Key Takeaways

  • Financial losses from ransomware attacks are climbing even as cyber insurance claims decline, according to a report released Tuesday by cyber risk management firm Resilience.
  • The average cost of a single ransomware attack rose 17% in the first half of this year, based on an analysis of Resilience's internal insurance claims. Ransomware accounted for 76% of incurred losses in the first half, compared with 46% in the same period last year.
  • "Financial incentives are driving cybercriminals to become more cunning and creative, and businesses are facing greater losses than ever before," said Vishaal Hariprasad, CEO of Resilience, in a press release. "Cybercrime moves in waves. Attackers use a tactic until defenders catch up, then pivot to new vulnerabilities."

Deeper Dive

The findings from Resilience, which show that sustained efforts to combat ransomware have yielded only limited results, align with other recent reports.

Cybersecurity firm Sophos reported in August that the average ransom demand faced by retail organizations this yearreached $2 million,doubling compared to 2024. However, in a positive sign, Sophos found that the average cost to recover from a ransomware attack, excluding ransom payments, fell 40% over the past year to $1.65 million, the lowest point in three years.

"These trends suggest that while threat actors are demanding more, retail organizations are becoming more resilient by improving recovery processes and potentially taking a harder line in ransom negotiations," a Sophos research blog post stated.

Resilience's report also highlighted positive aspects.In the first half of 2025, the number of incurred claims in Resilience's portfolio fell by more than half (53%). Additionally, the cyber risk management firm said its portfolio had a notably low loss ratio of just 22% in 2024.

Despite this, Resilience said ransomware attacks remain costly and disruptive. The analysis showed that among Resilience's clients, the average insured loss from a single ransomware attack exceeded $1.18 million in the first half of 2025, compared with $1.01 million in the same period last year.

The report said cybercriminals are using increasingly sophisticated extortion tactics, including AI-driven social engineering and "double extortion"—demanding payment for both data decryption and preventing public data leaks. Evolving ransomware methods also include stealing cyber insurance policies to better assess and set higher ransom demands.

"These new tactics are intensifying the threat landscape, allowing fewer attacks to still cause significant financial damage," Resilience said in the press release.