ABI: UK insurers paid out £197M+ in cyber claims in 2024, up from £60M in 2023; malware and ransomware-related claims were 51% of the total, up from 32% in 2023
Lee Harris / Financial Times :
Context & Ripple Effects
The UK loss surge follows years in which ransomware was already a large share of cyber claims: a 2020 report found it accounted for 41% of claims in the first half of that year. It also lands after estimates that cyberattacks had cost UK businesses substantial revenue over the preceding five years.
The changing claim mix matters because malware and ransomware are not peripheral exposures; they are becoming a central determinant of how insurers price and structure cyber cover.
First-order effects
- UK cyber insurers face materially higher claims costs from 2024 policies, with malware and ransomware now accounting for a majority of reported claims.
- Policyholders hit by these incidents have a clearer signal that cyber losses can translate into insured recovery, while insurers must reassess the adequacy of premiums, limits and underwriting controls.
Second-order effects
- Higher loss severity and concentration in ransomware-related claims should intensify insurer scrutiny of customers' security practices and policy terms, extending a pattern in which insurers raised cyber premiums after major hacks.
- Businesses seeking or renewing cover may face tougher security requirements or narrower protection, particularly where ransomware is a prominent operational risk; that raises the value of prevention and incident-response services.
Third-order effects
- If ransomware remains the dominant loss driver, cyber insurance is likely to evolve from broad risk transfer toward more tightly managed, security-conditioned coverage, with capacity concentrated among insurers able to model and absorb volatile events.
- The pattern also strengthens insurers' incentive to limit hard-to-price exposures, consistent with later reporting that some carriers were considering caps for AI-linked cyber losses.
The trend: Cyber insurance is becoming more selectively priced and more tightly tied to demonstrable security controls as ransomware concentrates claims losses.