Morningstar Cybercrime Losses Surge Amid Insurance Gaps and Evolving Threats
Article Content
- •Cybercrime losses in the U.S. reached nearly $21 billion in 2025, up from $16 billion in 2024.
- •79.2% of financial professionals cite cybersecurity as their top risk, with 38% unprepared for threats.
- •Cyber insurance adoption among small businesses remains low, estimated at only 10% to 20%.
Cybercrime losses in the U.S. reached nearly $21 billion in 2025, a significant increase from $16 billion in 2024, with over 1 million incidents reported. The rise in claim severity, particularly among large businesses, has been attributed to AI-driven threats, including sophisticated phishing and social engineering tactics. Despite the growing risks, adoption of cyber insurance among small and mid-sized businesses remains low, estimated at only 10% to 20%. A recent survey indicated that cybersecurity and fraud are the top concerns for financial institutions, with 79.2% citing cybersecurity as their leading risk. Additionally, 38% of surveyed organizations reported being inadequately prepared for cyber threats, highlighting a gap between awareness and readiness. The commercial cyber insurance market is projected to grow, but many businesses still lack the necessary resources to recover from attacks. The evolving nature of cyber threats, including supply-chain vulnerabilities, is complicating risk management efforts.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Common questions
What are the main risks identified for 2026?
How significant is the rise in cybercrime losses?
What is the current state of cyber insurance adoption?
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…