Ransom Payments Fell 44%, and Claims Rose 40%

Insurer claims data published this year reports average ransom payments falling 44% while cyber insurance claims rose 40%. Attack frequency is reported up around 45%.

Insurance data is the best quantitative view available of what incidents actually cost, because someone had to pay. It is also a biased sample — it describes insured organisations that claimed, which is not the same as all victims.

A 44% drop in average payment is attributed to better negotiation and faster claims handling. Both are consequences of professionalisation: insurers have panels of responders and negotiators who do this constantly, against operators who mostly do not.

It also reflects the shift this desk has documented all year. Where extortion is theft-and-publication rather than encryption, as in the DentaQuest file at 26-0612, more victims can decline — because they are choosing between disclosure and payment, not between payment and being unable to operate.

Claims up 40% on frequency up 45% says the improvement in payment size has not reduced how often organisations are hit. If anything the two are related: an ecosystem receiving less per victim has an obvious incentive to increase volume.

That is worth stating plainly, because "ransom payments are falling" reads as a win and, on this data, coincides with more organisations being attacked than before.

An average payment is a poor summary of a distribution with a long tail. A fall in the average is compatible with more small payments, or with fewer very large ones, and those imply different things about who is being targeted.

We would want the median and the distribution before drawing conclusions about the direction of the market, and insurers do not generally publish either.