Is your cyber insurer refusing to cover costs after ransomware, a data breach or digital fraud? Ask which cover, exclusion or security condition it is relying on. The costs of incident response, recovery, business interruption and liability can fall under different sections of the policy. A single ground for refusal does not automatically dispose of every head of loss.
Nederlands: Lees dit artikel in het Nederlands: Cyberverzekering weigert dekking na een incident
Türkçe: Bu makaleyi Türkçe okuyun: Siber sigorta bir olaydan sonra teminatı reddediyor
Written by Onur Arslan, attorney at Arslan Advocaten. Do you have questions about your own situation? Get in touch.
Report the incident and limit further damage
Follow the reporting procedure set out in the policy and record when you discovered the incident. Keep relevant logs, messages, contracts and technical reports. Coordinate the investigation and recovery with experts, so that necessary security work does not needlessly destroy evidence.
A dispute about cover does not replace any statutory notification obligations. Where personal data is involved, a data breach assessment may be required under GDPR, Articles 33 and 34. The insurer does not decide for every obligation whether you must notify a supervisory authority or the individuals concerned.
Security conditions and information given in the application
The insurer may ask about multi-factor authentication, back-ups, updates, access management or statements made in the application. Check the exact obligation, which systems it applied to and what the situation was at the relevant time.
A general allegation that security was inadequate is not the same as proving breach of a specific policy condition. Conversely, information about how your systems were set up must not be altered after the event to make cover appear plausible. Work with existing configuration data and technical documentation.
Which costs are covered?
Incident response cover may require the use of a designated service provider or prior consent. Business interruption cover may be subject to a waiting period, an excess and a maximum indemnity period. Recovery costs are not automatically the same as upgrading outdated systems.
In the case of digital payment fraud, a dispute may arise as to whether this is a cyber incident, social engineering or an excluded voluntary transfer. Ask which definition and module the insurer is applying. A data breach and a payment loss need not fall under the same cover.
Assessing the investigation and the refusal
Ask for the technical report and the reasoning that links the event to the exclusion. Draw up a timeline of access, discovery, notification and measures taken. An independent technical expert can help to test factual assumptions; the legal interpretation of the policy also requires a separate assessment.
Discuss which costs are undisputed and whether these can be paid in the meantime. Also check for possible cover under other policies, without claiming the same loss twice. The general rules on insurance are set out in Book 7 of the Dutch Civil Code (BW).
Frequently asked questions
Is ransomware always covered?
No. Cover depends on the policy, the conditions, the exclusions and what actually happened.
May I call in my own IT company straight away?
Emergency measures may be necessary. At the same time, check the notification and consent arrangements and record why the costs were necessary.
Is a missing security measure always fatal to the claim?
Not automatically. The precise clause, the facts and the legal consequences must be assessed.
Can Arslan look into the refusal?
We can review the policy and the incident report and align the technical and legal questions with each other.
Read more about overlapping insurance policies and a coverage error by your insurance adviser.
Have the refusal of your cyber cover and the individual cost items assessed.
This page provides general information and is not legal advice about your own situation. No rights can be derived from its content.
