What happens when you file a cyber claim

A cyber claim starts with a phone call to the incident hotline in your policy, not with a form. The insurer assigns a claims professional, usually brings in a privacy attorney called a breach coach and a forensic firm, and pays the vendors above your retention. The income-loss and third-party parts of the claim come later and take longer, because they depend on proof: what the attack cost you, and what the people who sued or complained are owed.

The sequence, from first call to final payment

The timing is a pattern, not a promise. A one-laptop phishing incident can close in days, and a ransomware event with stolen data can run for more than a year when regulators or plaintiffs become involved.

Step one is notice, and notice has two parts

Almost every cyber form is claims-made and requires that you give notice of a claim or a suspected incident during the policy period or a short reporting window after it. The hotline gets help moving. The policy's formal notice provision, which usually names an address or email, is what protects your rights. Do both, and put the date, time and person you spoke with in your log. notice of claim and late notice: why timing matters explains why timing disputes arise and how they differ by state.

Many forms also let you report a circumstance that has not yet become a claim, such as a suspicious login or a ransom email with no proof of access. Reporting a circumstance can lock the incident into the current policy year, which matters if the policy is about to renew or change carriers. Coalition says on its claims page that it offers pre-claims triage, so policyholders can seek help before a formal claim begins. Not every carrier does, so check yours, and ask your broker before you decide an incident is too small to mention.

Who is on your response team

• Claims professional. The carrier's employee who owns the file, approves spending and applies the policy wording.
• Breach coach. An attorney who directs the response and decides which privacy laws and contracts are triggered. See data breach notification laws and what they cost.
• Forensic firm. Determines how the attacker got in, what was touched, and when it is safe to restore.
• Negotiator and payment specialists. Brought in for cyber extortion demands; they check sanctions exposure before any payment (paying a ransom: sanctions risk and reporting rules).
• Notification, call center and credit-monitoring vendors. Hired by counsel when personal information was exposed.
• Forensic accountant. Measures the lost income and extra expense in the business interruption claim.

Policies usually require you to use panel vendors or get consent for your own. Coalition's claims page says that choosing its incident response affiliate from its panel carries a $0 retention. That is one carrier's design, and others may charge the retention regardless of which vendor you use or pay panel-rate reimbursement only. If you want your existing IT or legal firm involved, get approval in writing before the engagement, and see whether the carrier will accept them at their normal rates.

How the money moves

The retention is the first slice of covered loss that you pay. Invoices for covered response work usually go to the carrier, which pays the vendor directly and bills you the retention, or you pay and are reimbursed. Business interruption typically has a time retention (a waiting period measured in hours) on top of any dollar retention. The money you will not recover includes costs that exceed a sublimit, work done before notice or without consent, upgrades that make systems better than they were before the attack, and anything the policy excludes. common cyber insurance exclusions covers the most common exclusions, and ransomware sublimits and coinsurance in cyber policies covers the cost sharing that can apply to extortion events.

The business interruption claim

This is the part owners underestimate. The carrier will not pay on an estimate. It will ask for payroll, sales history, margins, a description of what systems were down, and when each came back, and it may appoint a forensic accountant. Start collecting from day one: a time log of outages, records of manual workarounds and the extra expense of running them, and the dates systems were restored. The mechanics parallel property claims, and documenting a business interruption claim, from day one to final payment and the sworn proof of loss: what it is, when it's due and how to prepare it show the documentation habits that carry over. cyber business interruption and dependent system failure explains the policy trigger, waiting period and dependent business interruption in detail.

Why many reported claims close without payment

The NAIC's 2025 Report on the Cybersecurity Insurance Market, which uses 2024 data from U.S.-domiciled insurers, counted 9,941 claims closed with payment and 28,555 closed without. By our arithmetic from those two NAIC figures, about 26% of closed claims ended with a payment. The gap was widest on excess policies, where unpaid claims outnumbered paid ones by more than 20 to 1. The NAIC report does not say why claims closed unpaid. Plausible reasons include losses below the retention, incidents that forensics found to be benign, and claims that were not covered. Coalition argues in a blog dated August 31, 2026 that many of its own closures involve early threats stopped before damage exceeded the retention. As an insurer it has a stake in how the number is read, so treat it as one view and do not take the percentage as a denial rate.

For context, NetDiligence's 2025 Cyber Claims Study, presented to the NAIC's Cybersecurity Working Group on June 10, 2026, analyzed 10,402 claims from 2020 to 2024. Ransomware was the cause of loss in 26% and business email compromise in 19%. The study's Ransomware Advisory Board warned that delayed escalation to professional responders gives attackers more time to expand access. That is the practical argument for calling the hotline early.

Where claims go wrong

1. Late or misdirected notice. Calling your IT contractor and the broker, but not the carrier.
2. Spending without consent. Hiring a forensic firm at premium rates or paying a ransom before approval.
3. Destroyed evidence. Wiping servers before forensics images them, which can make the cause of loss impossible to prove.
4. Application problems. If the security answers on the application were wrong, expect a coverage review or a rescission argument. See insurance applications: why accuracy matters and what misrepresentation costs and the cyber insurance application: what underwriters ask and how to answer.
5. Thin records. A business interruption claim built from memory rather than payroll and sales data.
6. Not tendering lawsuits. A customer demand letter or regulator inquiry is a claim even if no suit is filed. Send it to the carrier at once.

For third-party claims, the policy often gives the insurer the right to pick defense counsel and consent before settlement. Many forms contain a hammer clause, covered in the hammer clause: what happens if you refuse a settlement, that limits what the insurer pays if you reject a settlement it recommends.

If the carrier reserves rights or denies

A reservation of rights letter means the carrier is handling the claim while keeping the right to deny part of it, often based on an exclusion or an application question. Read it carefully and respond in writing with your broker and an attorney who handles coverage disputes. For a denial, what to do when your business insurance claim is denied lays out the appeal steps, and your state insurance department takes complaints. Most cyber premium is written on surplus lines paper (the NAIC put domestic surplus lines at 57% of 2024 direct written premium), and those policies can be governed by different state claims rules than admitted ones, so your state's specifics matter.

A hypothetical: a dental office

Say a dental practice in Texas finds patient files encrypted on a Friday afternoon. This is an illustration, not a typical claim. The office manager calls the hotline, and by Saturday a coach has retained forensics. The practice learns that attackers copied patient records, so counsel starts a HIPAA analysis. The practice restores from backups by Wednesday, and five days of reduced appointments become the business interruption claim, measured against the prior year's same weeks. The carrier pays response costs above the retention and the income loss after the waiting period. A patient group later sends a demand letter, which the office forwards the same day. The records it kept from day one shortened every step.

Key takeaways

• Call the policy hotline first, then send the formal written notice the policy requires, and keep a log of both.
• Do not hire vendors, rebuild systems or pay an extortionist before the carrier consents; unapproved spending is the most common reimbursement fight.
• Business interruption is paid on proof, so start recording downtime, workarounds and extra expense immediately.
• The NAIC data show roughly one in four closed claims paid in 2024, but the report does not explain why the rest closed unpaid, and many may have fallen below the retention.
• Forward every demand letter, regulator inquiry and lawsuit to the carrier right away.