Ransomware does more than lock files. It can disrupt operations, trigger legal obligations, and leave businesses facing significant recovery costs.
When a ransomware claim is lodged, cyber insurance can activate specialist incident response, IT forensics, legal support and business interruption cover to help the company respond and recover. The policy may then cover eligible response costs, system restoration expenses and lost income, subject to the policy terms, limits and applicable excess.
At Barrack Broking, we help businesses prepare for and respond to the financial and operational risks that can arise from cyber incidents, including digital threats, technology errors and client-related losses. Our team can help you understand where your business may be exposed and arrange cyber insurance suited to your risks and needs. Explore our cyber insurance services to learn more.
What Happens in the First 72 Hours of a Ransomware Claim
The first 72 hours of a ransomware claim typically focus on your insurer and response team coordinating the technical, legal, and financial steps, while you focus on keeping the company operating.
1. Notify your insurer or broker immediately
Call your insurer’s 24/7 incident hotline or contact your broker as soon as you become aware of the incident. Most cyber policies require notification as soon as practicable.
2. An incident response team is appointed
The insurer will typically appoint an incident response manager and IT forensics specialists to investigate what happened, identify affected systems, and coordinate the response.
3. Systems are isolated, and the attack is contained
IT specialists work to isolate affected devices, accounts, or networks and prevent the ransomware from spreading further.
4. Legal advisers assess notification duties
Legal advisers assess the incident and determine whether the company has obligations to notify customers, regulators, employees or other affected parties.
5. Recovery from backups begins
Once the environment is assessed and containment measures are in place, the response team can begin restoring systems and data from clean backups where available.
6. Costs and losses are documented
Keep records of response costs, restoration expenses, business interruption, and other financial losses associated with the incident. This documentation supports cyber insurance claims.
If you need help understanding your cyber insurance response or want to discuss your cover, contact our friendly team at Barrack Broking for guidance.
What a Cyber Insurance Policy Covers During a Ransomware Attack
A ransomware attack can create costs long after systems are first locked or encrypted. Depending on the policy, cyber insurance may respond across the technical, legal, financial and communications aspects of the incident, helping a business manage the immediate response while working towards recovery.
Coverage can include:
- Incident response and IT forensics
- Data and system restoration
- Business interruption and lost income
- Legal and regulatory costs
- Customer notification and credit monitoring
- Third-party liability claims
- Public relations support
- Extortion payment and negotiation
How Your Insurance Broker Manages the Claim
Your broker acts as the link between your business and the insurer during a claim, helping you present the claim correctly, coordinate the response, and address issues through to settlement.
01. Lodging and managing the notification
At Barrack Broking, we help ensure the company provides the insurer with the relevant information and documentation at the outset, while identifying any immediate risk or coverage issues that need attention.
02. Coordinating with the insurer
We liaise with the insurer’s claims and incident response teams as the claim progresses, helping keep communication moving between the insurer, your company and any appointed specialists.
03. Reviewing costs through to settlement
If any items are disputed, we can raise them with the insurer and seek clarification on the basis for its position. For business interruption claims, we can also track the calculation of lost income and associated costs through to settlement.
Get the Right Cyber Cover Today
Barrack Broking provides cyber insurance advice to businesses across Australia, helping you understand your exposure to ransomware, data breaches, business interruption and other cyber risks.
Ready to review your cyber insurance? Talk to one of our specialist insurance brokers today.
Frequently Asked Questions
1. What can cyber insurance cover during a ransomware incident?
It can cover incident response, IT forensics, data and system restoration, business interruption and certain liability costs, depending on the policy.
2. Are ransomware payments reportable in Australia?
Yes. Businesses in Australia with turnover of $3 million or more, and certain critical infrastructure entities, must report eligible payments within 72 hours.
3. What are the most common cyber insurance claims?
Common claims include ransomware, business email compromise, and funds transfer fraud, where criminals deceive a business into sending money to a fraudulent account.