The latest insights from the insurance sector reveal a troubling trend in ransomware attacks targeting businesses, particularly small and medium-sized enterprises (SMEs). According to a report from business-to-home insurer Hiscox, an overwhelming 80% of companies hit by ransomware over the past year chose to pay the ransom demanded by cybercriminals. However, paying up does not guarantee a full recovery: only 60% of those who paid were able to retrieve all or part of their stolen data, and nearly a third faced subsequent demands for additional payments.

Hiscox’s Cyber Readiness Report highlights the wide-reaching impact of cyber attacks, noting that nearly 60% of surveyed companies experienced some form of cyber intrusion within the last 12 months. Many of these firms cited vulnerabilities related to artificial intelligence technologies as a key factor in their susceptibility. Beyond operational disruption, companies also suffer reputational damage and financial penalties, often struggling to attract or retain customers after an attack.

Eddie Lamb, global head of cyber at Hiscox, emphasised the critical threat such attacks pose to the survival of businesses. He warned that the financial fallout—from hefty fines to lost revenue—can push firms to the brink, while the stress of recovery efforts affects staff morale and wellbeing. Lamb also noted a shift in cybercriminal tactics towards stealing valuable business data such as contracts, executive communications, financial records, and intellectual property. This data is considered easier to monetise than personal information, with hackers leveraging the threat of public exposure as further leverage.

Recent high-profile attacks reinforce these concerns. Jaguar Land Rover (JLR), for instance, suffered a ransomware attack that contributed to an estimated £200 million in lost production costs. The UK government granted JLR a £1.5 billion loan guarantee to protect its extensive supply chain—including many SMEs at risk of shutdowns lasting several weeks—from severe financial damage. JLR reportedly was finalising a cyber insurance policy at the time of the attack, underscoring the growing recognition of cyber risk among large employers. Cyber insurance, however, remains costly; premiums for coverage covering large-scale losses often run into millions of pounds, placing full protection beyond the reach of many companies.

The insurance market is responding with growth in cyber coverage availability, spurred by publicised disruptions at major firms like Marks and Spencer (M&S) and heightened awareness of cyber preparedness. M&S estimated a £300 million loss from its ransomware incident earlier this year but expects to reclaim most of that sum through insurance. The Hiscox report noted that companies must strike a balance between investment in preventive technologies and realistic cyber risk management to protect operations and reputation.

Despite these troubling figures from SMEs, there is a contrasting trend among larger enterprises in the UK. Recent data from 2025 shows a significant decline in ransom payments among UK enterprises, with only 17% paying up—the lowest rate on record. This shift is attributed to improved cyber resilience, including widespread use of air-gapped and immutable backups, enabling many organisations to thwart data encryption attempts before critical damage occurs. This indicates a move towards greater preparedness and resistance against ransomware attacks within some segments of the market.

The risks posed by ransomware are not confined to industry alone. Just last week, a ransomware gang targeted Kido International, a childcare provider operating 18 nurseries in Greater London, stealing and threatening to expose sensitive personal data of over 8,000 children. This alarming incident highlights the broader societal implications of cybercrime, particularly concerning vulnerable groups, and underscores the urgency for more robust data protection measures across sectors.

On a national level, the UK is facing an increasingly hostile cyber threat environment. According to the National Cyber Security Centre (NCSC), cyber incidents rose by 16% in 2024, with a notable increase in sophisticated data exfiltration and ransomware attacks. The NCSC reported issuing over 500 warnings to organisations on mitigating these threats, reflecting the scale and intensity of the challenge. Law enforcement efforts are ongoing, exemplified by the recent arrest of a suspect linked to a ransomware attack that disrupted airport systems across Europe, although investigations remain at an early stage.

Overall, the evolving cyber threat landscape underscores the need for comprehensive strategies combining prevention, rapid response, and resilient recovery frameworks. While some firms, particularly larger enterprises, are beginning to resist ransomware demands through improved defences, many smaller businesses continue to face difficult choices amid financial pressures—a reality that suggests cyber insurance, stronger security protocols, and widespread cyber education remain critical components in combating this pervasive threat.

📌 Reference Map:

Source: Noah Wire Services