We use data on cyber losses and model the potential market equilibrium for cyber insurance to document a market failure when portfolios of cyber risk are constructed. This can be explained by the distinct properties of cyber risk, namely heavy tails, strong (tail) dependencies, high costs due to asymmetric information, and modelling risk. Our results help to explain why many insurance companies are reluctant to offer cyber insurance on a broad scale. We also discuss ways to overcome the market failure. Our analyses expand results from catastrophic insurance and have implications for corporate risk management and public policy.