Ransomware and Its Exclusions
Ransomware rewrote cyber underwriting in a single loss cycle. When extortion claims surged, insurers did what markets do under correlated stress: they raised prices, shrank limits, and rewrote conditions. Coinsurance and sublimits are not paperwork — they are the market forcing operators to co-own the tail. Read the sanctions overlay as the sharpest term of all: a payment that would settle an incident can be the payment that breaks the law, and the policy will not indemnify an illegal act. My read is that ransomware turned cyber insurance from a loss-transfer product into a loss-sharing partnership, whether buyers wanted the partnership or not.
Knowledge check
Why can a ransom payment be simultaneously the fastest path to recovery and a coverage or legal dead end?
Show the answer
Paying may restore systems quickly, but if the attacker is a sanctioned entity or in a sanctioned jurisdiction, the payment can violate sanctions law — exposing the operator and any facilitating insurer or vendor to liability, and the policy will not indemnify an unlawful act. On top of that, insurers increasingly apply sublimits, coinsurance, and conditions (such as backup and control requirements) that reduce or defeat recovery even when payment is otherwise permissible, so the fast path can leave the operator both exposed and uncovered.