Ransomware Dominates Cyber Insurance Claims with Devastating Financial Impact, WTW Report Reveals A new analysis from insurance brokerage Willis Towers Watson (WTW) highlights the severe economic toll of cyber incidents, with ransomware emerging as the most financially damaging threat to global organizations. The Cyber Claims in Focus 2026 report reveals that cyber insurance currently covers over 95% of average losses from data breaches and 90% of direct organizational losses, yet the scale of disruption remains staggering. Ransomware attacks, in particular, inflict 25 days of operational paralysis on average, costing companies €4.5 million per incident. While the typical ransom demand stands at €3.2 million, actual payments average €1.3 million though the true financial burden stems from prolonged system outages, lost productivity, and business interruption. The largest single loss documented in the report exceeded €430 million, underscoring how a single attack can cripple even large enterprises. Data breaches remain the most frequent cyber insurance claim, though their financial impact varies widely. Malicious attacks drive the majority of cases, but supplier-related breaches are a growing concern, responsible for nearly 50% of breach-related losses and 29% of direct organizational costs. A single compromise at a third-party vendor can trigger cascading disruptions across hundreds of dependent businesses, amplifying systemic risk. Artificial intelligence (AI) is not yet a standalone driver of claims but is accelerating existing threats. Attackers leverage AI to refine social engineering, deepfake phishing, and ransomware tactics, making fraud harder to detect and defenses harder to maintain. The report warns that AI’s role in cybercrime introduces greater volatility, requiring organizations to continuously reassess security measures and insurance coverage. Despite high coverage rates, gaps persist. Many policies fail to align with an organization’s specific risks whether operational disruptions for industrial firms or data exposure for customer-centric businesses. WTW’s Cybersecurity Director, Carolina Daantje, emphasizes that misaligned coverage can leave critical vulnerabilities exposed while over-insuring against low-impact risks. Emerging threats, such as litigation tied to tracking pixels, further complicate the landscape. As attack patterns evolve, the report stresses the need for regular policy reviews to ensure coverage matches real-world loss scenarios. With ransomware and third-party risks reshaping cyber threats, the focus shifts from whether to insure to how to ensure policies address the most financially devastating incidents.