Cyber insurers paid out over twice as much for UK ransomware attacks last year
- Reference: 1762859088
- News link: https://www.theregister.co.uk/2025/11/11/ransomware_surge_fuels_230_increase/
- Source link:
The Association of British Insurers (ABI) said £197 million ($259 million) in cyber insurance payouts were made to victimized organizations in 2024, up from £59 million ($77 million) in 2023.
UK to ban ransomware payments by public sector organizations [1]READ MORE
Cyber insurance companies are a controversial part of the security market. Some argue the minimum standards they enforce on policyholders drive up security standards, while others have accused them of encouraging criminals to extort by making [2]payments to ransomware crews .
ABI data showed that ransomware and malware infections contributed to 51 percent of the claims made by UK organizations in 2024. This percentage increased markedly year-over-year, with ransomware and malware making up 32 percent of all claims in 2023.
The ABI said the surge in attacks leading to policy payouts illustrates an increase in sophistication and the damage cyberattacks are having on businesses.
[3]
"Cyber insurance is more than just a financial safety net," said Jonathan Fong, head of general insurance policy at the ABI. "The right policy not only supports businesses in the aftermath of an incident but can also help prevent attacks through access to expert advice, threat monitoring, and incident response planning.
[4]
[5]
"With cyber threats continuing to grow in scale and sophistication, it needs to be a critical component of every organisation's modern risk management strategy."
The ABI's most recent data pertains to the period before the wave of digital heists on major British businesses began this year.
[6]
These included retailer [7]Marks & Spencer , which last week reconfirmed to investors that it made a maximum £100 million ($131 million) claim on its cyber insurance policy, suggesting that 2025's data could lead to further increases in total payouts.
Officials at fellow besieged retailer Co-op confirmed in September the company did not hold comprehensive cyber insurance in place at the time of its April attack, and it would not make a claim on the limited-scope policy.
CFO Rachel Izzard told [8]Reuters : "We had the front-end elements of cyber insurance in place in terms of the immediate response capabilities in the technology space for third parties, but we don't believe we will be claiming on insurance for back-end losses."
[9]
Jaguar Land Rover reportedly did not have a cyber insurance policy in place at the time of its hugely costly cyberattack this year. When The Reg asked the org about this, a JLR spokesperson told us: "We do not comment on commercial matters such as these." Ultimately, the UK government had to step in with a [10]landmark support package to help the automaker, and the smaller businesses across its supply chain, financially recover.
Even if JLR did have a cyber insurance policy in place at the time - however comprehensive it might have been - it is unclear whether the massive costs associated with its downtime would have been materially eased by an insurance payout.
The [11]circa £2 billion ($2.6 billion) costs of its attack could be compared to those of Change Healthcare in the US, whose ALPHV ransomware attack in 2024 also led to costs [12]exceeding $2 billion .
Industry figures have debated the role and efficacy of cyber insurance for years.
At the UK National Cyber Security Centre's (NCSC) annual conference earlier this year, the matter of cyber insurance was one of the few topics all the top expert panellists agreed on, offering support for its role in improving security standards.
The prevailing takeaways from [13]the CYBERUK session were that insurers hold decades of expertise in assessing risk, and they have access to the most pertinent threat intelligence affecting modern organizations, which informs their policy requirements.
If organizations can't meet them – i.e. they don't implement the baseline standards required to defend against the most successful modern attacks – they don't get a policy.
On the other side of the debate sit those who believe insurers are encouraging ransom payments.
Anne Neuberger, chief of cyber under the Biden administration, argued last year for a ban on insurers from covering extortion payments, claiming current [14]policies incentivize payments , which in turn fuel cybercriminal operations.
[15]Russian broker pleads guilty to profiting from Yanluowang ransomware attacks
[16]Big Tech's control freak era is breaking itself apart
[17]Russian spies pack custom malware into hidden VMs on Windows machines
[18]The race to shore up Europe's power grids against cyberattacks and sabotage
Others who spoke to The Register at the time disagreed.
Monica Shokrai, Google Cloud's head of business risk and insurance, said: "I'm not convinced that banning the ransom from being paid by cyber insurance policies will remediate the issue."
"In the case of large companies, cyber insurance will still cover the cost of the incident and the ransom itself often isn't material, particularly compared to the cost of business interruption that a large corporation may face.
"So, if larger companies continue to pay the ransom despite insurance not covering it, the impact of a ban on the insurance coverage becomes less meaningful."
Others argued that a payment ban was too reductive a countermeasure, saying the root cause of rising payments was due to "widespread digital insecurity." ®
Get our [19]Tech Resources
[1] https://www.theregister.com/2025/07/22/uk_to_ban_ransomware_payments/
[2] https://www.theregister.com/2024/10/14/ransomware_insurance_ban/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aRNrpl3L8mit-q54wJitHAAAARA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aRNrpl3L8mit-q54wJitHAAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aRNrpl3L8mit-q54wJitHAAAARA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aRNrpl3L8mit-q54wJitHAAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/11/05/ms_pegs_cyberattack_cleanup_costs/
[8] https://www.reuters.com/world/uk/britains-co-op-says-cyberattack-cost-it-108-million-2025-09-25/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aRNrpl3L8mit-q54wJitHAAAARA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2025/09/29/jlr_government_loan/
[11] https://www.theregister.com/2025/11/07/bank_of_england_says_jlrs/
[12] https://www.theregister.com/2024/11/20/change_healthcares_clearinghouse_services/
[13] https://www.theregister.com/2025/05/12/uks_cyber_agency_and_industry/
[14] https://www.theregister.com/2024/10/14/ransomware_insurance_ban/
[15] https://www.theregister.com/2025/11/10/russian_iab_pleads_guilty_to/
[16] https://www.theregister.com/2025/11/10/three_most_important_factors_in/
[17] https://www.theregister.com/2025/11/04/russian_spies_pack_custom_malware/
[18] https://www.theregister.com/2025/11/03/europe_power_grid_security/
[19] https://whitepapers.theregister.com/
Re: I thought insurance was against something which *may* happen
If the companies left the front doors wide open, I agree. But where to draw the line? When major so-called internet security companies can't protect themselves, and don't even notice for months that they have been hacked, I would say computer security is a pipe dream.
There are many problems even with the idea of computer security. Applying the latest patches doesn't mean anything unless the patches themselves have been audited. The old adage of the latest version fixes old bugs and brings new ones is not a running joke, it is reality. Then we have seen several examples recently in The Reg of compromised packages being downloaded n thousand times. Nobody noticed, meaning more compromises waiting to happen. The whole software supply chain is built on sand using very thin bamboo sticks.
These forms of insurance do indeed socialise the costs, while the bosses give themselves bigger pay packets. Prices go up, we all pay. Some pay themselves a lot more than those on the coal face, they don't care.
Re: I thought insurance was against something which *may* happen
I think that I see insurance as a good thing because it will, eventually, start to drive improving standards in prevention. It worked with car theft in the 80s when some car doors could be opened with a screwdriver - mainly Peugots in my bitter experience. When these were shifted into insurance group 10-12 - normally reserved for luxury and super cars - the manufacturers started fitting deadlocks as standard and eventually immobilzers and alarms.
What about revenue?
Payouts going up - fair enough.
But is this good or bad for insurers? Are they getting more money in via more companies getting insurance and/or paying higher premiums?
Is it currently a loss for the insurance providers? Or a excuse to make even greater profit?
Savings
Turns out you cannot eat your cake and have it too.
If your IT strategy is going overseas to the lowest bidder, like why don't those mouse clickers work for beads, how hard is it to sit by the computer all day - then instead of IT wages you'll be paying insurance premiums.
Minimum standards?
How Minimum are they?
JLR got popped big time, they suffered huge losses, and companies that work them took a huge hit. M&S losses were so big they maxed out their cyber policy.
Do companies need to look at raising this minimum threshold? because clearly some messes are racking up substantial sums to clean up.
Conditions and guidance
I wonder if the insurance policies have conditions to do things such as spend more money on Cyber next year, since most of these "highly complex attacks" are rarely so. Its always the same attack vectors, operated in the same way. Poor compliance with security standards and people falling for scams and getting software installed locally, that is then used to elevate access and pivot to something else.
If only there was a way to solve such a complicated problem, perhaps someone should come up with a framework to make it less complicated for motrals - Oh, yes, there are several aready. You just have to read them and implement their recommendations, which means that companies need to spend money and have suitably trained people, rather than say "no budget", but then "spaff any money we need to dig ourself out of this huge security incident".
Here's a couple of links for some common ones.
NCSC for the UK - https://www.ncsc.gov.uk/section/advice-guidance/all-topics
NIST for the US - https://www.nist.gov/cyberframework
CRA for the EU - https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
MITRE ATT&CK - https://attack.mitre.org/
ISO2700x - Stupidly, behind a paywall
CIS benchmarks - https://www.cisecurity.org/cis-benchmarks
OWASP - https://owasp.org/www-community/attacks/#
Any additions from others welcome ...
I thought insurance was against something which *may* happen
otherwise it's assurance.
Also, if I don't lock my front door or secure my windows, my insurer won't pay out. What evidence have these insurers (who are after all paying out with MY money) obtained that the insured did everything possible to prevent the attack ?
It's hard to avoid the feeling that (as ever) big business is getting better treatment at the expense of the little person.