Ransomware and cyber insurance: how claims work

A ransomware claim under a cyber policy starts with a call to the insurer's incident hotline, not with the ransom. The insurer assigns a privacy attorney and a forensic firm, the team contains the attack and decides whether data was stolen, and the policy then pays response costs, data restoration and lost income, and, only if the law and the policy allow it, an extortion payment. The money you collect depends less on the attack than on three things: how fast you reported, whether you used approved vendors, and how your answers on the application compare with what the investigators find.

How common this is, and how it has changed

ransomware is no longer just locked files. Coveware, an incident response firm, reported in its Q2 2026 analysis that data theft appeared in 76% of the cases it handled, and that the payment rate in data-theft-only cases was 15%, which it called historically low. The same report put the median payment at $150,000 and the average at $1,880,612, with a few large payments in data-theft cases pulling the average up. Verizon's 2026 Data Breach Investigations Report, as summarized by Help Net Security, found ransomware in 48% of breaches and that 69% of ransomware victims did not pay.

The FBI's 2025 Internet Crime Report received more than 3,600 ransomware complaints, and notes that the dollar losses reported to it exclude lost business, wages, equipment and remediation services. In other words, the visible loss is the smallest part. The IOA 2026 midyear cyber outlook says NetDiligence data shows small and mid-size companies' average incident cost was 650% greater when business interruption occurred. Downtime is the expensive part, and that is what a policy is built to cover.

The claim, step by step

1. Call the hotline before anything else. Your policy lists a 24-hour number and requires prompt notice. Most forms also require the insurer's consent before you hire vendors, negotiate or pay. Calling your usual IT contractor first, or wiping machines to get back online, can destroy evidence and create a dispute over who pays.
2. The insurer appoints a response team. Typically a breach coach (a privacy attorney), a forensic firm hired through counsel so that findings may be privileged, and, if there is a demand, a negotiation specialist. Counsel directs the work. Expect the coach to also bring in notification, call center and public relations vendors if data was taken.
3. Contain and investigate. Forensics determines how the attackers got in, whether they are still inside, which systems are encrypted and what was copied. This answer drives everything that follows, including whether you have a notification duty (data breach notification laws and what they cost).
4. Decide about restoration and payment. If clean, tested backups exist, many victims rebuild without paying. If not, counsel, the negotiator and the insurer weigh options. Before any payment, the team must check the attacker against sanctions lists, which is covered in paying a ransom: sanctions risk and reporting rules.
5. Report to authorities. The U.S. government asks victims to report to CISA, the FBI (including IC3) or the Secret Service, and OFAC treats prompt reporting as a mitigating factor. Many policies also expect it.
6. Restore and document losses. Data restoration, system rebuilds and extra expense are submitted with invoices. Lost income is proved with financial records, usually with a forensic accountant, after the waiting period.
7. Third parties arrive later. Customers, employees or regulators may make claims months afterward, which fall under the third-party half of the policy (first-party vs third-party cyber coverage).

what happens when you file a cyber claim covers the general mechanics of any cyber claim; this guide concentrates on what is specific to ransomware.

What the policy may pay for

ransomware sublimits and coinsurance in cyber policies explains why the headline limit often shrinks for this event.

Where ransomware claims get disputed

• Application mismatches. If the investigation shows that MFA, backups or EDR were not what the application said, the insurer may reserve its rights or move to rescind. See the cyber insurance application: what underwriters ask and how to answer.
• Sublimit and coinsurance. A $3 million policy with a $1 million ransomware sublimit and coinsurance pays far less than $3 million.
• Consent. Payments, settlements and vendors chosen without the insurer's consent may not be reimbursed.
• War or state-backed exclusions. If attribution points to a nation-state, the insurer may invoke them (war and state-backed attack exclusions in cyber policies).
• Betterment and upgrades. The policy pays to restore to the prior state. Replacing old gear with better gear is often your cost.
• Late notice. Most forms are claims-made and require notice of the incident, or of a circumstance, within the policy period. See notice of claim.
• Income proof. Business interruption is paid on documented loss, not estimates. Keep clean books and a plan for how you will show lost sales.

A hypothetical: data theft with no encryption

Say a 20-attorney law firm finds an email from criminals saying they copied client files and will publish them unless it pays. Nothing is encrypted and the backups are fine. This is an illustration, not a typical claim. Many people assume that makes it a small event. It is not.

On day one the firm calls the hotline. The breach coach engages a forensic firm, which confirms access through a remote login without MFA and identifies which folders were copied. Because the files hold client confidences and personal data, counsel analyzes professional duties to clients and state notification laws for the affected individuals. A negotiator contacts the criminals to verify what they hold, and the sanctions check is run on the group and wallet. The firm decides not to pay, and the insurer's role is to fund the investigation, the notices and the monitoring. Weeks later two clients demand compensation, and those claims go to the liability coverage.

Backups did nothing here. What mattered was the extortion definition (does a threat to publish data count, with or without encryption?), the limit for breach response, and the third-party coverage. Ask your broker about each. Law firm insurance and other professional practices hold exactly this sort of data.

The first 24 hours

1. Isolate affected machines from the network, but do not power them off or wipe them, since forensic evidence may sit in memory.
2. Call the insurer's hotline and your broker. Write down the time of discovery and of notice.
3. Do not contact the criminals or pay anything, and do not hire vendors until the insurer approves.
4. Gather the policy, a network diagram, a list of critical systems and the contact list from your response plan (building an incident response plan your insurer will like).
5. Preserve logs, ransom notes and emails. Photograph screens with a phone if you can no longer log in.
6. Let counsel coordinate communications to staff, clients and law enforcement.

Key takeaways

• Call the policy hotline first, use the approved team, and get the insurer's written consent before any payment or vendor engagement.
• Ransomware now often involves stolen data, so check whether your extortion and breach response coverage applies without encryption.
• Downtime usually costs more than the ransom, so business interruption terms and tested backups matter most.
• The usual disputes are application accuracy, sublimits and coinsurance, consent, exclusions and proof of income loss.
• Report to law enforcement quickly. It helps recovery efforts and is treated as a mitigating factor by OFAC.