Subrogation
The mechanism by which the insurer, having indemnified its insured, steps into their shoes to recover the amount from the third party responsible for the damage.
Article L. 121-12 of the French Insurance Code, inherited from Article 36 of the law of July 13, 1930: the insurer that has paid the indemnity steps into the insured's rights against the party responsible, up to the amount paid. In practice, the insurer that has indemnified its insured takes over the rights the insured held against the third party responsible for the damage, and may go after that party to recoup all or part of the amount paid. The rule serves two ends of fairness. It prevents the insured from being indemnified twice, once by their insurer and once by the responsible party, which would breach the indemnity principle. It places the final cost of the loss on the party that caused it, rather than on the pool of insureds, so third parties keep a reason to be careful. The subrogated recovery is an important economic component of insurers' results, since amounts recovered reduce net claims cost. In cyber, subrogation matters more when a loss comes from a provider's failure: a negligent host, the vendor of vulnerable software, a compromised supplier. The insurer may go after it, but apportioning liability is hard in technical chains where fault is diffuse.
Textbook case: having indemnified an insured victim of a data leak caused by the negligence of its hosting provider, the insurer brings a subrogated recovery action against that provider to recoup the sums paid, which shifts the final cost onto the party truly responsible.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.