Ransomware Insurance Claims and Business Interruption: A Practical Guide

If ransomware or another active compromise is suspected, follow your incident-response plan and involve qualified security staff. The FTC recommends isolating affected devices while preserving evidence where appropriate.

Keep an accurate chronology of when systems failed, which assets were affected, who was contacted and what measures were taken. Avoid making unverified claims about the cause.

Some cyber policies require prompt notice, a dedicated hotline or preapproval for outside advisers. Review your contract rather than guessing deadlines.

An insurer may use a panel of forensic professionals, counsel or other vendors. Incur critical safety and security expenses when necessary, while documenting why they were needed.

Business interruption insurance is not an automatic guarantee of all lost revenue. The policy may define covered disruptions, the waiting period, indemnity period, required proof and how lost income or extra expenses are calculated.

Track normal operations against the affected period, identify avoided expenses and record revenue, invoices, payroll and other supporting information. Calculation rules differ widely among policies.

You may incur temporary system, recovery, communication or outside service expenses. Keep invoices and proof that the expense relates to the incident.

Some costs can be subject to insurer approval, limits or exclusions. Distinguish costs to restore operations from upgrades you would have made even without the incident.

If data was accessed or stolen, notification obligations may apply depending on the affected information, jurisdiction and business type.

Ask qualified legal advisers about reporting, regulatory notifications, privacy obligations and sanctions restrictions before decisions involving extortion demands.

Review the insurer's claims correspondence, explanations of covered and noncovered losses, and any dispute process. Keep copies of communications and supporting documentation.

Improve access controls, backups, patching, vendor security and employee training. The FTC's small-business cybersecurity guidance provides practical prevention and recovery topics.