Cyberwrite Study: Economic Losses From Cyber Attacks Exceed Insurance Claims Across Revenue Bands
A Cyberwrite analysis of 26 documented incidents against the claim benchmarks in the 2026 Breach Impact Study by the Verizon DBIR team and CyberAcuView, and what the gap means for cyber underwriting, limit setting and portfolio accumulation.
Key findings
- The 2026 Breach Impact Study, produced by the Verizon DBIR team with CyberAcuView, measures the insured portion of a loss. It is a rigorous claims benchmark, but a claim is by construction smaller than the economic loss an incident imposes on the victim.
- Cyberwrite compared the study's segment benchmarks with 26 documented incidents whose economic losses are disclosed in filings, regulatory records, court documents or primary reporting.
- Every documented large-enterprise loss exceeded the study's top 2.5% claim benchmark of more than $22 million, by roughly 2 to 140 times. The clearest mid-market comparable ran at least 15 times its benchmark. For SMBs, every disclosed-dollar case exceeded the segment's top 2.5% benchmark, and closure or insolvency recurs throughout the cases.
- The gap is widest exactly where solvency is decided: at the tail, in systemic supply-chain and third-party events, and in SMB survival.
- Implication: use claim benchmarks for expected-recovery questions, and anchor limits, severity curves and accumulation to ground-up economic loss. The two views complement each other.
Get the full study as a PDF
What the 2026 Breach Impact Study is
The 2026 Breach Impact Study was produced by the Verizon DBIR team in collaboration with CyberAcuView, the study's sole data partner, which contributed the claims dataset from its participating member insurers. The study covers 69,683 US cyber insurance claims for incidents from 2019 to 2025, of which 38,181 had recorded paid losses. The study calls the quantity it measures insurable loss and itself describes it as a potential floor, not a ceiling, of true economic impact.
Its headline figures: half of all paid claims had a financial impact above $83,000. By revenue segment, the median impact was about $38,000 for SMBs (revenue below $25 million), about $96,000 for the mid-market ($25 million to $250 million) and about $283,000 for large enterprises (above $250 million). The most extreme 2.5% of large-enterprise claims exceeded $22 million each; the study publishes no dollar figure for the SMB and mid-market top 2.5%.
Cyberwrite considers the study the best available benchmark for what cyber insurance claims actually record. This research note takes the study as its starting point and asks a different question: how far does the full economic loss of an incident run beyond the insurance claim, and what should underwriters do with the difference?
Source: 2026 Breach Impact Study. CyberAcuView: cyberacuview.com
Definitions
Insurance claim. The amount a cyber insurance policy paid or reserved for an incident. It records only the covered portion of a loss, after deductibles, within sublimits and up to the policy limit.
Economic loss. Everything an incident costs the victim organization, insured or not: business interruption, remediation, ransom, litigation and settlements, regulatory penalties, lost contracts, financing costs and, in the extreme case, the loss of the business itself.
Ground-up loss. The economic loss before any insurance terms are applied. Limits, severity curves and accumulation estimates that are built on ground-up loss capture the exposure; those built on claims capture the recovery.
What Cyberwrite did
The analysis followed four steps.
1. Took the study's benchmarks as published, and derived working values where the study gives none. The study publishes a median claim value for each revenue segment and a top 2.5% figure for large enterprises only (more than $22 million, taken as $22 million). The SMB top 2.5% of about $1 million is implied by the study's statement that the large-enterprise top 2.5% figure is 22 times the SMB figure. The study publishes no mid-market dollar figure; Cyberwrite uses about $2 million as a working upper bound, derived from the study's statement that top 2.5% mid-market losses did not exceed 2 percent of revenue, applied to $100 million of revenue, so mid-market multiples are stated as minimums.
2. Assembled documented incidents. Cyberwrite selected 26 incidents from 2013 to 2025 whose economic losses are disclosed by the victim, in regulatory or court filings, or in primary reporting. Cases were grouped into the same three revenue bands the study uses: large enterprise (10 cases), mid-market (6 cases) and SMB (10 cases).
3. Adjusted the benchmark to each company's size. Because the study states one benchmark per segment rather than per organization, Cyberwrite interpolated the median and top 2.5% values on a logarithmic scale between the three segment benchmarks, each placed at the geometric midpoint of its revenue band. The documented loss for each case is therefore read against a claim figure sized to that organization. Above about $1.6 billion of revenue this extends beyond the range the segments describe, so those estimates are indicative.
4. Ran Cyberwrite's own model on each organization. For each case with sufficient public data, Cyberwrite's Monetary Impact Analysis model produced the mean, median and 99th percentile of the loss distribution for a sector-typical organization of that size and country, on a pre-control basis (security risk scores set at sector medians, no credit for controls). Inputs were revenue for the last full fiscal year before the incident, sector and country. These figures are shown alongside the documented losses for comparison; they are not used in the multiples.
The result is a like-for-like comparison: documented economic loss, the study's insurance-claim benchmark scaled to the same company, and Cyberwrite's modeled ground-up loss, side by side for every case.
Three structural reasons the two figures diverge
The divergence is not noise. It follows from how cyber insurance is structured.
Scope: the claim is a subset of the loss. The study states that its dataset does not estimate uninsured losses, reputational damage or non-claim costs. The portion of a loss below the deductible is not captured in the incurred figure, and zero-dollar claims are set aside. By construction the claim is smaller than the economic loss.
Structural caps: policy architecture truncates the recorded number. Sublimits record a category such as contingent business interruption or extortion at its internal cap rather than its full size. A claim that exhausts the policy records the limit, not the loss. In a layered tower, an excess layer has no visibility into the layers above it, so the recorded severity of a single large claim is lower than the full tower loss.
Measurement and timing: how losses are summarized and matured. Median claim values describe the typical case, not the extreme, and in skewed loss data the mean runs far higher (the study's overall median is about $83,000 against an average the study describes as in the seven-figure range). Claims also develop over years as investigation and litigation conclude, so the most recent year understates final losses and long-tail liability is still emerging.
The evidence
Exhibit 1. Documented economic losses sit far beyond the insurance-claim range
Read as multiples of the top 2.5% marker: every documented large-enterprise loss exceeded the study's benchmark of more than $22 million, by roughly 2 to 140 times. Change Healthcare's $3.1 billion against $22 million is about 140 times, and Synnovis's roughly $42 million is about 2 times. The clearest mid-market comparable, Xoom, ran at least 15 times the $2 million working benchmark, and for SMBs every disclosed-dollar case exceeded the implied $1 million benchmark.
Table 1. Large enterprises (revenue above $250 million)
Insurance-claim benchmark for this segment, per the study: median about $283,000; top 2.5% more than $22 million.
| Organization (year) | Sector and incident | Documented economic loss | Insurance-claim estimate, adjusted to company revenue | Cyberwrite modeled loss (mean / median / 99th pct) |
|---|---|---|---|---|
| Change Healthcare / UnitedHealth Group (2024) | Health technology. Ransomware and business interruption. | About $3.1 billion total 2024 impact per UnitedHealth Group full-year results, including a reported $22 million ransom. More than $9 billion in interest-free provider advances and loans excluded as repayable liquidity support. | Median ~$380,000; top 2.5% ~$42 million (revenue $3.5B) | Mean $59M Median $45M 99th pct $231M |
| Merck & Co. (2017) | Pharmaceuticals. NotPetya destructive malware. | Up to $1.4 billion across roughly 40,000 wiped devices, followed by multi-year litigation over whether a war exclusion voided coverage. | Median ~$910,000; top 2.5% ~$299 million (revenue $39.8B) | Mean $524M Median $349M 99th pct $2.5B |
| Equifax (2017) | Credit reporting. Data breach and external liability. | More than $1.4 billion total cost, including a settlement of roughly $575 million to $700 million; the total exceeded the firm's annual earnings. | Median ~$360,000; top 2.5% ~$39 million (revenue $3.1B) | Mean $54M Median $42M 99th pct $214M |
| A.P. Moller-Maersk (2017) | Shipping and logistics. NotPetya business interruption. | About $250 million to $300 million, driven almost entirely by business interruption across 76 port terminals. | Median ~$870,000; top 2.5% ~$273 million (revenue $35.5B) | Mean $490M Median $328M 99th pct $2.4B |
| The Clorox Company (2023) | Consumer goods. Social-engineering ransomware via IT vendor. | About $380 million claimed, of which roughly $49 million was remediation; the balance was business interruption from months of disruption. | Median ~$490,000; top 2.5% ~$77 million (revenue $7.4B) | Mean $73M Median $58M 99th pct $267M |
| Marks & Spencer (2025) | Retail. Social-engineering ransomware via IT help desk. | About £300 million (about $400 million) impact on group operating profit before mitigation, per company disclosure; online sales suspended for about six weeks. | Median ~$680,000; top 2.5% ~$156 million (revenue $17.7B) | Mean $431M Median $276M 99th pct $2.2B |
| FedEx / TNT Express (2017) | Logistics. NotPetya destructive malware. | About $400 million in the first half of fiscal 2018, per SEC filings, from lost TNT business and systems restoration; the outbreak also raised TNT integration costs by an estimated $600 million. | Median ~$500,000; top 2.5% ~$80 million (revenue $7.7B) | Mean $80M Median $62M 99th pct $310M |
| Mondelez International (2017) | Food and beverage. NotPetya destructive malware. | About $180 million in recorded damage across 1,700 servers and 24,000 laptops; the insurer initially denied the roughly $100 million claim under a war exclusion, litigated for years before settling. | Median ~$780,000; top 2.5% ~$212 million (revenue $25.9B) | Mean $474M Median $303M 99th pct $2.4B |
| MGM Resorts (2023) | Hospitality and gaming. Social-engineering ransomware. | About $100 million impact on third-quarter adjusted property EBITDAR plus under $10 million in one-time expenses, per Form 8-K, after a ten-day shutdown of hotel and casino systems. | Median ~$610,000; top 2.5% ~$123 million (revenue $13.1B) | Mean $386M Median $238M 99th pct $2.0B |
| Synnovis (2024) | Pathology services to the NHS, revenue about £209 million. Qilin ransomware. | An estimated £32.7 million financial impact per accounts filed at Companies House, more than seven times the company's 2023 profit; over 10,000 outpatient appointments and 1,700 elective procedures postponed across London NHS trusts. | Median ~$150,000; top 2.5% ~$5.2 million (revenue $260M) | Mean $7.8M Median $6.9M 99th pct $22M |
Table 2. Mid-market ($25 million to $250 million revenue)
Insurance-claim benchmark for this segment: median about $96,000, per the study. The study publishes no dollar figure for the mid-market top 2.5%; it reports that in the top 2.5% of mid-market cases the loss did not exceed 2 percent of revenue. Cyberwrite uses about $2 million as a working upper bound (2 percent of $100 million revenue), so multiples against it are conservative.
| Organization (year) | Sector and incident | Documented economic loss | Insurance-claim estimate, adjusted to company revenue | Cyberwrite modeled loss (mean / median / 99th pct) |
|---|---|---|---|---|
| KNP Logistics / Knights of Old (2023) | Road freight, about £100 million revenue. Akira ransomware. | The entire 158-year-old business collapsed into administration and about 730 jobs were lost; a £1 million cyber policy was insufficient to recover. | Median ~$110,000; top 2.5% ~$2.9 million (revenue $124M) | Mean $4.6M Median $3.7M 99th pct $17M |
| Xoom Corporation (2014) | Money transfer, about $160 million annualized revenue. Business email compromise. | $30.8 million transferred to overseas accounts in a single fraud; the CFO resigned and the share price fell about 17 percent. | Median ~$120,000; top 2.5% ~$3.5 million (revenue $159M) | Mean $5.0M Median $4.0M 99th pct $18M |
| St. Margaret's Health (2021 attack, 2023 closure) | Regional two-hospital health system. Ransomware. | Billing and claims submission paralyzed for more than three months, triggering a financial spiral that contributed to permanent closure. | Median ~$99,000; top 2.5% ~$2.1 million (revenue $85.8M) | Mean $4.8M Median $3.9M 99th pct $17M |
| Vastaamo Psychotherapy Centre (2020, 2021 bankruptcy) | 25-clinic provider, about 400 staff. Data breach and extortion. | Bankruptcy attributed directly to the breach; a regulatory penalty of about 608,000 euros; roughly 33,000 patients extorted individually. | Median ~$56,000; top 2.5% ~$1.3 million (revenue $15.6M) | Mean $930K Median $750K 99th pct $3.4M |
| Stoli Group USA / Kentucky Owl (2024) | Spirits distribution, assets of $100 million to $500 million. Ransomware. | The attack disabled the ERP system and forced manual accounting, putting the units in default with lenders; a contributing factor in the Chapter 11 filing that later converted to Chapter 7. | Median ~$64,000; top 2.5% ~$1.5 million (revenue $23.8M) | Mean $1.0M Median $850K 99th pct $3.4M |
| National Bank of Blacksburg (2016 to 2017) | Community banking, 25 offices in Virginia. Phishing-led network intrusions and ATM cash-out. | $2.4 million taken across two coordinated intrusions; the insurer offered $50,000 under a debit-card rider rather than the $8 million computer-crime rider, litigated in NBB v. Everest. A documented case of the recorded claim running 48 times below the economic loss. | Median ~$83,000; top 2.5% ~$1.8 million (revenue $50.9M) | Mean $3.4M Median $2.4M 99th pct $15M |
Table 3. Small and medium-sized businesses (revenue below $25 million)
Insurance-claim benchmark for this segment: median about $38,000, per the study; top 2.5% about $1 million, implied by the study's statement that the large-enterprise top 2.5% figure is 22 times the SMB figure.
| Organization (year) | Sector and incident | Documented economic loss | Insurance-claim estimate, adjusted to company revenue | Cyberwrite modeled loss (mean / median / 99th pct) |
|---|---|---|---|---|
| Efficient Services Escrow Group (2013) | Escrow services, nine employees. Banking-trojan wire fraud. | $1.5 million stolen, of which $1.1 million was never recovered; state regulators forced the firm to close and lay off all staff. | Median ~$33,000; top 2.5% ~$910,000 (revenue $3.4M) | Mean $600K Median $410K 99th pct $2.8M |
| The Heritage Company (2019) | Telemarketing, about 300 employees. Ransomware. | The ransom was paid but systems could not be restored; the 61-year-old firm ceased operations and about 300 employees lost their jobs. | Median ~$51,000; top 2.5% ~$1.2 million (revenue est. $12.1M) | Mean $720K Median $550K 99th pct $2.8M |
| Lincoln College (2022) | Higher education, fewer than 1,000 students. Ransomware. | A ransom under $100,000 was paid, but recruitment and fundraising systems were down for three months; the college closed after 157 years. | Median ~$66,000; top 2.5% ~$1.5 million (revenue $25.9M) | Mean $1.2M Median $980K 99th pct $3.9M |
| Wood Ranch Medical (2019) | Medical practice. Ransomware. | Patient records and backups were encrypted beyond recovery; the practice permanently closed and about 5,835 patients were affected. | Segment benchmark (revenue not available) | Not modeled |
| Brookside ENT and Hearing Center (2019) | Medical practice. Ransomware. | A $6,500 ransom was refused; the attackers wiped all files, the practice closed permanently, and its two physicians retired early. | Median ~$29,000; top 2.5% ~$810,000 (revenue est. $2.2M) | Mean $620K Median $420K 99th pct $2.9M |
| AMCA / Retrieval-Masters (2019) | Medical debt collection, about 113 employees. Web payment portal breach affecting up to 21 million individuals. | Disclosed response costs included $3.8 million to mail seven million breach notices and $400,000 in IT consultants; its largest clients terminated, and the parent filed for Chapter 11 within weeks. | Median ~$48,000; top 2.5% ~$1.2 million (revenue $10.0M) | Mean $680K Median $510K 99th pct $2.8M |
| Code Spaces (2014) | Source-code hosting SaaS. Cloud account takeover and extortion. | An attacker with access to the company's AWS control panel deleted production data, machine configurations and most backups after a ransom was refused; the company shut down permanently within days. | Segment benchmark (revenue not available) | Not modeled |
| CloudNordic (2023) | Cloud hosting provider, Denmark. Ransomware via compromised administration systems. | All systems and servers were encrypted, including backups; the company refused to pay, concluded the data could not be recovered, and stated that the majority of its customers had lost all data hosted with the firm. | Segment benchmark (revenue not available) | Not modeled |
| Saint Ambrose Catholic Parish (2019) | Church and school community, Ohio. Business email compromise. | $1.75 million in renovation funds wired to a fraudulent account after attackers compromised two email accounts and impersonated the parish's construction contractor; investigated by the FBI. | Segment benchmark (revenue not available) | Not modeled |
| Colorado Timberline (2018) | Printing and apparel decoration, Denver. Ransomware. | The company ceased all operations indefinitely after repeated attacks; its closure notice stated it was unable to overcome the final ransomware attack. | Median ~$63,000; top 2.5% ~$1.5 million (revenue $23M) | Mean $890K Median $710K 99th pct $3.2M |
Notes on the cases: actual figures are as disclosed by the victim, in regulatory or court filings, or in primary reporting. Where an organization closed or entered insolvency, the economic loss is the loss of the going concern rather than a single disclosed number. A few cases sit outside the United States or involve more than one contributing factor, which is stated in the entry; they are included because they are among the best-documented severity examples available. Documented dollar figures are scarcest in the mid-market, where private companies rarely disclose; that silence biases every public severity dataset downward, and the cases shown are those with regulatory, court or company-disclosed records. The insurance-claim estimate in the fourth column is a Cyberwrite adjustment of the segment benchmarks, not a figure published in the study. The Cyberwrite modeled loss is the model's estimate for a sector-typical organization of that size, not a reconstruction of the specific incident, run in 2026 on a pre-control basis.
The divergence is largest exactly where solvency is decided
The gap is not uniform. It widens in the three places that matter most for capital and pricing.
At the tail. Medians describe the expected claim, but limits and reserves have to hold against the extreme. The large-enterprise cases show economic outcomes up to two orders of magnitude above the claim tail, which is where limits adequacy is actually tested.
In systemic events. Business-ending and supply-chain or third-party events are precisely where claim records meet coverage caps and understate the loss. The 2024 CDK Global outage illustrates the mechanism: an estimated $1.02 billion in direct losses across roughly 15,000 US auto dealers in under three weeks (Anderson Economic Group), each individual loss modest, the correlated total catastrophic. The same pattern reaches down-market: the 2021 Kaseya VSA compromise disrupted an estimated 800 to 1,500 downstream small businesses through roughly 60 managed service providers, and a 2019 ransomware attack on the backup provider PerCSoft locked files at about 400 US dental practices in a single event. At the largest scale, the 2025 Jaguar Land Rover production halt shows the same shape: the Cyber Monitoring Centre modeled a £1.9 billion UK financial impact, the majority of it lost manufacturing output at JLR and its multi-tier suppliers, across more than 5,000 organizations. These are the events that correlate across a portfolio, so a claim-only view understates accumulation. This is the core concern of cyber catastrophe modeling, as distinct from single-risk assessment.
For smaller firms, the outcome is existential. Closure or insolvency recurs throughout the documented cases. Because the cases are selected for severity, this is not a failure rate; it shows an outcome class that claim data cannot represent. For an SMB the relevant question is often not the dollar severity of a claim but whether the business survives, which no claim figure expresses.
Implications: anchor decisions to ground-up economic loss
The response is not to discard claim benchmarks but to use them for the question they answer, expected recovery, while anchoring capital-relevant decisions to ground-up economic loss. Adding deductibles and reserves back to the incurred loss recovers a fuller severity view; extending it to uninsured and non-claim costs recovers the economic tail.
| Decision | Anchored to insurance claims (common today) | Anchored to ground-up economic loss (recommended) |
|---|---|---|
| Limit setting | Sized around the median or expected claim. | Sized to the economic tail: the top 2.5% and beyond, up to loss of the enterprise. |
| Severity and pricing | Severity curves fit to incurred claim data. | Curves fit to ground-up loss, adding deductibles and reserves back to the incurred figure. |
| Portfolio accumulation | Correlation measured on claim payouts. | Correlation measured on economic loss, including systemic supply-chain and third-party events. |
| SMB risk view | Dollar severity of the expected claim. | Probability the business survives the event, not only the dollar amount. |
How Cyberwrite applies this
Cyberwrite's financial-impact modeling is built on real breach and loss data and estimates ground-up economic impact and the full loss distribution, including the tail, as a complement to insurance-claim benchmarks.
Single-risk cyber risk assessment. For an individual company, the modeled loss distribution (mean, median, 99th percentile) makes the gap between a client's exposure and the cover it holds explicit, which lets an underwriter or broker defend a higher limit on evidence rather than appetite.
Cyber catastrophe modeling. At portfolio level, modeling economic loss rather than claim payouts exposes how correlated loss propagates through shared dependencies (vendors, platforms, service providers), and lets the controls that keep most campaigns contained, and the rates at which those controls fail, be modeled directly.
Claim benchmarks price the recoveries on a single risk. Economic-loss estimates size both the gap above them and the correlation across the book that turns many simultaneous recoveries into one catastrophe. Used together, they give underwriters a more complete and more defensible view of cyber risk than either provides alone.
Related: Cyber Risk Analytics, Catastrophe Modeling, Cyber Risk Quantification, Understanding EP Curves
FAQ
Methodology and sources
This analysis is stated in original terms. The 2026 Breach Impact Study, produced by the Verizon DBIR team with CyberAcuView as its sole data partner, is used only as a cited source of published statistics, and incident details are reported as facts from the sources listed below. The cases are selected as documented severity examples and illustrate the magnitude of the gap between claim figures and economic loss; they are not a frequency statement about how often losses of this size occur, nor a survival rate; organizations that failed are overrepresented in public records precisely because failure forces disclosure. Segments follow the revenue bands used in the study. Multiples are the documented economic loss divided by the segment's top 2.5% claim benchmark, rounded. The large-enterprise benchmark is the study's published figure of more than $22 million, taken as $22 million. The SMB benchmark of about $1 million is implied by the study's statement that the large-enterprise top 2.5% is 22 times the SMB top 2.5%. The study publishes no mid-market dollar figure for the top 2.5%; the $2 million working benchmark is a Cyberwrite upper bound derived from the study's statement that mid-market top 2.5% losses did not exceed 2 percent of revenue, applied to $100 million of revenue, so mid-market multiples are stated as minimums. For organizations that closed, the economic loss is stated as loss of the going concern rather than a point estimate. The Cyberwrite modeled loss range is produced by Cyberwrite's Monetary Impact Analysis model on the inputs described in the notes on the cases, and is shown alongside, not used in, the multiples.
Sources: 2026 Breach Impact Study: Verizon DBIR team (Hylender, Langlois, Pinto and Widup) with CyberAcuView as data partner; 69,683 claims from participating member insurers, incidents 2019 to 2025. Change Healthcare: UnitedHealth Group full-year 2024 results; Forbes; The Record. Merck: Superior Court of New Jersey filings; Cybersecurity Dive; Risk & Insurance. Equifax: FTC and CFPB settlement notices; CSO Online. Maersk: A.P. Moller-Maersk Q2 2017 report; Reuters/Forbes; Computer Weekly. Clorox: Clorox v. Cognizant complaint (Alameda County Superior Court, 2025); SecurityWeek; Cybersecurity Dive. KNP Logistics: BBC; Bloomberg/Insurance Journal; The Times. Xoom: Xoom SEC Form 8-K (2015); Reuters; CFO.com. St. Margaret's Health: NBC News; SecurityWeek; The Hill. Vastaamo: TechTarget; Finnish Data Protection Ombudsman; Computer Weekly. Stoli Group USA: US Bankruptcy Court, Northern District of Texas (Case No. 24-80146); Reuters; The Record. Efficient Services Escrow: KrebsOnSecurity; SC Media; BankInfoSecurity. The Heritage Company: KATV; Infosecurity Magazine. Lincoln College: NBC News; BleepingComputer; New York Times. Wood Ranch Medical and Brookside ENT: SecurityWeek; HIPAA Journal; Becker's Hospital Review. Jaguar Land Rover: Cyber Monitoring Centre statement (2025); Reuters; Cybersecurity Dive. Marks & Spencer: company FY2024/25 results statement; Reuters; CNBC. FedEx/TNT: FedEx SEC filings; The Security Ledger. Mondelez: Federal Reserve Bank of New York Staff Report No. 937; The Register. MGM Resorts: MGM Resorts Form 8-K (2023); Security Magazine. CDK Global: Anderson Economic Group; Automotive News. National Bank of Blacksburg: NBB v. Everest National Insurance (W.D. Va., 2018); Business Insurance; Threatpost. AMCA: Retrieval-Masters Chapter 11 filing (Bankr. S.D.N.Y., 2019); SecurityWeek; HIPAA Journal; multistate attorneys general settlement (2021). Code Spaces: Threatpost; eSecurity Planet. CloudNordic: company incident notice; SecurityWeek; TechTarget. Kaseya: Kaseya statements; BankInfoSecurity; NPR. PerCSoft/DDS Safe: KrebsOnSecurity; MSSP Alert. Synnovis: Companies House accounts filing (2025); Digital Health; UK parliamentary written statement (2025). Saint Ambrose: parish letter to congregation; FBI Cleveland; SC Media; Cleveland 19 News. Colorado Timberline: company closure statement; BusinessDen; SC Media. Model revenue inputs: company annual reports and SEC filings; IRS Form 990 (ProPublica Nonprofit Explorer); Companies House; exchange rates from the Federal Reserve (FRED series AEXUSUK and AEXUSEU). Revenue estimates: US Census Bureau, 2007 Economic Census, NAICS 56142 (telephone call centers), $40,421 receipts per employee; AAO-HNS 2017 Socioeconomic Survey, $1,100,580 mean collections per FTE physician in practices of 1 to 3 physicians.
Disclaimer: This research note is provided for informational purposes for cyber insurance market participants and does not constitute legal, actuarial or investment advice.
See the full loss distribution for any company
Cyberwrite profiles any of 320M+ companies worldwide on demand, in real time, and returns the modeled economic loss distribution alongside the technical risk findings. Request a demo to see how ground-up loss estimates support limit setting, pricing and portfolio accumulation.