Verizon Finds Ransomware in 48% of Breaches Examined in 2026

Key Takeaways

• Ransomware appeared in 48% of examined breaches, keeping extortion high on corporate risk agendas (source).
• Cyber insurance covers more than ransomware, with email compromise and funds-transfer fraud producing a larger share of reported claims.
• Small and midsize businesses remain significantly underinsured even as cybercrime losses and AI-enabled fraud increase.

Verizon found ransomware involved in 48% of the breaches examined in its 2026 Data Breach Investigations Report. The figure reinforces a difficult reality for corporate security leaders, insurers, and boards: ransomware remains a frequent breach component despite years of investment in detection, backups, endpoint controls, and incident response.

The insurance implications extend well beyond ransom payments. A disruptive attack can create overlapping costs tied to forensic investigations, data restoration, legal advice, regulatory response, customer notification, business interruption, and third-party liability. Policy language determines which expenses are covered, how limits apply, and whether exclusions or security-control requirements affect a claim.

That distinction matters because cyber risk is broader than extortion. Research from Triple-I and Fenix24 found that business email compromise and funds-transfer fraud represented 56% of reported cyber-insurance claims in 2023, compared with 19% for ransomware. In other words, organizations focusing their insurance decisions almost entirely on ransomware may overlook the fraud scenarios most likely to trigger a claim.

Attackers do not need to encrypt a network to cause a material loss. A convincing email, compromised supplier account, or deepfake call can induce an employee to change payment details or authorize a transfer. Once the money moves, recovery can be difficult, and coverage may depend on whether the policy includes social engineering, computer fraud, or funds-transfer provisions.

The financial backdrop is worsening. Reported U.S. cybercrime losses reached nearly $21 billion in 2025, up from approximately $16 billion in 2024 (source). AI-enabled cybercrime generated about $893 million in reported losses during 2025, highlighting the growing use of synthetic identities, deepfakes, and automated fraud. Those capabilities can make familiar scams faster, cheaper, and more convincing.

Yet only an estimated 10% to 20% of small and midsize businesses carry cyber insurance. That leaves most smaller organizations exposed to recovery costs, lost revenue, and potential liability without a dedicated risk-transfer mechanism. Why does the protection gap remain so large when reported losses keep climbing?

Price is only part of the answer. Global cyber-insurance premiums were estimated at roughly $16 billion in 2025 and are forecast to reach $16.4 billion in 2026. Softer pricing has not materially closed the small-business coverage gap. Some companies still view cyber insurance as an optional technology expense, while others face detailed applications, control requirements, limited internal expertise, or uncertainty about what policies actually cover.

Insurers such as Munich Re and Chubb, along with brokers including Aon, are responding through more detailed underwriting and closer examination of systemic exposure. Underwriters increasingly look for evidence of multifactor authentication, tested backups, endpoint monitoring, privileged-access controls, employee training, incident-response planning, and oversight of critical suppliers. Applicants may also face more scrutiny when filing claims if their actual controls differ from representations made during underwriting.

Formal security programs can help organize that evidence. The NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022 give organizations structured ways to document governance, identify critical assets, manage access, prepare for incidents, and track corrective work. Certification is not the only route, but clear documentation tends to make insurance discussions more concrete.

That said, coverage is not a substitute for operational resilience. Businesses should examine ransomware, payment fraud, cloud outages, vendor compromise, and data-liability scenarios separately, then compare those exposures with policy limits, sublimits, waiting periods, exclusions, and notification obligations. Finance, legal, security, and insurance teams all have a role.

Verizon’s 48% finding keeps ransomware near the center of the conversation (source). The broader claims data points to a more complicated task: companies need protection against extortion, but also against fraud and supply-chain failures that may produce equally serious losses without ever displaying a ransom note.