A ransomware claim, step by step, from the first alert to the last settlement

This is a hypothetical composite. The company, the attackers and every dollar figure are invented to show how a cyber claim runs; this is not a real incident, and the amounts are not typical costs. Cyber policies are not standardized the way ISO property and liability forms are. Limits, waiting periods, vendor panels and exclusions differ from one carrier to the next, so read your own policy against this outline.

A ransomware claim is managed in the first 72 hours by phone calls, not paperwork. The order matters: call the policy's incident hotline, let a lawyer direct the investigation, screen any payment against sanctions before a dollar moves, and work out which states' notification laws apply while the systems are still down.

The business and the policy

Say a 60-employee wholesale distributor in Ohio sells to other businesses and holds employee records plus personal data from a small online reorder portal. Its first-party and third-party cyber policy carries a $2 million aggregate limit, a $25,000 retention, a 12-hour waiting period for business interruption, a panel of approved breach response vendors, and a requirement to get the carrier's consent before incurring response costs. The policy is claims-made, so it must be reported during the policy period or an extended reporting period.

Timeline

Step 1: the first calls

The insurer's hotline is on the policy and in most cases is the first call, not the broker's after-hours line, though calling both costs nothing. Use the incident response plan if you have one (building an incident response plan your insurer will like). The coach's value is privilege: when counsel retains the forensic firm, reports about cause and scope are more likely to be protected from later discovery, though courts have not applied that protection uniformly. Keep ordinary IT chatter and speculation out of email. See what happens when you file a cyber claim.

Stay on the panel. Many policies pay panel vendors at pre-negotiated rates and require consent before you hire someone else. A recovery firm brought in by a well-meaning executive can end up unreimbursed.

Step 2: the OFAC check, before any ransom

Paying a ransom can violate U.S. sanctions law even if the victim does not know who the attacker is. Treasury's Office of Foreign Assets Control issued an advisory in 2020 and updated it on September 21, 2021. Its key points: OFAC strongly discourages payment; sanctions liability is strict, meaning intent is not required; paying a person or entity on the Specially Designated Nationals list, or one located in a comprehensively sanctioned jurisdiction, can result in civil penalties; and a self-initiated, timely and complete report to law enforcement plus full cooperation are significant mitigating factors when OFAC decides on enforcement. License applications for ransomware payments are generally reviewed with a presumption of denial. Penalties under the International Emergency Economic Powers Act are the greater of a fixed per-violation amount, $377,700 per the 2026 inflation adjustment, or twice the transaction value (31 CFR 505.401; Federal Register, September 25, 2026).

In practice the negotiator and coach screen the attacker's identity indicators and wallet addresses before any negotiation reaches payment. A clean screen is not a guarantee; it is evidence of diligence. Insurers will also not reimburse a payment that violates sanctions. The distributor decided not to pay because it could restore, but the screening was done and documented first. See paying a ransom: sanctions risk and reporting rules and cyber extortion.

Step 3: business interruption

Cyber business income coverage is different from the property form. Rather than a fixed 72-hour wait, cyber policies set their own waiting period, commonly measured in hours, and some count from the time systems fail rather than the date of the discovered attack. The covered loss is typically lost net income plus continuing expenses during the restoration period, plus extra expense such as temporary staff, overtime and manual order processing. It generally does not pay to improve security, so multifactor authentication added afterward is the company's own cost unless the policy has a betterment provision. A forensic accountant does the math and the carrier's own accountant tests it. See cyber business interruption and dependent system failure. Some policies also apply a ransomware sublimit or coinsurance, which would reduce every dollar here; check ransomware sublimits and coinsurance in cyber policies before you need it.

Step 4: state notification laws

Every state, D.C., Puerto Rico and the territories have breach notification laws, and the law that applies is determined by where the affected individuals live, not where the company is based. So the Ohio distributor had to follow 14 states' rules at once. They differ on:

• Deadlines. Some require notice "in the most expedient time possible without unreasonable delay"; others set fixed days. Among examples, California and New York require individual notice within 30 days (New York counts from discovery, GBL 899-aa), Florida within 30 days of determining a breach occurred (Fla. Stat. 501.171) and Texas by the 60th day after determining it (Tex. Bus. & Com. Code 521.053).
• Regulator notice. Attorney general or agency notice thresholds vary, often tied to the number of residents affected. Texas, for instance, requires notice to the attorney general within 30 days when a breach involves at least 250 Texas residents (521.053(i)).
• What counts as personal information. Name plus Social Security number is universal. Medical data, biometrics, online credentials and passport numbers are included in some states only.
• Harm tests and encryption safe harbors. Some states excuse notice if the breach is unlikely to cause harm; most exempt properly encrypted data.

Check dates against current statutes with counsel; several states amended their deadlines recently. The coach tracks this. Other duties can overlap, including contractual notice to customers whose data you hold and HIPAA if protected health information is involved (HIPAA breaches and cyber insurance for healthcare providers). See data breach notification laws and what they cost and workers' comp and benefits requirements by state.

Step 5: regulatory and third-party claims

Notification is where the first-party claim hands off to the liability side. The state regulator's inquiry triggered the policy's regulatory coverage for defense and, where insurable under that state's law, fines and penalties. The class action alleged negligent security and invoked the policy's liability coverage; the carrier owed a defense subject to the limit, and the settlement came out of the same $2 million aggregate. Add up the table and the total claim ran roughly $1.0 million before the retention, well inside the limit. A larger incident, or a limit that is spent on first-party costs, leaves less for lawsuits.

What this business did right and wrong

Right: it called the hotline within hours, stayed on the panel, let counsel run the investigation, reported to the FBI and CISA, screened before any payment decision, kept offline backups, and tracked every cost for the claim.

Wrong: the VPN account without multifactor authentication was the whole breach, and the insurance application had said remote access required MFA. A carrier can raise a misrepresentation defense and in some cases rescind or limit coverage; here the application answer was reviewed with counsel and the carrier paid, but that is a risk no business should invite. The company also kept its nightly backups on a domain-joined share, so the attackers encrypted them, and it did not know which states its portal customers lived in until day 10.

Key takeaways

• Call the policy hotline first, use panel vendors, and get consent before hiring others.
• Screen against OFAC sanctions lists before any ransom discussion; liability is strict and a report to law enforcement is a mitigating factor.
• Cyber business interruption has its own waiting period, and betterment is usually excluded.
• Notification obligations follow the residence of affected people, so a small company can owe 14 states' rules at once.
• Regulatory and class action claims come months later, often from the same aggregate limit as the first-party costs.