Whether to pay a ransom is a question put to the insured, never to the insurer, and that is the first misunderstanding to clear. An extortion cover decides nothing: it reimburses, under conditions, a decision the company takes alone and for which it bears responsibility. That allocation is not drafting caution, it is the only tenable one: nobody but the executive can arbitrate between the survival of the business and what the payment funds. What insurance brings is to make that decision less bad by documenting it, quantifying it and bounding it legally.
The trade-off arises first in terms of time and it can be quantified. Paying and obtaining a decryption key can restore activity in a few days; rebuilding from backups can take weeks. The gap between the two converts directly into business interruption loss, and that conversion is what makes comparison possible: six weeks of rebuilding on a given margin represent an amount that can be set against the ransom demanded. It is a cold calculation and it is not sufficient, but it must have been done, because a decision taken without it is taken on fear.
One must then know that paying does not extinguish the loss, and that is the second misunderstanding. A decryption key rarely works well: it is slow, it fails on part of the files, and restoration remains a project of several weeks. Above all, the dominant practice pairs encryption with prior exfiltration: the data is already out, and payment buys only a promise not to publish it, a promise no mechanism guarantees. An insured paying to avoid a leak is therefore buying something that does not exist, while one paying to shorten an interruption is buying something real but imperfect.
Then comes the constraint that is not negotiable and that meets what this certification has seen elsewhere: sanctions. A payment to a designated entity is prohibited, whatever the cover, and the policy cannot reimburse what the law forbids paying. The result is a situation exactly parallel to the loss that is covered and unpayable: the cover responds, the expense is legitimate, and the transfer is prohibited. That is why checking the recipient is a precondition and not a formality, why it is conducted by specialists, and why it takes time that urgency bears badly.
The insurer's prior consent is the second condition and one must understand what it protects. A payment made without notice will be disputed, not out of ill will but because the insurer cannot verify afterwards what it would have verified before: the reasonableness of the amount, the reality of the threat, the compliance of the recipient. Most policies provide a number to call and a fast decision, in hours. An insured that pays first and notifies later turns a cover into a disputed claim, on an expense it can no longer undo. For a French insured, the law adds a third condition, which does not depend on the contract: since the LOPMI law, article L. 12-10-1 of the French Insurance Code makes any indemnity for losses caused by an attack on an automated data processing system conditional on a criminal complaint filed no later than seventy-two hours after the victim became aware of the attack. It applies to legal entities and to individuals acting in a professional capacity.
A word on negotiators, because their role is poorly understood. They are not intermediaries obtaining a discount: they establish a channel, verify that the counterpart actually holds the key, test decryption on a sample, and slow down a conversation the attacker wants fast. That slowing has value in itself, because it lets restoration progress and therefore lets the calculation change. They are among the providers on the insurer's panel, and this is one of the rare situations where going through the panel is an obvious advantage.
The discipline comes to four steps prepared in the cold. Know who, in the company, has authority to decide a payment, because asking that during the crisis costs hours. Know that the recipient's compliance is verified before any transfer and that this takes time. Know that the insurer must be called before paying, on a number known and recorded off the network. And have quantified in advance what a full rebuild would cost, because it is that figure, and not fear, that must sit opposite the sum demanded.
A logistics company, 60 million euros of turnover and 18 percent gross margin, discovers on a Monday that its warehouse operating systems are encrypted. The attackers demand the equivalent of 900,000 euros and state they hold 400 gigabytes of commercial data. The technical team estimates rebuilding from backups at six weeks, and decryption at two days if the key works. Management wants to pay immediately to avoid publication of the data. The policy covers extortion subject to prior consent. Two of the three payment addresses given show partial matches with designation lists. What should be done?
The reason management invokes is the only one that does not hold, and that must be said before discussing the amount. Paying to avoid publication of the 400 gigabytes amounts to buying a promise nothing guarantees: the data is already out, and no mechanism obliges an attacker to destroy it. What payment can actually buy is time on the interruption, and that can be quantified: six weeks of rebuilding represent about 1.24 million euros of lost gross margin, against two days and a 900,000 euro ransom if the key works, which is never certain and in any event implies several weeks of restoration. The calculation therefore leans toward paying, but for a different reason than the one advanced, and by a narrower margin than it appears. Two preconditions then govern what follows and neither can be bypassed. The partial matches with designation lists must be cleared before any transfer: a payment to a designated entity is prohibited whatever the cover, and the policy cannot reimburse what the law forbids paying. And the insurer's prior consent is sought now, on the emergency number, because a payment made first and notified later turns a cover into a disputed claim on an irreversible expense. If the company is French, a third condition has been running since Monday: without a complaint filed within seventy-two hours, the insurer may refuse any indemnity, ransom included. The useful step today is therefore to run in parallel the recipient check, the insurer's consent and the restoration, the last having the advantage of lowering the ransom's value by the day.
- 01The decision belongs to the insured, never to the insurer: the policy decides nothing, it reimburses under conditions a decision taken alone.
- 02Paying to avoid publication buys a promise nothing guarantees; paying to shorten an interruption buys something real but imperfect.
- 03The trade-off can be quantified: rebuilding converts into business interruption loss, and that amount must sit opposite the sum demanded.
- 04A payment to a designated entity is prohibited whatever the cover: checking the recipient is a precondition, not a formality.
- 05Paying first and notifying later turns a cover into a contentious claim on an expense that can no longer be undone.