Your Cyber Insurer Paid the Ransom. What About the Business You Lost During the Shutdown?

Imagine a food distributor in Chicago’s western suburbs. One Monday morning, every screen in the building shows a ransom note. The company can’t take orders, plan deliveries, or send invoices. Its cyber insurer approves an $85,000 ransom payment, the hackers send the key to unlock the files, and the IT vendor announces the servers are back up on day six.

But the ordering system relies on a database the hackers damaged, and it doesn’t work properly until day 19. By then, the company has lost about $410,000 in sales. It kept paying 60 employees, hired a temporary IT firm to process orders by hand, and lost two restaurant customers to a competitor that could still deliver.

The insurer treats the claim as mostly finished. Under most cyber policies, though, the ransom was the easy part.

Ransom Coverage and Business Interruption Coverage Are Separate Promises

A cyber policy is really several coverages packaged together, each with its own conditions, dollar limits, and deductible. Ransom coverage, often called cyber extortion coverage, pays the ransom and the cost of negotiating with the hackers. It usually requires the insurer’s approval before anyone pays. By contrast, business interruption coverage pays for income lost while the business can’t operate normally. Other coverages pay to rebuild data and to cover the extra costs of keeping the business running during the outage.

Paying under one coverage doesn’t settle anything under the others, including any separate coverage for funds lost through a fraudulent wire transfer. An insurer that pays the ransom quickly, in other words, hasn’t agreed to pay for the shutdown, and a business that treats that first check as the end of the claim may never ask for the larger amount.

How a Cyber Business Interruption Claim Is Calculated

Lost income under a cyber policy usually isn’t the same as lost sales. Most policies start with the profit the business would have made. They add the ordinary expenses that kept running during the outage, such as payroll, and subtract the costs the business didn’t have to pay. For the distributor, the $410,000 figure may go down once you remove the cost of food it never had to buy. It may go up once payroll and other fixed costs are added back.

The business has to prove the loss with sales history, seasonal patterns, pending orders, and customer emails. Many cyber policies also pay for an accountant to prepare the claim, usually up to a set cap, so it is worth checking for that coverage before paying an accountant out of pocket.

When Customers Don’t Come Back With the Servers

The two lost restaurant customers raise a different issue. Basic business interruption coverage often stops once the restoration period ends, even though the business keeps losing money.

Some cyber policies add extended coverage, commonly 30 to 90 days, for income lost after the systems are fixed while the business wins back customers. A few policies also cover harm to the company’s reputation. Whether you have this coverage, and for how long, may decide whether lost customers are covered at all. Businesses often don’t claim it because they don’t think of lost customers as part of a cyber claim.

Who Decides When the Business Is “Restored”?

Most disputes are about when the covered shutdown ended, which insurers call the period of restoration. In this example, the insurer says day six, when the servers came back, while the business says day 19, when it could fill orders again.

The answer depends on the policy’s wording. Some policies end coverage when the systems are restored, or when they could have been restored if the work had moved at a reasonable pace. Others end it when the business is back to operating the way it did before the attack. Almost all policies also have a waiting period, often several hours, before coverage starts. It works like a deductible measured in time.

Many businesses miss a related problem: cyber policies often require the policyholder to use the insurer’s approved forensic and IT vendors. Those vendors write the official timeline of the recovery, and the insurer may rely on their report to argue the shutdown ended early. A policyholder should keep its own record as events unfold: what worked, what didn’t, and which orders went unfilled.

Before Accepting a Final Payment

A policyholder should read any release language before accepting a final payment, since signing it may give up the rest of the claim. The policy’s deadlines for submitting proof of loss and for filing suit also need close attention. In Illinois, Section 155 of the Insurance Code lets a court award attorney fees and a limited penalty when an insurer’s delay or denial is vexatious and unreasonable, meaning it had no good reason. That gives policyholders real leverage, but courts set a high bar. A good faith disagreement about the restoration date usually won’t qualify.

Not every shortfall is worth a lawsuit. Many disputes are resolved with a claim backed by good records, a credible accountant’s analysis, and a clear record of when the business could actually operate again.

The ransom is the number everyone remembers. The policy’s definitions of “restored” and any extended coverage usually decide the bigger number.

If your cyber insurer paid the ransom but left your business absorbing the shutdown losses, we can evaluate the policy, challenge an underpayment, and pursue additional covered amounts. Contact us to discuss your matter.

This article provides general information and does not constitute legal advice. For guidance concerning a specific matter, see our insurance recovery services. Coverage depends on the policy wording, the facts, and applicable law. To discuss potential representation, request a consultation. Submitting an inquiry does not establish an attorney-client relationship.