Recent international retail attacks ‘not big enough’ to harden cyber market

The cyber insurance market in Europe has softened from its early 2020s ransomware wave peak, leading to lower prices, readily available coverage and more favourable terms.

That was according to Ben Dyson, senior editor at S&P Global Market Intelligence, who also said that it would take a large or systemic loss to harden the market again.

He made this claim during the S&P Global Market Intelligence webinar on 24 July 2025, entitled ‘Outlook and Trends for European Insurers – Second Half of 2025 and Beyond’, which examined key trends influencing the insurance and reinsurance sectors across Europe.

During the webinar, the audience voted for what they thought was the biggest risk for insurers in Europe. The poll revealed that 30% of audience members believed digital transformation and cybersecurity to be the biggest risk – coming second to geopolitical and economic volatility.

This wariness around cyber security is not unfounded, with recent attacks such as the widespread exploitation of zero-day vulnerabilities in enterprise collaboration platform Microsoft SharePoint in July 2025 and infamous data breaches at UK retailers Marks and Spencer (M&S) and Co-op in April 2025.

According to a report released by the Cyber Monitoring Centre (CMC), the total financial impact of these attacks for M&S and Co-op is between £270m to £440m, due to the total disruption to their online services as well as in-store sales.

Addressing the UK retail cyber attacks specifically, Dyson noted that the incidents are “not big enough” to change the market as the pricing and terms in the cyber insurance market stand alone.

In fact, Dyson explained that the retail cyber attacks have “prompted companies” that have not bought cyber security to go to the market, while brokers and insurers have been promoting now as a “good time to buy because the prices are still relatively soft”.

Speaking on the global impact of the Microsoft SharePoint attacks, he said: “Just based on very early discussion around this, it’s looking like this isn’t necessarily going to be a big claims event for the cyber insurance markets.

“[This is] simply because a lot of the victims were US government agencies, which are not insured, but also because the attacks were very much stealing data, not introducing malware to disrupt systems.

“Nonetheless, it’s going to be an important learning point.”

Focus on people

While there has been a softening in the cyber insurance market, insurer focus on risk management remains.

Dyson said: “Cyber insurance, more than most, has a very strong risk management component to it.

“But in recent years, and it’s no different now, the insurance companies are making very sure that the companies they insure have adequate cyber hygiene – a lot of that now is focused around individuals.

Dyson concluded that “the weakest link in any cyber security setup is humans” which makes it even more significant to train staff members to counter “deep fakes and phishing attempts”.