According to a new report published by Marsh the number of companies in the US and Canada experiencing a cyber extortion event hit record numbers in 2023, with unprecedented ransom demands. However, an increasing number of companies refused to pay.
The above is one of the key findings from ‘Ransomware: A persistent challenge in cyber insurance claims’, which analyzed more than 1,800 cyber claims submitted to Marsh in the US and Canada in 2023.
Overall, 21% of Marsh’s clients reported a cyber event in 2023, a vast majority of which were privacy claims and system attacks leading to unauthorized access and potentially exposed data. This has remained fairly consistent over the last five years — between 16% and 21% — demonstrating in part that companies’ cyber controls have kept pace with the growing sophistication and frequency of cyberattacks, says Marsh.
In 2023, however, a record 282 extortion events were reported to Marsh, a 64% increase from 2022. Although representing only 17% of all cyber claims filed, ransomware remains a top concern for organizations given their increased frequency, sophistication, and potential severity.
The median ransom demand soared to $20 million in 2023 from $1.4 million, while the median payment made was $6.5 million, reflecting the effectiveness of extortion negotiations, Marsh notes in the report. Only 23% of Marsh’s clients impacted by a cyber extortion event in 2023, paid the ransom. A majority — 77% — refused, reflecting the growing trend highlighted above. In 2021, only 37% of Marsh’s clients rejected cyber criminals’ demands.
