Key Takeaways
- Cyber policies can cover incident response, forensics, data restoration, extortion payments, business interruption, and liability after a ransomware attack.
- Common gaps include system upgrades, prior known incidents, war or state-actor exclusions, and ransomware sublimits or coinsurance.
- Paying a ransom can create sanctions exposure, and OFAC considers cooperation with law enforcement and cybersecurity practices as mitigating factors.
- Controls such as multifactor authentication, endpoint detection, and offline backups affect both eligibility and how well you recover.
Cyber insurance often covers much of the cost of a ransomware attack, including incident response, forensic investigation, data restoration, extortion payments, lost income, and liability claims. It usually does not cover system upgrades, losses from known prior incidents, or anything excluded by sublimits or war wording, notes Bozzuto Group, a San Diego–based specialty commercial insurance brokerage.
Ransomware is malicious software that encrypts or steals your data and demands payment for its release. Many attacks now combine encryption with data theft, threatening to publish files if you refuse to pay. That dual threat touches several parts of a cyber policy at once.
What does cyber insurance cover after a ransomware attack?
A cyber liability policy is built from first-party coverages, which pay your own costs, and third-party coverages, which respond to claims against you. Terms vary, but a ransomware event commonly involves the following.
First-party coverages
- Incident response. Access to a breach coach (usually an attorney), IT forensics, and crisis communications, often through a carrier-approved vendor panel.
- Cyber extortion. Negotiation services and, where lawful and approved by the carrier, the ransom payment itself.
- Data restoration. Costs to restore, recreate, or recollect data and software from backups or other sources.
- Business interruption. Lost net income and extra expenses while your systems are down, after a waiting period measured in hours.
- Notification and monitoring. Costs to notify affected individuals and provide credit monitoring if personal information was accessed.
Third-party coverages
- Privacy and network security liability for lawsuits from customers, patients, or partners whose data was exposed.
- Regulatory defense and penalties where insurable by law.
- Payment card liabilities for assessments under merchant agreements, if the policy includes them.
What does cyber insurance usually not cover?
Even a strong policy has limits. Watch for these common gaps:
- Betterment. Upgrading systems beyond their pre-attack condition, such as replacing outdated servers with new ones, is generally excluded.
- Prior known incidents. Intrusions you knew about, or should have known about, before the policy began.
- War and state-backed attacks. Many policies include war or infrastructure exclusions, and wording varies widely between carriers.
- Ransomware sublimits and coinsurance. Some carriers cap ransomware losses below the full policy limit or require you to share a percentage of the loss.
- Bodily injury and property damage. Physical damage caused by a cyber event is often excluded or limited.
- Unapproved vendors and payments. Hiring your own forensic firm or paying a ransom without carrier consent may reduce or eliminate reimbursement.
Misstatements on your application also matter. If you said multifactor authentication was in place and it was not, the carrier may contest coverage. Coverage depends on the carrier and policy wording.
Is paying a ransom legal?
Paying a ransom is not automatically illegal in the United States, but it can create sanctions risk. In its updated advisory issued September 21, 2021, the Treasury Department's Office of Foreign Assets Control (OFAC) warned that facilitating payments to sanctioned individuals or groups can violate U.S. sanctions, and that liability can apply even if you did not know the recipient was sanctioned.
OFAC said it would consider mitigating factors, including prompt reporting to law enforcement, full cooperation during and after the attack, and whether the victim had adopted recommended cybersecurity practices such as offline backups, incident response plans, and employee training. Carriers and their vendors typically screen threat actors before any payment. Consult your attorney before making any decision to pay.
How do policy features affect a ransomware claim?
| Policy feature | Why it matters in a ransomware event |
|---|---|
| Business interruption waiting period | Losses during the first hours of downtime are retained by you |
| Dependent business interruption | Covers income lost when a vendor or cloud provider is attacked, if included |
| Ransomware sublimit | May cap extortion, restoration, and interruption below your full limit |
| Vendor panel requirement | Using non-panel firms without consent can reduce reimbursement |
| Retention (deductible) | Your share of each loss before coverage applies |
Which security controls do underwriters expect?
Carriers use security questionnaires to decide eligibility and pricing. Controls they commonly ask about include multifactor authentication on email, remote access, and administrator accounts; endpoint detection and response software; offline or immutable backups that are tested regularly; timely patching; and employee phishing training. A written incident response plan with your carrier's hotline number helps you act fast when minutes count.
For example, imagine a small manufacturer whose production schedules live on a single server. If backups are stored on the same network, ransomware may encrypt them too, extending downtime and increasing the business interruption loss. Offline backups change that outcome.
What should you do in the first hours of an attack?
- Call your carrier's cyber hotline before calling outside vendors, so panel and consent requirements are met.
- Isolate affected devices from the network, but do not wipe or power down systems until forensics advises.
- Do not contact the attackers or agree to any payment on your own.
- Preserve logs, ransom notes, and emails, and start a timeline of what happened and when.
How Bozzuto Group Helps
We compare cyber policies line by line on the terms that drive ransomware outcomes: extortion and restoration limits, sublimits or coinsurance, waiting periods, dependent business interruption, war wording, and panel requirements. We also help you complete security applications accurately, so answers reflect the controls you actually have.
For businesses that handle regulated data, such as cannabis operators with customer records or nutraceutical brands running e-commerce, we coordinate cyber coverage with crime and technology errors and omissions so gaps between policies are addressed. Our loss control resources can help you strengthen the controls underwriters review.
Want to know how your policy would respond to ransomware? Call Bozzuto Group at 858-805-1865 or request a quote for a cyber coverage review.
Frequently Asked Questions
Does cyber insurance pay the ransom?
Many cyber policies include cyber extortion coverage that can reimburse a ransom payment, but usually only with the carrier's prior consent and where the payment is lawful. Carriers and their vendors typically screen the threat actor for sanctions concerns first. Some policies cap ransomware losses with a sublimit or coinsurance, so check your extortion limit and conditions.
How long does business interruption coverage take to start after a ransomware attack?
Cyber business interruption coverage usually begins after a waiting period stated in the policy, commonly measured in hours. Income lost during that window is retained by you. Policies also limit the period of restoration. Review both the waiting period and whether dependent business interruption covers outages caused by attacks on your vendors or cloud providers.
Can a cyber insurance claim be denied for lack of multifactor authentication?
It can be contested if your application stated that multifactor authentication or other controls were in place and they were not. Insurers rely on application answers when issuing coverage, and material misstatements can affect a claim. Answer security questionnaires accurately, and tell your broker promptly if your controls change during the policy term.
Is it illegal to pay a ransomware demand?
Paying a ransom is not automatically illegal in the U.S., but OFAC has warned that payments to sanctioned parties can violate sanctions law, even if you did not know the recipient was sanctioned. OFAC considers prompt law enforcement reporting, cooperation, and strong cybersecurity practices as mitigating factors. Consult your attorney and insurer before any payment.
What is not covered by cyber insurance after ransomware?
Common exclusions or limits include upgrading systems beyond their prior condition, incidents known before the policy began, war or state-backed attacks under certain wording, bodily injury and property damage, and costs incurred with unapproved vendors. Some policies also apply ransomware-specific sublimits or coinsurance. Coverage depends on the carrier and policy wording.