What ransomware does to a business
Ransomware encrypts files and systems so they cannot be used, and many groups now also copy data first and threaten to publish it. The business loses access to accounting, scheduling, customer records and sometimes production systems at once, and may face notice duties if personal information was taken.
The cost is rarely the demand alone. It is forensic investigation, rebuilding systems, overtime, lost revenue while operations stop, legal advice and notification — costs that arrive whether or not any demand is paid.
What a cyber policy may pay for
Depending on the form, a cyber policy may pay for incident response and forensics, legal advice, data restoration, income lost during the outage after a waiting period, extra expense to keep operating, notification if personal data was taken, and liability for related claims. Extortion coverage, where included, may cover negotiation and, subject to law and carrier consent, a payment.
Most policies require prompt notice and the use of approved or consented vendors. Calling the carrier's incident-response line early, before hiring outside help, is often a condition worth knowing in advance.
Federal guidance on paying a ransom
The U.S. Treasury's Office of Foreign Assets Control issued an updated advisory on September 21, 2021 stating that the government strongly discourages paying ransom or extortion demands, and that facilitating payments to sanctioned parties can carry sanctions risk. Carriers and incident-response firms take that into account before any payment is considered.
The Cybersecurity and Infrastructure Security Agency's #StopRansomware guide offers prevention steps and a response checklist, and incidents can be reported to CISA and the FBI's Internet Crime Complaint Center.
Preparing before an attack
Separated backups that have been restored in a test are the single control that most changes the outcome, because they let a business rebuild without relying on an attacker. Multi-factor authentication, endpoint detection, prompt patching and a written plan naming who to call first reduce both the odds and the damage.
Those are also the controls underwriters ask about. See what a cyber insurance application asks, and for a plant or production operation, manufacturing cyber insurance.
More on Cyber & Technology Risk
Cyber Insurance vs. General Liability: Where One Stops and the Other Starts
General liability answers for injury and property damage; cyber insurance answers for data, networks and money moved on false instructions. Here is where the line usually falls.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
When a Contract Requires Cyber Insurance: What to Check Before You Sign
More owners, general contractors, lenders and agencies now write cyber insurance into their agreements. Here is how to read the requirement before it becomes a condition you cannot meet.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Wire Fraud and Payment Diversion: Cyber Insurance, Crime Insurance, or Both?
A redirected payment is the most common cyber-related loss for many businesses, and the one most likely to fall between policies. Here is how cyber and crime forms divide it.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Frequently asked questions
Does cyber insurance cover ransomware?
Many cyber policies cover ransomware response — forensics, restoration, lost income after a waiting period and notification — and some include extortion coverage, subject to law, carrier consent and conditions.
Will my cyber insurance pay the ransom?
Only where the policy includes extortion coverage, the payment is lawful and the carrier consents. Federal guidance strongly discourages ransom payments and warns of sanctions risk.
Who should I call first after a ransomware attack?
Usually the carrier's incident-response line or your broker, because many policies require prompt notice and approved vendors. Incidents can also be reported to CISA and the FBI's IC3.
Does ransomware trigger California breach notice?
If personal information was acquired, or is reasonably believed to have been acquired, notice duties under Civil Code section 1798.82 can apply, now within 30 calendar days of discovery under SB 446.
What reduces ransomware damage the most?
Separated backups that have been tested by restoring them, plus multi-factor authentication, endpoint detection, patching and a written response plan.