Glossary
Ransomware
Malicious software that locks or encrypts a victim's data or systems and demands payment for the key, often with a threat to publish stolen files.
Also called: ransomware attack, double extortion, extortion malware
Ransomware is malware that encrypts a company's files or locks its systems, then demands payment, usually in cryptocurrency, for a decryption key. Many attackers now steal data first and threaten to publish it, known as double extortion, so restoring from backups does not end the problem. Common entry points are phished or stolen credentials, remote access tools without multi-factor authentication, unpatched software and a compromised vendor.
A cyber policy typically responds with several coverages at once: a breach coach and forensic investigators, negotiators, the ransom itself under extortion coverage, data restoration, business interruption for the income lost during the outage, and notification costs if data was taken. Some policies apply sublimits or coinsurance to ransomware events. Before quoting, underwriters ask about multi-factor authentication, endpoint detection and response, offline or immutable backups and patching.
Paying is not simple. The Treasury's OFAC has said in an advisory that sanctions violations are strict liability, so a payment to a sanctioned party can bring penalties even if the payer did not know. Counsel and the insurer will screen the payee, and law enforcement should be told. Whether to pay is a business decision made with advisers, not an automatic insurance step.
The guide on ransomware and cyber insurance: how claims work follows a claim from first call to recovery, and paying a ransom: sanctions risk and reporting rules covers the sanctions rules. See cyber extortion for the coverage grant.
Last reviewed October 10, 2026