Does cyber insurance cover ransomware and business interruption?

Does cyber insurance cover ransomware attacks?

A well-structured cyber liability policy covers both ransomware attacks and the business interruption losses that follow. Standard commercial property and general liability policies typically exclude cyber events entirely, so without a dedicated cyber policy, a Georgia business absorbs both costs out of pocket.

What does ransomware coverage pay for?

Ransomware coverage generally pays for:

• Incident response fees, the forensic investigators who identify how attackers got in and contain the breach
• Ransom payments, where permitted by policy terms and applicable law
• Data restoration, rebuilding or recovering encrypted files and databases
• Notification costs if customer or employee data was exposed
• Legal and regulatory fees tied to the breach

For example, a Gwinnett County staffing firm is hit by ransomware that encrypts its database and payroll system. Recovery takes six days. The forensic firm, ransom payment, and data restoration cost $55,000. Lost income during the shutdown adds another $40,000. A cyber policy responds to both. The firm's business owners policy (BOP) excludes cyber losses explicitly.

How does cyber business interruption coverage work?

Business interruption coverage under a cyber policy works similarly to the business income protection in a standard BOP, except the trigger is a cyber event rather than a physical one like a fire or flood. The policy typically reimburses lost net income during the period your systems are offline and you cannot operate normally. That period of restoration is usually defined as the time reasonably required to rebuild systems to their pre-attack condition.

For a small business, that window matters. A ransomware attack that takes systems offline for four days can generate $30,000 to $80,000 in lost revenue alone, before accounting for forensic and recovery costs. To understand whether your business needs standalone cyber coverage, see whether small businesses need cyber insurance.

Do all cyber policies respond to ransomware the same way?

Cyber policies do not all respond the same way. Some cap the business interruption benefit at a set dollar amount or a fixed number of days. Others exclude certain categories of incidents, social engineering losses or attacks on third-party vendors, for example, unless those extensions are specifically added. The waiting period before business interruption benefits begin, sometimes called the retention period, varies by policy and affects how much of a short outage is actually covered.

The aggregate limit on a cyber policy also matters. If a single ransomware event triggers both the incident response coverage and the business interruption coverage, both draw from the same overall limit unless the policy carries separate sub-limits for each. For more on how commercial policies are structured, see claims-made vs. occurrence policies.

How do I confirm my cyber policy covers ransomware and business interruption?

Because terms vary this much, the right way to confirm coverage is a direct policy review. A licensed advisor can walk through your specific cyber policy, identify any caps or exclusions that apply to ransomware and business interruption, and flag gaps before an incident forces the question. See also whether your business qualifies for a BOP and what cyber add-ons may be available under that structure.

Request a free coverage review and our team will confirm whether your cyber coverage responds to both ransomware response costs and lost income during a shutdown.