Μake us preferred on Google Cyberattacks are no longer a threat reserved for large corporations. From online shopping fraud and data theft to malicious software disrupting business operations and even damaging equipment, the risks now extend to companies of every size and private individuals.
“There’s no business that isn’t a target,” Kostas Voulgaris, head of the Cyber Insurance working group at the Hellenic Association of Insurance Companies (HAIC), told the Athens-Macedonian News Agency (AMNA), pointing to the growing dependence on digital systems as a factor increasing exposure to cyber risks.
The potential consequences can extend well beyond stolen information or financial fraud. Attacks can interrupt business operations, damage equipment and create risks to health and safety. Incidents involving even the digital systems of commercial refrigerators illustrate how broadly cyber threats can affect everyday business activity.
Against this backdrop, cyber insurance is becoming an increasingly important tool for managing the financial consequences of an attack.
In Greece, the number of cyber insurance policies reached 397,990 in 2025, up from 208,747 in 2024, a 90.7% increase, according to HAIC’s survey covering 2022–2025. In 2022, the total stood at just 32,370.
Individuals drive growth in cyber insurance
Of the 397,990 policies recorded last year, 395,232 covered individuals under personal cyber insurance, while 2,758 covered businesses under commercial cyber insurance.
Policies for individuals increased by 91.2% year over year, while business coverage grew by 35.7%.
The total coverage limits rose to €3.95 billion in 2025, from €2.86 billion the previous year, an increase of 38%.
Voulgaris said demand from individuals became more noticeable during the COVID-19 pandemic, as remote work expanded and people became more aware of their exposure to digital threats.
Interest is now rising sharply, particularly among individuals, he said, while businesses are moving more slowly. Companies must first invest in the technology and organizational measures needed to protect their systems before they can obtain insurance coverage. The cost, therefore, extends beyond the insurance premium itself.
The motivation behind cyberattacks can also be difficult to establish. Unlike conventional theft or property damage, an attack may involve hackers, state actors or other parties pursuing different objectives, Voulgaris said.
Insurance claims rise, but do not capture all attacks
Insurers recorded 653 cyber-related claims in 2025, up 25.8% from 519 in 2024. Of these, 621 involved personal policies and 32 involved business policies.
However, these figures do not represent the total number of cyberattacks in Greece. They cover only insured systems and incidents for which an insurance claim was filed, meaning attacks affecting uninsured individuals and businesses are not reflected.
The average claims frequency in 2025 stood at 0.16% across all cyber policies. The rate was also 0.16% for personal policies, compared with 1.16% for commercial coverage.
The average claim amounted to €1,112 overall. The figure was €472 for individuals and €13,531 for businesses.
HAIC cautioned that these indicators are based on the information currently available and may change because the final cost of all claims has not yet been established.
Online shopping fraud dominates personal claims
An analysis of claims from 2022 to 2025 for which detailed information was available revealed different patterns among individuals and businesses.
Of the 75 personal claims examined, 61 — or 81.3% — involved online shopping. Three were linked to spoofing and phishing, two to malicious software and nine to other causes.
Among the eight business claims analyzed, five involved malicious software and three involved spoofing and phishing.
The distribution of insurance payouts for these cases was different: 89.1% went toward claims involving spoofing and phishing, while 10.9% covered incidents involving malicious software.
What does cyber insurance cover?
Depending on the terms of each policy, cyber insurance can cover a range of costs associated with an attack, according to HAIC’s guidance.
These may include recovering lost or compromised data, restoring information systems and software, hiring specialized technical and legal advisers, managing data breaches, notifying customers and repairing damage to a company’s reputation.
Coverage for business interruption is also important. If an attack temporarily prevents a company from operating, a policy may compensate it for lost operating profits, fixed expenses that continue during the disruption and additional costs incurred to restore operations more quickly.
HAIC illustrates this with the example of a commercial company whose data center is largely encrypted in a cyberattack. Its electronic systems go offline, leaving it unable to serve customers through either its online store or its physical locations.
Under such a scenario, the insurer could provide specialist support to manage the incident, recover files and systems, and help the business resume operations.
The risks traditional insurance may not cover
HAIC also highlights the issue of so-called “silent cyber” risk: the possibility that a cyberattack causes damage that is neither explicitly covered nor expressly excluded under a traditional property or liability insurance policy.
One example involves malicious software affecting the data of a programmable industrial machine and triggering a fire at a manufacturing facility. The question is whether the resulting damage would be covered by the company’s property insurance, given that the underlying cause was a cyberattack.
HAIC’s guidance also notes that bodily injury and physical property damage may be excluded from cyber insurance policies and instead fall under other types of coverage. The actual protection available therefore depends on the specific terms and exclusions of each contract.
Insurers prepare for a growing threat
Voulgaris said the insurance industry has been preparing for the rise in cyber risks for years, with companies calculating the capital they need, incorporating potential losses into actuarial assessments and making policy coverage and exclusions more explicit.
He also pointed to the European Union’s efforts to strengthen the regulatory framework for cybersecurity.
Greek businesses, however, remain at a lower level of technological development than major European corporations, Voulgaris said. As a result, the cyberattacks they have faced so far have generally not reached the scale of incidents affecting large companies abroad.
But the market is changing rapidly, he added, making protection against cyber risks increasingly necessary.
Cyber insurance payouts fall in 2025
Despite the rise in claims, insurers’ paid cyber insurance compensation fell by 32.9% in 2025, to €263,723 from €392,976 in 2024.
Meanwhile, reserves for outstanding claims increased by 21.7%, reaching €462,667, compared with €380,244 a year earlier.
HAIC said the figures cover eight insurance companies that participated in the survey and reflect the information available when it was compiled. Claims and compensation amounts remain estimates, as the final cost can take time to emerge while insurance claims are being processed.
