The number of claims notifications have continued to increase throughout 2026 and, at the end of August, had already exceeded the total number recorded during 2024. The current trends suggest activity will comfortably exceed 2025 by year end.

Some of the most common notification types over the last 12 months include business email compromise, phishing and social engineering attacks. Threat actors are increasingly leveraging trusted communication platforms such as Microsoft Teams and WhatsApp, alongside traditional email-based attacks, to impersonate employees, divert payments, and facilitate fraud.

Third-party provider incidents also remain a significant source of claims notifications, reflecting organisations’ growing reliance on external technology and service providers. Privacy-related events also continue to generate substantial activity, particularly accidental disclosures, confidentiality breaches, and data handling errors.

Law firms remain one of the most frequently affected sectors, experiencing a broad range of incidents including phishing attacks, client fund fraud, privacy breaches and impersonation scams.

We have also seen a notable increase in copyright-related litigation and subsequent claims notifications within the market, driven largely by the unauthorised use of copyrighted music in social media content, digital advertising and marketing campaigns. As organisations expand their online presence and content output, rights holders are taking a more proactive approach to enforcement, creating a growing source of financial risk that is often overlooked by businesses.

Encouragingly, Lockton’s analysis of claims data over the past five years demonstrates that cyber policies respond effectively when claims do occur, with 98.2% of all claims covered by insurers and only a minority of notifications resulting in a coverage declinature. Further review of those declined claims found that the reasons for denial were generally clear and understandable and largely related to losses falling outside the intended scope of cyber insurance coverage.

Examples included claims for patent infringement, which would typically fall under a dedicated Intellectual Property policy, claims arising from false advertising, which are not covered under the multimedia liability provisions of most cyber policies (although coverage may be available under the Lockton proprietary wording), and claims involving theft of funds resulting from social engineering incidents. While cyber policies may provide limited cover for social engineering losses through a sub-limited extension, these exposures are more commonly insured under a dedicated crime policy.

Overall, the findings reinforce the value of cyber insurance as a reliable source of protection for cyber-related losses, with declinatures arising primarily where the claim falls outside the policy’s intended coverage rather than from disputes over valid cyber claims.