Cyber liability claims examples (2 figures)
The median published figure in the Cyber Claims Severity Benchmark is 137,500 USD across 2 sources' own pages in USD (range 115,000 to 160,000 USD; 3 sources publish a figure), read 12 October 2026.
3 of the 16 named sources read in full publish a figure; 13 publish none, read 12 October 2026.
The median is unchanged since 26 September 2026 (was 137,500 USD across 2).
By series
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| seriesregulator | 80,850AUD | 80,850 to 80,850AUD | 1 |
| seriesinsurer-claims | 137,500USD | 115,000 to 160,000USD | 2 |
Every figure, with its source
One row per published figure: the figure as the source's own page publishes it, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| Marsh: ransomware in cyber insurance claims | 160,000USD | insurer-claims | 2026-10-12 |
| The Coyle Group cyber insurance claims examples | 115,000USD | insurer-claims | 2026-10-12 |
| ASD/ACSC Annual Cyber Threat Report 2024-25 | 80,850AUD | regulator | 2026-10-12 |
The sentence each figure was read from (3)
- Marsh: ransomware in cyber insurance claims, read 2026-10-12:
During the last five quarters, the median cost of breach response expenses remained around $160,000, while the average has trended upwards, from $963,000 in the third quarter of 2023 to $1 million in the fourth quarter, primarily due to a few large cyber events.
- The Coyle Group cyber insurance claims examples, read 2026-10-12:
Average claim cost: $115,000 globally ($108,000 in the U.S.), but ransomware attacks average $292,000
- ASD/ACSC Annual Cyber Threat Report 2024-25, read 2026-10-12:
Average self-reported cost of cybercrime per report for businesses, up 50% overall ($80,850)
Read in full, publishes no figure
13 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- HHS OCR breach portal, read 2026-09-12: read in full and no accepted figure on the page
- HHS: breach reporting, read 2026-09-12: read in full and no accepted figure on the page
- FBI IC3 annual reports, read 2026-10-11: read in full and no accepted figure on the page
- FBI IC3, read 2026-10-12: read in full and no accepted figure on the page
- FBI IC3 2024 Internet Crime Report (PDF), read 2026-09-12: read in full and no accepted figure on the page
- ICO data security incident trends, read 2026-10-12: read in full and no accepted figure on the page
- GOV.UK Cyber Security Breaches Survey, read 2026-10-12: read in full and no accepted figure on the page
- OAIC notifiable data breaches statistics dashboard, read 2026-09-12: read in full and no accepted figure on the page
- OAIC notifiable data breaches publications, read 2026-09-12: read in full and no accepted figure on the page
- OAIC notifiable data breaches report: July to December 2024, read 2026-09-12: read in full and no accepted figure on the page
- OAIC: data breach notifications at an all-time high in 2025, read 2026-09-12: read in full and no accepted figure on the page
- California Attorney General data breach list, read 2026-10-12: read in full and no accepted figure on the page
- Washington Attorney General data breach notifications, read 2026-10-12: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
3 of the 16 named sources that could be read published a usable figure; 13 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in USD (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 29 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per jurisdiction per period: notified breaches, their cause split and the authority's own cost figure, from each regulator's own series (HHS OCR, the state AG registers, the ICO, the OAIC, the ASD); across them, the frequency a business of a given size faces and the severity it faces, set against the limits sold in the price index - the answer to 'how much do I need' that no seller's page computes, because no seller holds all four countries' registers
29 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (16)
- HHS OCR breach portal(the publisher's own terms; quoted for reporting and comment)
- HHS: breach reporting(the publisher's own terms; quoted for reporting and comment)
- FBI IC3 annual reports(the publisher's own terms; quoted for reporting and comment)
- FBI IC3(the publisher's own terms; quoted for reporting and comment)
- FBI IC3 2024 Internet Crime Report (PDF)(the publisher's own terms; quoted for reporting and comment)
- ICO data security incident trends(the publisher's own terms; quoted for reporting and comment)
- GOV.UK Cyber Security Breaches Survey(the publisher's own terms; quoted for reporting and comment)
- OAIC notifiable data breaches statistics dashboard(the publisher's own terms; quoted for reporting and comment)
- OAIC notifiable data breaches publications(the publisher's own terms; quoted for reporting and comment)
- OAIC notifiable data breaches report: July to December 2024(the publisher's own terms; quoted for reporting and comment)
- OAIC: data breach notifications at an all-time high in 2025(the publisher's own terms; quoted for reporting and comment)
- ASD/ACSC Annual Cyber Threat Report 2024-25(the publisher's own terms; quoted for reporting and comment)
- California Attorney General data breach list(the publisher's own terms; quoted for reporting and comment)
- Washington Attorney General data breach notifications(the publisher's own terms; quoted for reporting and comment)
- Marsh: ransomware in cyber insurance claims(the publisher's own terms; quoted for reporting and comment)
- The Coyle Group cyber insurance claims examples(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The median published figure in the Cyber Claims Severity Benchmark is 137,500 USD across 2 sources' own pages in USD (range 115,000 to 160,000 USD; 3 sources publish a figure), read 12 October 2026.
3 of the 16 named sources read in full publish a figure; 13 publish none, read 12 October 2026.
Cyber Claims Severity Benchmark, series regulator: median 80,850 AUD across 1 source, read 12 October 2026.
Cyber Claims Severity Benchmark, series insurer-claims: median 137,500 USD across 2 sources, read 12 October 2026.
The median is unchanged since 26 September 2026 (was 137,500 USD across 2).
Cite as: "Insurance by Profession Cyber Claims Severity Benchmark", updated 2026-10-21, https://insurancebyprofession.com/datasets/cyber-claims-severity-benchmark/.
Download the CSV (3 rows, computed 2026-10-21)