Cyber Insurance Losses Surge Despite Fewer Claims in 2025

The cost of cyber insurance losses is climbing at a startling pace — even as the number of claims filed actually falls. That’s the headline from Chubb’s 2026 Cyber Claims Report, which paints a picture of a market where severity, not frequency, is the real problem.

For large US companies, the average cost per claim doubled in 2025 compared to the prior year. Middle-market firms saw a 22% jump. And the story repeats across the Atlantic, where large UK and European businesses faced a 98% increase in average claim severity.

The driving force? It’s not more attacks. It’s the aftermath — specifically, the soaring expense of data breach litigation, privacy-related lawsuits, and business interruption costs.

Why Average Claim Costs Are Exploding

Chubb’s report, released on August 25, points to a perfect storm of legal and regulatory pressure. In the US, third-party litigation expenses are a major factor. Companies hit by a breach increasingly face class-action lawsuits, and the administrative costs alone can be staggering.

Consider this example from the report: in a suit involving 10,000 claimants, non-refundable filing fees can exceed $10 million — before the case is even heard. That’s a massive chunk of any cyber insurance payout, regardless of whether the claim has merit.

Privacy Laws Add New Burdens

A growing web of privacy legislation in the US and EU is also stacking obligations on businesses that store or transfer personal data. These include the right to opt out of profiling, disclosure requirements for AI-driven processing, and other compliance hurdles that didn’t exist a few years ago.

The result: even a relatively contained data incident can trigger a cascade of legal exposure.

Ransomware Tactics Are Making Things Worse

Ransomware actors have changed their playbook. Instead of just encrypting data, they now leak it. That doubles the damage — victims face not only operational disruption but also litigation risk under data protection laws for exposing personal information.

This shift is a key reason why cyber insurance losses are rising even as the frequency of claims drops. One successful attack now carries a much heavier price tag.

US vs. UK and Europe: A Tale of Two Markets

There’s a stark difference in claim costs between regions. In 2025, the average claim in the US was far more expensive than in the UK and Europe. Chubb attributes this to the absence of material third-party litigation expenses in the latter region — both for data breach and non-data breach privacy claims.

European companies simply don’t face the same class-action culture. That keeps average payouts lower, even as severity trends upward.

SMEs: A Different Pattern Entirely

Small and medium-sized enterprises tell a different story. For SMEs, the frequency of claims actually went up in both regions during 2025.

• US SMEs: Average claim cost fell from $215,297 to $141,931
• UK and European SMEs: Average claim cost rose from $51,095 to $82,621

That divergence suggests US SMEs are experiencing less severe incidents — or perhaps they’re simply reporting smaller breaches more often. Either way, the trend lines are moving in opposite directions.

What This Means for Businesses Buying Cyber Insurance

If you’re shopping for cyber coverage, the takeaway is clear: premiums may not track claim frequency. Insurers are pricing for severity, and severity is climbing.

Businesses should also recognize that data breach costs are no longer just about IT recovery. Legal defense, regulatory fines, and privacy compliance are now major line items in any claim.

And with ransomware attack tactics evolving, the risk profile keeps shifting. A single incident can now trigger multiple layers of liability.

The bottom line: cyber insurance losses are rising because the consequences of a breach are more expensive than ever. Fewer claims doesn’t mean less risk — it means the risk is concentrating into bigger, costlier events.

For a deeper look at how much a breach actually costs, check out our coverage of data breach cost trends.

Berlin refuses to pay ransom after Rhysida hackers claim massive data theft

Berlin’s government has drawn a hard line: it won’t pay a cent to the hackers who say they’ve stolen terabytes of official data. Governing Mayor Kai Wegner made that clear on Friday, calling the situation outright blackmail.

“The state of Berlin is being blackmailed,” Wegner said, adding that the government would not comply with the attackers’ demands. His remarks came as the Rhysida ransomware group claimed responsibility for the breach, which was discovered in mid-August.

What Rhysida claims to have stolen

According to several dark-web monitoring sites, Rhysida has posted Berlin on its leak site, claiming to have grabbed a staggering 5.79 terabytes of government data. That’s a lot of documents. The group says the haul includes 46,500 contracts, plus emails, phone numbers, passwords, and classified information.

They’ve put the dataset up for auction, with a starting price of 30 bitcoin — roughly $2.3 million at current rates. A countdown of about seven days was posted, adding urgency to an already tense situation.

Berlin authorities have confirmed that data was indeed stolen and that an extortion demand was received. But they’ve stopped short of officially blaming Rhysida or verifying the group’s claims about the volume or contents of the stolen files. Investigators are still digging into the scope and nature of the breach. They haven’t ruled out that personal data or other non-public information was compromised.

The data is believed to have been taken between August 7 and August 12. Wegner had earlier said there was no indication that sensitive information was compromised, but that assessment may change as the investigation unfolds.

The attack’s impact on city services

Berlin disconnected the affected systems from the wider state network on August 14, the day the breach came to light. Two ministries were cut off: one handling urban development, construction, and housing, and another overseeing mobility, transport, climate protection, and the environment.

Both ministries stayed operational, but employees lost access to their usual IT systems. That meant no email, no internet services. Some staff had to fall back on telephone, text messages, and even fax machines. Yes, fax. In 2026.

The disruption rippled outward. Some district offices couldn’t process applications for housing benefits or education and participation assistance, because those processes rely on systems run by the affected urban development ministry. Berlin’s state-owned IT provider, ITDZ Berlin, wasn’t hit. The two ministries share some IT infrastructure and run their section of the state network independently of ITDZ, according to local media.

Election security under the microscope

The timing couldn’t be worse. Berlin holds elections to its House of Representatives on September 20 — less than a month after the breach. That’s raised obvious questions: could the attackers disrupt election infrastructure?

Interior Senator Iris Spranger sought to calm those fears on Friday. “According to what we know at this point, no data has been exfiltrated from there,” she said. “According to our security officials, the election environment is secure.”

Who is Rhysida?

Rhysida isn’t a new player. The group has been active since at least May 2023, targeting governments, hospitals, schools, manufacturers, and tech companies. Their playbook is familiar: steal data, encrypt systems, then demand cryptocurrency payments.

They’ve hit a string of high-profile public-sector and healthcare organizations worldwide. Cybersecurity researchers have assessed that the group is likely Russian-speaking or operating from the broader Russian region, though the operators’ identities and exact location remain murky.

For Berlin, the refusal to pay is a statement. But it also means the leaked data could end up public. The city is bracing for that possibility. In the meantime, officials are working to restore normal operations and reassure residents that their information is safe. Whether that holds remains to be seen.

Iranian Espionage Group Adds New Tools

An Iranian-linked threat actor has quietly expanded its malware toolset, adding a backdoor and a reverse SSH tunneling utility. Researchers at Group-IB say newly identified infrastructure hints at broader targeting across Europe and the Middle East.

The group, tracked as Tortoiseshell by Group-IB and Mirage Kitten by Kaspersky, has been active since at least 2018. Its focus? Defense, aerospace, IT service providers, and military organizations in the Middle East and the US.

Reverse SSH Tunnel: A Stealthy Entry Point

One newly discovered sample is a reverse SSH tunneling utility disguised as wtsapi32.dll, a legitimate Windows Terminal Server API DLL. The malware forward-exports genuine functions from the DLL while using Windows’ built-in OpenSSH client to connect to Tortoiseshell infrastructure.

The result? A reverse tunnel that can redirect traffic from the command-and-control (C2) server straight into the compromised network. Group-IB notes this behavior aligns with techniques previously documented by Google Threat Intelligence Group (GTIG) for UNC1549.

The Backdoor: A C++ Imposter

A second sample is a C++ backdoor showing similarities to TWOSTROKE malware, previously documented by GTIG in late 2025. Like the SSH tunnel, it’s disguised as wtsapi32.dll and appears designed for DLL search-order hijacking.

Once loaded, the backdoor establishes HTTPS communications with multiple hardcoded C2 servers. It generates a unique identifier from the victim’s fully qualified hostname and supports a range of malicious actions:

• File and shell command execution
• In-memory DLL execution
• File transfer and directory listing
• File deletion

That’s a full toolkit for espionage, all wrapped in a seemingly innocent DLL.

Infrastructure Points to Wider Targeting

Group-IB also uncovered infrastructure tied to a previously known Tortoiseshell C2 domain. Two domains, locat[.]sbs and tiktok-u[.]sbs, resolved to related servers. Their subdomains used country or regional identifiers including UAE, Saudi Arabia, the UK, Belgium, Canada, Australia, and Japan.

That spread could indicate an expanded targeting profile covering Middle Eastern and European countries. But Group-IB cautions that actual use remains unclear—they haven’t yet linked any malware samples to these servers.

Interestingly, the servers stayed active even after the tiktok-u[.]sbs domain was suspended by its registrar. Historical DNS data shows its subdomains previously resolved to the same servers as those associated with locat[.]sbs.

What This Means for Defenders

Tortoiseshell’s evolving toolset is a reminder that threat actors don’t rest. The group’s shift toward DLL side-loading and SSH tunneling suggests a focus on stealth and persistence.

Group-IB recommends persistent threat hunting, monitoring for unusual wtsapi32.dll side-loading, and watching outbound traffic tied to known Tortoiseshell infrastructure. For organizations in defense, aerospace, or IT services, these indicators are worth adding to your detection stack.

For more on Iranian-linked cyber activity, check out our coverage of Iran-Linked MuddyWater Poses as Ransomware Gang to Mask Cyber Espionage. And if you’re tracking similar threats, our cyber threat intelligence guide offers practical steps for staying ahead.