At-Bay's 2026 Report Finds Rising Cyber Claims and Costlier Ransomware
Summary
At-Bay reports cyber claim frequency rose 7% in 2025, with average severity reaching $221,000. Remote access dominated ransomware entry, while rapid fraud reporting was associated with better fund recovery.
Key points
- Drawing on more than 100,000 policy years, At-Bay reports that 2025 cyber claim frequency increased 7% year over year and average claim severity reached $221,000.
- VPNs and RDP accounted for 87% of ransomware claims in 2025; VPNs alone represented 73% of ransomware attacks with an identified entry vector.
- Akira accounted for more than 40% of ransomware claims and drove a 53% increase in ransomware frequency in the second half of 2025. SonicWall devices were present in 86% of Akira-attacked environments.
- Average ransomware claim severity rose 16% to $508,000. One-third of ransomware claims triggered business interruption coverage, and claims with interruption payments were three times as severe as those without.
- Financial fraud represented approximately 30% of claims, with email the entry vector in 82% of fraud claims. Average funds stolen increased 16% to $285,000.
- In 2024–2025 fraud claims, 70% of victims notifying At-Bay within three days recovered some funds, compared with 28% reporting after 15–30 days, underscoring the importance of prompt escalation.
- Third-party liability claim frequency rose 70% in 2025. California Invasion of Privacy Act cases accounted for 34% of these claims, while post-incident class actions added delayed legal exposure.
Article Details
- Publisher
- At-Bay
- Report Period
- Primarily 2025, with historical claims from 2021 through the first quarter of 2026.
- Scope
- Cyber insurance claims, ransomware, financial fraud, third-party liability, and email threat observations among At-Bay policyholders.
- Sample Size
- More than 100,000 policy years of cyber claims data; supplemental analysis of over one million email security alerts from September 2025 to March 2026.
- Key Statistics
- In 2025, overall claim frequency increased 7% year over year and average claim severity reached $221K.
- Average ransomware claim severity increased 16% year over year to $508K in 2025; VPNs and RDP accounted for 87% of ransomware claims.
- Average funds stolen per financial fraud incident reached $285K in 2025, up 16% year over year; the largest recorded theft was $9.65M.
- Among financial fraud victims in the 2024–2025 analysis, 70% who notified At-Bay within 0–3 days recovered some funds, compared with 27% who reported after more than 30 days.
- Third-party liability claim frequency increased 70% year over year in 2025; CIPA-related cases accounted for 34% of those claims.
- Recommendations
- Address exposed remote access infrastructure rather than assuming risk is limited to a particular appliance vendor.
- Use high-fidelity, human-led 24/7 Managed Detection and Response to identify lateral movement and contain intrusions before encryption spreads.
- Escalate suspected financial fraud immediately to the insurance provider and promptly supply transaction details so banks and law enforcement can initiate recovery.
- Audit website tracking technologies for privacy compliance and verify that they are properly configured and operating as intended.
- Maintain functioning backups and involve experienced incident response and legal professionals early in an incident.
MITRE ATT&CK
T1046 · Network Service DiscoveryIn the Akira case study, attackers used automated tools to probe 126 hosts, triggering network discovery detections.T1078 · Valid AccountsAkira attackers leveraged stolen VPN credentials in the incident examined by At-Bay MDR.T1114 · Email CollectionThe report describes attackers using stolen credentials to monitor victims' email and learn vendor relationships and payment patterns.T1133 · External Remote ServicesVPNs and RDP were major initial entry routes for ransomware; an Akira case involved entry using stolen VPN credentials.T1486 · Data Encrypted for ImpactThe report describes ransomware encrypting business systems, disrupting operations, and requiring restoration.T1566.002 · Spearphishing LinkAttackers routed malicious credential-stealing links through trusted cloud infrastructure in emails to evade security scanning.
Threat Actors
AkiraRansomware-as-a-service operation active since 2023. At-Bay attributes a major second-half 2025 ransomware surge to its attacks involving SonicWall devices and assesses that infrastructure drove victim selection.PEAR (Pure Extraction and Ransom) TeamData-theft extortion group reported to have emerged in June 2025. Its site claimed 63 victims as of 2026-03-11; the report describes exfiltration and publication threats without encryption.
Malware
Vendors
Products
Industries
ConstructionManufacturing Technology Healthcare ConstructionEducationEducation, manufacturing, technology, and retail trade held their positions as the top four industriesFinance and insurance72% higher than the $508K average. Finance and insurance ($731K) and health care ($675K)Healthcareseverity for ransomware claims. Healthcare ($250K) and manufacturing ($248K) followed. AllLaw firmsfollowed. Although manufacturing ($451K) and law firms ($418K) ranked fifth and sixth respectively,ManufacturingEducation, manufacturing, technology, and retail trade held their positions as the top four industriesReal estate rental and leasingReal estate rental and leasing is a notable addition to the top tier. This sector processes frequentretail tradeEducation, manufacturing, technology, and retail trade held their positions as the top four industriesTechnologyEducation, manufacturing, technology, and retail trade held their positions as the top four industries