Ransomware Coverage
Ransomware coverage is protection, usually part of a cyber liability policy, for costs after a ransomware attack, such as incident response, negotiation, extortion payments where legally permitted, data restoration and business interruption, subject to limits and exclusions.
Last updated October 13, 2026
How ransomware coverage works
Ransomware is malware that locks or steals data and demands payment. There is generally no separate stand-alone policy for it. Instead, coverage sits inside a cyber liability policy, often under a cyber extortion insuring agreement together with other first-party coverages. Depending on the policy, it may address:
- Forensic investigation and incident response costs.
- Negotiation services and, where lawful and covered, the extortion payment itself.
- Data restoration and system recovery costs.
- Lost income and extra expense from network downtime, subject to a waiting period.
- Notification, credit monitoring and legal costs if data was stolen, plus liability claims from affected parties.
Most policies require the insured to notify the insurer quickly and to use approved response vendors, and insurers often need to consent before any payment is made.
Sanctions and legal limits
In 2020 the US Treasury (OFAC and FinCEN) warned that paying or facilitating ransoms to sanctioned actors can create legal risk, and OFAC has said penalties can apply even without knowledge. Insurers therefore commonly check payees against sanctions lists, and some policies restrict or exclude payments where payment would be unlawful. Rules vary by jurisdiction.
Example
A payments startup finds its servers encrypted and a demand for cryptocurrency. It calls the incident hotline in its cyber policy. The insurer appoints a forensics firm and breach counsel, and the team restores from backups. The policy reimburses covered response and recovery costs and lost income, subject to the retention and any sublimit for extortion, and no payment is made.
What to watch for
- Sublimits, coinsurance or higher retentions specific to ransomware are common. See sublimit.
- Underwriting often asks about controls such as multi-factor authentication, offline backups, endpoint detection and patching.
- Read the sanctions and war or infrastructure exclusions.
- Check the waiting period for business interruption and how income loss is measured.
- Insurance does not replace security. Paying does not ensure data is recovered.
Ransomware coverage vs. related terms
- Cyber extortion. Cyber extortion is the usual name of the insuring agreement. It is broader than ransomware, since it can include threats to publish stolen data or to disrupt systems, not only to keep files encrypted. Ransomware is the most familiar form.
- Social engineering fraud and business email compromise. Social engineering fraud and business email compromise involve tricking a person into sending money, not locking systems. They are often covered by a separate sublimit or by a crime policy, with different conditions.
- Traditional business interruption. Business interruption in a property policy is usually triggered by direct physical damage. Income lost to a ransomware outage is typically addressed by the cyber policy's own business interruption coverage, with its own waiting period.
- Data breach liability. If stolen data leads to claims from customers or regulators, that is the third-party side of a cyber policy. Ransomware response costs are mostly first-party.
Second example: data theft without encryption
A hypothetical software company receives a message claiming that its customer data was copied and will be published unless it pays. Its systems still run normally. The company reports the incident under its cyber policy. The insurer may appoint forensic and legal advisers to find out whether data was actually taken, and the policy may reimburse covered investigation and notification costs, subject to the retention. Whether any payment is covered depends on the policy, on legal restrictions and on insurer consent. If customers later make claims, the liability section of the policy may respond to their defense, and the claims-made trigger and reporting duties apply.
Questions to ask your broker or underwriter
- Is extortion a separate sublimit, and does coinsurance or a higher retention apply to ransomware events?
- What is the waiting period for network business interruption, and does it also cover outages at an outsourced provider?
- Must we use panel vendors for forensics and counsel, and when does the insurer need to consent before we act?
- Which security controls were stated on the application, and how does the policy treat a statement that turns out to be wrong?
- Do the war, infrastructure and sanctions exclusions narrow coverage for attacks by state-linked groups?
- Does the policy pay to rebuild systems, and does it cover only restoring to the prior state or also some improvement?
Why it matters for technology, AI, fintech and digital-asset companies
These companies hold valuable data, run continuous services and are frequent targets. Downtime can be more costly than the ransom, so business interruption terms matter. See cyber and technology E&O.
AI companies hold training data, proprietary models and customer prompts, which can give an attacker leverage even when systems are restored from backups. Fintech companies often have regulatory notice duties and customer contracts that call for specific cyber limits, and see fintech insurance. Digital-asset companies should separate ransomware from theft of crypto-assets: stolen assets from a wallet or exchange hack are usually a crime or digital asset question and not an extortion question. See digital assets and crypto insurance for context. Underwriters also review how fast a company can recover, so documented backups and incident plans can matter to both coverage terms and loss size.
See how this applies in practice: tech E&O and cyber insurance and insurance requirements in enterprise contracts.
Related terms
Frequently asked questions
What is ransomware coverage?
Ransomware coverage is protection, usually part of a cyber liability policy, for costs after a ransomware attack, such as incident response, negotiation, extortion payments where legally permitted, data restoration and business interruption, subject to limits and exclusions.
Does cyber insurance pay the ransom?
Many cyber policies include cyber extortion coverage that may reimburse a ransom payment when it is lawful and the insurer has consented, but this is subject to limits, retentions and conditions. Some policies restrict or exclude payments, for example where sanctions laws apply. The wording controls.
What does ransomware coverage usually not include?
Common limits include sublimits or coinsurance on ransomware, exclusions for sanctioned payees, war or infrastructure events, and failure to maintain required security controls. Improvements to systems after an attack are often not covered. Exact exclusions vary by insurer, so read the policy carefully.
What do insurers ask before offering ransomware coverage?
Underwriters commonly ask about multi-factor authentication, offline or immutable backups, endpoint detection, patching, employee training and incident response plans. Weak controls can lead to higher premium, sublimits, or declined coverage. Requirements differ by insurer and change over time.
Is ransomware covered by standard business insurance?
Generally not. Property and general liability policies are written around physical damage and bodily injury or property damage claims. Ransomware response and recovery costs are usually addressed by a cyber policy, so check whether your program includes one and how its extortion terms read.
Does ransomware coverage pay for lost income?
It may. Many cyber policies include business interruption coverage for income lost during a covered network outage, usually after a waiting period and subject to limits. How income loss is measured, and whether outsourced providers count, depends on the wording.
Do I have to tell my insurer before paying a ransom?
Policies commonly require prompt notice and often require the insurer's consent before any payment is made. Many organizations also involve legal counsel early. Follow your policy's notice terms and ask your broker or counsel about your specific situation.
Can a ransomware claim be denied because of weak security controls?
It can lead to a coverage dispute. Insurers rely on the application, so a material statement that proves inaccurate, or a policy condition that is not met, may affect coverage. The outcome depends on the policy wording and applicable law.
Need this coverage, or just a clear answer?
Our brokers translate terms like Ransomware Coverage into a program built for how your company actually operates, and read every policy for the exclusions that matter.
Book a consultation → (opens in a new tab)