Cyber incidents often start out disguised as routine. A supplier the accounts team has paid for years sends an email about an outstanding invoice, mentions that its bank details have changed and asks for the next payment to go to the new account. The tone is right, the spelling is clean and the timing makes sense. The money is paid. By the time anyone realises the supplier was hacked, and the hackers altered the bank details on the invoice, the money has gone.
The same pattern, in its many variations, now accounts for more than half of the cyber claims reported to Emergence this year. The specialist cyber insurance provider's Cyber Claims Data Report 2026, drawn from claims under its Cyber Event Protection policy for small and medium-sized enterprises (SMEs) in Australia and New Zealand, shows business email compromise (BEC) made up 55% of claims reported in 2026 to date, up from an average of 44% between 2023 and 2025.
Threat actors, according to the report, are increasingly working through people, business processes and trusted relationships to steal money and sensitive information. For brokers, that changes which risks clients most need to hear about.
The report highlights that the top three most common cyber incidents are BEC, cyber extortion and socially engineered theft.
A BEC remains the largest claim type according to the report. A BEC occurs when an attacker gains access to an employee's email account and uses it to manipulate staff into transferring money or changing payment details, or to gather information for further attacks.
Cyber Extortion including ransomware, remains the second largest claim type, while socially engineered theft (SET), which is where an employee is deceived into authorising a fraudulent payment or disclosing information has run close to ransomware as the third most common claim type, averaging more than 17% of Emergence's claims from 2023 to 2025.
Individual losses here tend to be smaller than the big ransomware events. The average BEC claim cost $36,250 between 2023 and 2025, and the average SET claim $27,300. The direction is upward, though. The report's outlook section notes a 22% increase in the average cost of a BEC attack in 2026 so far. For a small firm, a five-figure hole in the bank account can be the difference between a hard quarter and a closed door.
Artificial intelligence is part of the picture. Poor grammar and generic phrasing used to give fraudulent emails away. According to the report, AI now lets attackers write in professional language, tailor messages to a specific organisation and match the tone of a supplier, executive or customer. It also speeds up reconnaissance, pulling material from websites, LinkedIn profiles, media releases and procurement notices to map out who holds the purse strings.
"The emails that cost our clients money don't look like scams any more. They look like the supplier you dealt with last week. Verifying any change to payment details with a phone call to a known number is still one of the simplest and most effective controls a business can put in place," said Tim Barratt, chief operating officer at Emergence (pictured above left).
Emergence is experiencing AI being used in cyber attacks and has also seen an increase in notifications of suspected incidents., The report puts down to greater awareness among policyholders, who are calling its incident response team earlier, helped by a $0 excess for eligible insureds.
“Cyber-attacks have not changed fundamentally with the introduction of AI. What has changed, is how quickly AI allows threat actors to personalise attacks, research organisations and easily identify sensitive records with the greatest extortion value,” said Cris White, head of resilience at Emergence (pictured above middle).
Cyber extortion, including ransomware, accounted for an average of just over 20% of Emergence's claims from 2023 to 2025, with 2026 tracking at a similar share. Its cost profile sets it apart. The average ransomware claim exceeded $256,000 over 2023 to 2025, the highest of any claim type. The report puts the average 2026 ransomware claim at more than $140,000, although that number may increase as 2026 claims mature.
The shift brokers may find most useful is where the money goes once an incident is underway. Cyber event response costs, which the report calls the engine room of cyber insurance, made up more than 65% of total incurred costs on average between 2023 and 2025. Within that category, customer notification and legal costs rose from 33% in 2023 to more than 54% in 2025, while IT forensics and data securing held at around 30% on average.
Recovery now stretches well past the point where systems come back online. Privacy laws in both countries can require organisations to assess whether a breach is likely to cause serious harm and, where it is, to notify the regulator and affected individuals. Those notifications increasingly trigger detailed questions, complaints and requests, each needing a legal response. AI is helping individuals understand their rights and draft well-structured complaints.
A privacy law partner at a Sydney law firm, quoted in the report, described the change. "What once took half an hour to respond to now arrives as a five-page letter of demand requiring an equally detailed response, driving up legal costs," the partner said.
Because notification and legal costs tend to land late in a claim, the report expects the 2025 and 2026 figures to rise as open claims mature. Notification and legal work already accounts for more than 40% of 2026 response costs to date.
"Getting a business back online is often the quicker part of the job. The notification process, engagement with regulators and the complaints that follow can run for months, and that is where clients most need experienced support," said Blake Baxter, head of claims and incident response at Emergence (pictured above right).
Healthcare and social assistance represented more than 24% of Emergence's claims in 2026 to date and more than 25% of its claims costs in 2025, a pattern the report says is consistent with data breach publications from the Office of the Australian Information Commissioner. Professional, scientific and technical services, a category that includes lawyers, real estate agents and accountants, ranked second on claims costs in 2025, followed by financial and insurance services.
The healthcare sector combines large volumes of sensitive patient data with heavy pressure to keep services running, broad user access across clinicians, administrators and patients, reliance on third-party platforms and ageing, interconnected technology.
A case study in the report shows how this plays out. A medical organisation learnt from the Australian Signals Directorate that it had been listed on the dark web as potentially exploited. It had seen no ransom note. Forensic investigators engaged by Emergence found attackers had been inside its systems for four months, and the initial intrusion had been mistaken for a planned system outage. The threat actor then demanded US$100,000 to keep a large volume of health and demographic data from being published. The organisation had initially opposed engaging with the attackers, but the potential harm to patients changed the calculation. A ransom negotiator brought the demand down to US$55,000, lawyers notified thousands of affected individuals, and crisis communications specialists managed the reputational fallout over several months.
Third-party incidents made up 14% of claims in Emergence's 2026 data, up from 10% in 2025. The report also records a 47% increase in third-party incidents in the first half of 2026 compared with the second half of 2025.
It cites the Instructure Canvas incident of late April and early May 2026 as an example. According to the report, a threat actor gained access to the learning management platform, affecting more than 9,000 educational institutions worldwide, including major Australian universities that lost access to the system and had to assess notification obligations over potentially exposed student and staff data.
Emergence insureds lodged claims that were covered under its Cyber Event Protection wording, which extends to certain cyber events involving an IT contractor or data processor, subject to policy terms.
For brokers reviewing a client's cover, whether a policy responds to an incident at a supplier is now a practical question. Each layer of a supply chain brings its own communication pressures, and the report stresses that messaging must reach every affected party consistently.
The controls that reduce claims have changed little. The report lists security awareness training, multi-factor authentication, patch management, tested and segregated backups, and incident response planning. It also sets out how the same event can play out differently depending on what is in place. A payment request checked through a callback to a known contact is stopped before the money leaves. A business hit by ransomware that has segregated, tested backups can restore its systems and limit the attacker's leverage.
The report suggests brokers can widen client conversations about cyber insurance to cover how a business is building resilience, including access to incident response, risk management services and specialist expertise alongside financial protection.
Emergence's Cyber Claims Data Report 2026 can be downloaded here.
This article was produced in partnership with Emergence
