Ransomware

Ransomware is malicious software that renders a victim's data or systems unusable, most often by encrypting them, and makes their restoration conditional on paying a ransom, today almost always in cryptocurrency. The modern form combines encryption with prior theft of the data and the threat to publish it, and it is distributed by operators who rent their tool to affiliates. For the insurer, ransomware is not one peril among others but the one that shapes the line. A single attack triggers almost every cover in the policy: incident response costs, system restoration, business interruption, extortion, notification and liability to third parties whose data leaked. Its severity depends less on the ransom than on the length of the outage, often several weeks, which is why underwriters now require isolated backups, multi-factor authentication and detection capability before offering cover. Its political dimension comes from sanctions: paying may be prohibited when the group or one of its members is designated, turning a crisis management decision into a question of criminal law.