Cyber Extortion Policy
Coverage responding to ransomware attacks and extortion demands that threaten to disable systems, release data, or disrupt business operations.
What It Is
A Cyber Extortion Policy, or cyber extortion coverage within a cyber liability policy, responds to threats by malicious actors to disable computer systems, release confidential data, introduce malicious code, or otherwise disrupt the insured's business operations unless a ransom is paid.
The coverage typically includes the ransom payment itself (usually in cryptocurrency), negotiation expenses with the extortionist, forensic investigation costs to determine the scope of the intrusion, system restoration expenses, and business interruption losses during the event.
Cyber extortion coverage has become one of the most important components of cyber liability policies as ransomware attacks have become the most costly and frequent cyber threat facing businesses of all sizes.
Why It Matters for Brokers
Ransomware attacks have escalated dramatically in both frequency and severity. Average ransom demands now exceed $500,000 for mid-size businesses, and total costs including system restoration and business interruption can reach millions. Without cyber extortion coverage, businesses must absorb these costs entirely. Brokers must evaluate cyber extortion coverage carefully, as policies vary in their treatment of ransom payments, waiting periods for business interruption, and whether OFAC sanctions compliance is required before a ransom can be paid.
Real-World Example
A mid-size law firm's entire document management system is encrypted by ransomware. The attackers demand $300,000 in Bitcoin, threatening to publish confidential client files if not paid within 72 hours. The cyber extortion coverage engages a specialized negotiator who reduces the demand to $175,000, which is paid after OFAC screening confirms the attacker group is not sanctioned. The policy also covers $120,000 in forensic investigation, $80,000 in system restoration, and $200,000 in business interruption during the two-week recovery period.
Common Mistakes
- 1Not verifying whether the cyber policy includes extortion coverage and at what sublimit, as some policies exclude or significantly limit ransomware payments.
- 2Failing to understand OFAC sanctions compliance requirements that may prevent ransom payment if the attacker group is a sanctioned entity.
- 3Not reviewing the business interruption waiting period and coverage period within the cyber extortion section, which affects recovery cost coverage.
How brokerageaudit.com Handles This
Policy Checker evaluates cyber extortion coverage sublimits, waiting periods, and payment conditions within cyber liability policies to ensure adequate protection against ransomware threats.