You can construct an extended character class inside square brackets but make sure the hyphen is at the beginning or end of the character class or it will be interpreted as denoting a range, e.g [A-Za-z]. An alternative to Eily's non-greedy match is a negated character class, i.e. match anything that isn't a single quote.

use strict;
use warnings;

use feature qw{ say };

my $string = "{'totalResultsCount':71-24,'securityList':[{'cusip':'91%
+279-6.H:Y8','issueDate':'2016-06-02T00:00:00','securityType':'Bill'}"
+;

say $1 if $string =~ m{'cusip':'([\w:%.-]+)'};
say $1 if $string =~ m{'cusip':'([^']+)};
[download]

Produces

91%279-6.H:Y8
91%279-6.H:Y8
[download]

I hope this is helpful.