Annual cyber notifications fall across Europe – Marsh

Cyber insurance notifications across Europe fell year-on-year in 2025 for the first time in three years, with improvements largely driven by “fewer large-scale systemic events and continued improvements in cyber security practices”.

This is according to the latest Global Cyber Claims Trends Report from insurance broker Marsh, released yesterday (23 June 2026), which also highlighted that despite the drop in incidents, high levels of risk remain across all forms of cyber activities.

Marsh pointed towards growing incident severities, privacy exposures, third-party vulnerabilities and cyber extortion as areas for clients to be particularly aware of.

Manufacturing remained the most targeted sector in 2025, representing 20% of all notifications, while financial institutions (17%) and professional services firms (10%) likewise made up a large proportion of cyber incidents.

In terms of event types, privacy breaches – in essence data loss events – grew strongly once again, now appearing on 73% of claims. Business interruptions (18%), extortion attempts (15%), liability incidents (10%) and fraudulent transfers (9%) also proved highly common events.

Increasingly complex scenarios

Florian Sättler, cyber incident management leader and cyber claims co-leader for Europe at Marsh, said: “While cyber claim notifications fell across Europe in 2025, the severity of incidents remains a significant concern.

“Privacy-related exposures continue to distinguish the European cyber risk landscape, while extortion, social engineering and third-party incidents are driving increasingly complex and costly loss scenarios.”

He added: “As cyber threats evolve and regulatory expectations grow, organisations must be prepared not only to prevent incidents, but also to respond and recover effectively when they occur.

“The cyber insurance market plays a critical role in supporting organisations throughout that journey, providing access to risk expertise, incident response resources and financial protection before, during and after a cyber event.”