber risk and insurance landscape in 2025 reveals a complex and evolving threat environment. Large insured companies are becoming increasingly resilient against cyber-attacks with strengthening of cyber security and preparedness and response capabilities helping to mitigate the impact of some of the large cyber losses in 2025 to date.
However, the reliance on digital supply chains, impact of expanding privacy regulation, and more sophisticated social engineering attacks targeting employees are also broadening the scope of potential losses for all companies.
Allianz Commercial global head of cyber claims Michael Daum said, “Insureds’ increased detection and response capabilities are helping to stop some attacks at an early stage. Every step an attacker progresses, and every minute that they are in the system, the impact goes up exponentially. The cost of a ransomware attack that progresses to data theft and encryption can be 1,000 times higher than an incident that is detected and contained early.”
Ransomware attacks accounted for around 60% of the value of large claims during the first half of 2025. High-profile incidents across many industries underscore ongoing threats, although there are signs international co-ordination by law enforcement agencies and the strengthening of cyber security by large corporates is having a positive impact.
Attackers are also shifting focus to smaller firms, which are typically less resilient than multinationals, as well as firms in other territories, such as in Asia or Latin America.