Ransomware and Business Interruption: How Cyber Claims Actually Pay Out

Cyber business interruption starts after a waiting period, usually 8, 12, or 24 hours from the point the outage begins. Losses inside that window are never reimbursed, regardless of severity.

For a business that trades continuously, a 24-hour waiting period on a $40,000-per-day revenue base is a $40,000 uninsured deductible. Buying down to 8 hours typically costs little and is one of the highest-value negotiation points in the policy.

The clock starts at the outage, not at discovery, so accurate logging matters. Establish and document the timeline immediately.

The policy pays for the period of restoration — from the end of the waiting period until systems are restored, subject to a maximum, commonly 30, 60, 90, or 180 days.

Better wordings add an extended period of indemnity of 30 to 90 days, covering the tail during which revenue is still depressed after systems are back. Customers do not return the day the servers do, and for service businesses the tail is often larger than the outage itself.

If your policy lacks an extended indemnity period, ask for it. It is generally an inexpensive endorsement and closes the most commonly disputed part of the claim.

The insurer calculates net income the business would have earned but for the incident, plus continuing operating expenses such as rent and payroll that ran during the outage.

This is derived from historical financials, usually 12 to 24 months of monthly management accounts, adjusted for trend and seasonality. A business with clean monthly accounts and a stable trend gets a clean calculation; one with erratic bookkeeping gets a conservative one.

Extra expense — overtime, temporary hardware, manual workarounds, expedited vendor fees — is reimbursed separately, but generally only up to the amount of loss it avoided. Keep every invoice and record the rationale at the time.

Notify the insurer's incident hotline before engaging any vendor. Costs incurred with firms outside the insurer's approved panel are frequently non-reimbursable, and this catches out businesses whose instinct is to call their existing IT provider first.

Preserve evidence: do not wipe and rebuild affected systems before forensics has imaged them. Forensic findings drive both the notification obligation and the claim, and a destroyed evidence trail hurts both.

Start a contemporaneous incident log with timestamps — who was told what, when systems went down, when each service came back. Forensic accountants will reconstruct the loss from this, and reconstructing it six weeks later from memory reliably understates it.

Control warranty breaches are the leading cause. If the application stated MFA was enforced on all remote access and it was not on one legacy account, insurers may reduce or deny. Answer application questions with verified fact, not intent.

Late notification is second. Claims-made policies impose strict notice deadlines, sometimes as short as 72 hours for a security incident.

Third is inadequate financial documentation — a business that cannot demonstrate what it would have earned receives the insurer's conservative estimate. Keeping monthly management accounts is, in effect, a cyber control.

Test restoring from backup, end to end, and record the date and result. Insurers increasingly ask for evidence of a tested restore, and a tested restore also shortens the actual outage, which reduces the loss.

Keep an offline copy of your incident response plan, the insurer's hotline number, and your policy number. During a ransomware event your email, file shares, and CRM may all be inaccessible.

Run one tabletop exercise a year with your finance lead present. The finance function owns the business interruption claim, and it is almost always the least-rehearsed part of the response.