Business email compromise, phishing and payment fraud account for 44% of the cyber insurance claims Gallagher is handling for New Zealand clients, according to the broker. The figures arrive as a critical flaw in widely used web software adds to the pressure on businesses’ defences.
Gallagher said business email compromise and phishing make up 23% of attack types in its clients’ claims. Payment and funds transfer fraud follow at 21%. The broker did not say what period the figures cover or how many claims they are drawn from.
Mark Jones, chief broking officer at Gallagher, said the claims showed how varied cyber risk had become.
“Cyber incidents don’t always start with a major system attack. Our clients are being affected by payment fraud, phishing attacks and compromised accounts, often through everyday interactions and processes,” said Jones.
He said businesses had little control over geopolitical and economic uncertainty, inflation or energy costs. Cyber was different, he said, because firms could work out where they were exposed, strengthen their resilience and check whether their cover was adequate.
The broker’s figures line up with government reporting. The National Cyber Security Centre recorded 1,129 incidents in the second quarter of 2026, with scams and fraud the most common category at 348 reports. Reported direct financial losses fell to $2.7 million, down 52% from the $5.6 million recorded in a first quarter that also saw the return of highly significant incidents.
The pattern is not limited to New Zealand. The World Economic Forum’s Global Cybersecurity Outlook 2026 found that chief executives’ top cyber concern had shifted from ransomware to cyber-enabled fraud and phishing.
The claims split matters for brokers because fraud losses are where cyber policies diverge most. Social engineering cover is not treated the same way across New Zealand cyber wordings. Some wordings offer it only as an optional extension, with its own sublimit and required internal controls.
Consider a client whose likeliest loss is a fraudulent change to a supplier’s bank details. That client may have far less protection for that loss than the policy’s headline limit suggests. Insurers are also likely to examine verification steps closely when a social engineering claim lands, such as callbacks to known numbers or dual sign-off on payments.
Market conditions favour fixing the gap now. New Zealand’s cyber market was classed as soft in the first quarter, with plenty of capacity and broader cover on offer.
Gallagher also told clients to check their exposure to two critical vulnerabilities in PHP, the programming language behind a large share of websites and web applications. The NCSC urged organisations to patch immediately on October 22. It warned that the flaws, CVE-2026-109618 and CVE-2026-109619, could allow an attacker to take full control of a website, web server or web service.
Gallagher advised businesses that were unsure whether they were affected to ask their IT provider or web host. It also suggested checking with third-party technology suppliers. The broker said artificial intelligence was making phishing and other social engineering attacks more convincing and easier to scale.
Insurers have continued to expect strong security controls from insureds even as cyber premiums have stabilised. A client that leaves a known critical vulnerability unpatched may face harder questions at renewal, and potentially at claim time, depending on its wording.
Gallagher’s figures suggest the cyber losses New Zealand businesses are most likely to suffer are also the least dramatic. Those losses usually come through an inbox or a payment request rather than a system breach. With capacity plentiful, brokers have room to push for social engineering limits that match that exposure before a client finds the sublimit in the middle of a claim.
