Ransomware is rising. European cyber insurance rates are falling. Is the market getting the balance right?

Ransomware activity reached a new high in Q3 2026, while the European cyber insurance market continues to face strong competition and pricing pressure. The two trends raise an important question for insurers, brokers and businesses: are changing cyber exposures being adequately reflected in insurance pricing and risk management?

We run through data and market trends with Ali Khodabakhsh, Head of Cyber Europe.

Ransomware activity reaches record levels

According to the latest Comparitech analysis, reported ransomware activity increased by 29% quarter-on-quarter and 61% year-on-year in Q3 2026. 
Manufacturing remained the most frequently targeted business industry, with an increase of 22% quarter-on-quarter. Financial services (+72%) and technology (+70%) experienced much faster growth in reported activity. 
These figures include both confirmed incidents and unverified claims reported by ransomware groups.

Europe is prominently exposed

Germany ranked second globally, behind the United States. Italy ranked fourth, France seventh and Spain eighth. Four European markets therefore appeared among the ten most frequently targeted countries in Comparitech's dataset. These rankings underline the relevance of ransomware for European businesses, although differences in disclosure and reporting practices should be considered when comparing countries.

What does this mean for cyber insurance pricing?

The European cyber insurance market continues to experience abundant capacity and competitive pricing. However, recent US data suggests that pricing trends are not moving in the same direction everywhere. According to CRC Group’s REDY Index, average cyber renewal pricing in the US increased by 7.5% year-on-year in September 2026, with CRC noting that SME pricing may have reached a floor. While US wholesale renewal data is not directly comparable with the European market, it is a development worth watching.
At the same time, pricing trends cannot be assessed on the basis of ransomware activity alone. An increase in reported attacks does not automatically result in higher insured losses or deteriorating loss ratios. Insurance outcomes depend on which organisations are affected, the effectiveness of their security controls, the duration and cost of disruption, the quality of incident response, and the structure of their insurance coverage.
In other words, cyber threats may be increasing while individual organisations become more resilient. The key question is therefore not whether ransomware activity and insurance pricing must move in the same direction. It is whether the market is properly recognising the difference between growing threats, changing vulnerabilities and actual insured loss outcomes.
This does not mean that continued rate reductions are sustainable. If pricing reductions exceed the actual improvements in underlying risk, the long-term sustainability of the market could be challenged. 

Prevention and response matter as much as price

A sustainable approach to cyber risk should extend beyond the insurance transaction. Businesses should assess critical suppliers and shared technology platforms, test recovery capabilities and ensure that incident response arrangements can be activated without delay. The speed at which an organisation contains an incident and restores operations can be as important as the ultimate insurance payment.
Ultimately, businesses do not want a large insurance payout. They want to avoid disruption, protect their reputation and return to normal operations as quickly as possible.
At DUAL, we combine cyber underwriting with prevention and specialist incident response capabilities to help businesses reduce both the likelihood and potential impact of cyber incidents. Our focus is not only on transferring financial risk, but on helping clients reduce disruption and return to business as quickly as possible.
We believe sustainable cyber insurance is not only about pricing risks accurately, but also about actively helping clients reduce them.

Speak to DUAL Europe Cyber team:
For a discussion about evolving ransomware exposures, cyber resilience and insurance solutions, contact the DUAL Europe Cyber team.