Privacy breaches, extortion, prolonged business interruption and litigation are increasingly figuring in cyber incidents, driving lengthier and more complex losses, Marsh says.

The broker’s Global Cyber Claims Report for last year flags “more of the same, amplified” this year, warning interdependent supply chains and third-party services spread impacts across sectors and geographies.

Privacy litigation and regulatory scrutiny are likely to increase, it says. AI will raise risk by reducing attackers’ entry costs and introducing new error modes in deployments and vendor services, and by enabling criminals to increase the scale and plausibility of attacks.

While the volume of attacks last year was comparable to 2024, Marsh says incidents now combine multiple loss drivers within a single event.

This is creating larger and more legally complex claims.

“Losses increasingly reflect operational disruption, data misuse, regulatory scrutiny, extortion dynamics and dependencies on external vendors.”

There was a rise in claims related to non-breach privacy statutes and litigation last year, prompting Marsh to warn organisations to review how they use website tracking and analytics tools, and ensure disclosures, consent practices and vendor arrangements keep pace with privacy risk.

Communications, media and technology industries produced the most claims, followed closely by healthcare and financial institutions.