U.S. Cyber Insurance Premiums Fell for the First Time on Record
Summary
American insurers wrote $9.14 billion in cyber coverage in 2024 — a 7.1% drop and the market's first-ever year-over-year decline, per the NAIC. Claims rose almost 40% to nearly 50,000, and the FBI logged a record $16.6 billion in cybercrime losses the same year.
The line that had only gone up
Since the National Association of Insurance Commissioners started tracking the market through its Cyber Supplement filings, U.S. direct written premium for cyber coverage had risen every single year — from $4.07 billion in 2020 to a peak of $9.84 billion in 2023, growth that touched 61% in a single year (2021) at the height of the ransomware wave. In 2024 that run ended: insurers wrote $9.14 billion, a 7.11% drop, the market's first year-over-year contraction since the NAIC began collecting this data.
View data as table
| 2020 | $4.07B | |
|---|---|---|
| 2021 | $6.54B | +60.96% YoY |
| 2022 | $9.69B | +48.03% YoY |
| 2023 | $9.84B | +1.62% YoY |
| 2024 | $9.14B | -7.11% YoY, first-ever decline |
More claims, not more payouts
The premium decline did not track a quieter year. The NAIC report counted almost 50,000 claims reported in 2024 — a nearly 40% jump — while the number of active policies barely moved (4,368,614, down 0.03%). Insurers were covering roughly the same number of customers and fielding far more claims from them, for less premium revenue than the year before.
What happened to those claims once filed is its own story. Of claims closed in 2024, insurers closed 28,555 without paying anything at all, against 9,941 closed with a payment — a ratio the NAIC's own report says runs above 20-to-1 for excess policies specifically. Loss ratios varied enormously by carrier: market leader Chubb paid out 36 cents of every premium dollar in claims, while Liberty Mutual paid out 71 cents and Starr Group paid out 96.
View data as table
| Closed without payment | 28,555 | 2024 |
|---|---|---|
| Closed with payment | 9,941 | 2024 |
Where the claims come from
The insurance market's numbers describe carriers. The 's Internet Crime Complaint Center (IC3) describes the people and organizations actually filing the underlying reports. IC3 logged 859,532 complaints in 2024 and $16.6 billion in reported losses — a new record, up 33% from 2023. Within that total, complaints IC3 codes specifically as "Personal Data Breach" rose to 64,882 in 2024, up from 55,851 the year before — even though the dollar losses tied to that category actually fell, from $534.4 million in 2023 to $364.9 million in 2024. More people reported being caught in a breach; the average one cost less.
View data as table
| 2022 | 58,859 | $459.3M in reported losses |
|---|---|---|
| 2023 | 55,851 | $534.4M in reported losses |
| 2024 | 64,882 | $364.9M in reported losses |
The takeaway
- The market broke its own pattern. Premiums rose every year from 2020 through 2023, then fell 7.1% in 2024 — the first year-over-year decline the NAIC has recorded since it began tracking the Cyber Supplement.
- Risk didn't retreat with the price. Claims rose almost 40% to near 50,000 in the same year premiums fell, and the logged a record $16.6 billion in cybercrime losses.
- Filing a claim is not the same as collecting on it. Insurers closed nearly three claims without payment for every one they paid in 2024, with loss ratios ranging from 9% to 96% depending on the carrier.
Premium and claims figures cover U.S.-domiciled and alien surplus lines carriers as reported to the NAIC's Cyber Supplement for calendar year 2024; they do not capture self-insured retentions or uninsured cyber losses. IC3 figures are self-reported complaints and are widely understood to undercount actual incidents.
Sources
- National Association of Insurance Commissioners — Report on the Cybersecurity Insurance Market (2025 ed.), the source for all direct written premium, policies-in-force, claims-closure, and carrier loss-ratio figures. content.naic.org
- Internet Crime Complaint Center (IC3) — 2024 Internet Crime Report, the source for total complaints, total reported losses, and the "Personal Data Breach" complaint-category trend. ic3.gov
Comments
Always open. Logged-in readers can annotate paragraphs in place.
Cyber insurance exists to price a risk nobody can see coming: a ransomware note, a vendor breach, a class-action suit filed the week after. For four years running, insurers priced that risk higher every year. In 2024 the line bent for the first time — premiums fell even as the underlying risk, by every other measure available, kept climbing.