Glossary

Cyber extortion

A demand for payment backed by a threat to encrypt, destroy or publish your data or disrupt your systems, and the cyber policy coverage that responds to it.

Also called: cyber extortion coverage, extortion threat coverage, cyber ransom, ransomware extortion

Cyber extortion is a demand for money, usually in cryptocurrency, backed by a threat: to leave your files encrypted, to publish stolen data, to launch a denial-of-service attack or to keep an intruder in your network. Ransomware is the best-known form, and many attacks now combine encryption with a threat to leak the data.

In a cyber policy, extortion coverage is a first-party insuring agreement. It typically pays the extortion demand itself, plus negotiators, forensic investigators and the cost of acquiring cryptocurrency, and it usually requires the insurer's prior consent before any payment. Many policies limit it with a sublimit or a coinsurance share, especially for ransomware.

Paying carries legal risk. The Treasury Department's OFAC advised in September 2021 that payments to sanctioned persons or places can violate sanctions law, and that liability is strict, meaning intent is not required. A prompt report to law enforcement counts as a mitigating factor. Insurers and breach counsel therefore screen the attacker before funds move, and coverage does not make an illegal payment legal.

A breach coach usually runs that process. ransomware and cyber insurance: how claims work explains how claims unfold, and paying a ransom: sanctions risk and reporting rules covers the sanctions rules in depth.

Last reviewed October 10, 2026

In the index now

Related terms

Ransomware Malicious software that locks or encrypts a victim's data or systems and demands payment for the key, often with a threat to publish stolen files. Business email compromise (BEC) Fraud in which a criminal impersonates an executive, vendor or client by email to trick an employee into sending money or changing payment details. Breach coach A privacy attorney, usually from the cyber insurer's panel, who directs the first days of a data breach or ransomware response. Social engineering fraud Fraud that tricks an employee into voluntarily sending money or data by impersonating a vendor, executive or client, rather than breaking into systems. First-party coverage Insurance that pays the policyholder directly for its own losses, such as damaged property or breach response costs, rather than defending claims by others.

Related guides

A ransomware claim, step by step, from the first alert to the last settlement A hypothetical composite walkthrough of a cyber claim: breach coach, forensics, OFAC check, business interruption, state notification and third-party suits. Building an incident response plan your insurer will like What a cyber incident response plan needs for your policy to work: the hotline call, consent rules, evidence, legal deadlines and a tested first 24 hours. Cyber insurance: what it covers for a business What a cyber policy pays for after a breach, ransomware attack or email fraud, how limits and retentions work, and what the policy leaves out. Kidnap, ransom and extortion insurance What K&R insurance covers beyond the ransom itself, who buys it, why the policy is confidential, and the sanctions and legal limits on paying. Paying a ransom: sanctions risk and reporting rules No federal law bans a business from paying a ransom, but OFAC sanctions liability is strict. What the rules say, how payments are screened and who must be told. Ransomware and cyber insurance: how claims work How a ransomware claim unfolds under a cyber policy, from the hotline call and panel vendors to payment decisions, lost income and the usual coverage disputes.

Related insurers

Coalition San Francisco cyber MGA and carrier that pairs cyber, tech E&O and executive risks policies with security scanning and incident response, sold through brokers.

Related industries

E-commerce business insurance Product liability, marketplace insurance requirements, stock at fulfillment centers, cyber and shipping losses for online sellers.