Cyber extortion cover
A first-party cover that reimburses, under conditions, the ransom paid and the costs of handling a computer extortion threat, within the limits set by sanctions law and, in France, the prior complaint requirement.
Cyber extortion cover addresses the consequences of a threat against the insured's systems or data: to encrypt, destroy, publish or block them unless paid. It covers negotiator and advisor fees, investigation costs, and the ransom amount when payment was decided with the insurer's prior consent. It is almost always written as reimbursement rather than advance, and subject to several conditions: the insurer's written consent, a real and credible threat, notification of the authorities, and sanctions screening. It differs from kidnap and ransom cover, which protects people, even if the negotiation logics look alike. Its existence is debated. Critics see it as an incentive to pay that funds the criminal ecosystem; defenders reply that the insurer, by conditioning reimbursement and imposing negotiators, lowers the frequency and size of payments. Several markets have regulated it rather than banned it, and since 2021 underwriters often apply a sublimit or coinsurance to it, so that the insured keeps an interest in not paying.
Textbook case: a 5 million euro cyber policy provides a 1 million extortion sublimit and 50 percent coinsurance on that item. An 800,000 euro ransom, paid with the insurer's consent after a complaint within 72 hours and sanctions screening, is reimbursed up to 400,000 euros; the negotiator's fees are reimbursed in full.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.