A ransomware attack can stop trading, lock you out of vital systems and expose customer data within hours. Ransomware and extortion cover can help a UK SME fund specialist response, restoration and lost income. But payment may be unlawful, may not recover data and is never assured.
Ransomware cover: costs paid, ransom not assured
Ransomware cover can fund containment, forensics, legal advice, customer notification, data restoration and business interruption. A ransom payment remains subject to separate limits, insurer approval and the law.
A £1 million policy limit is not a £1 million ransom fund. Check separate limits for extortion, forensic work, restoration and lost income. Also check the insurance excess that you must pay yourself.
When is a ransom payment considered?
An insurer may consider payment after its response team checks recovery options, the threat and sanctions risk. A decryptor may fail. Stolen files may still be published, and attackers may demand more money.
The error most firms make is treating payment as the main solution. It is only one option in a wider response.
Which costs sit outside extortion cover?
Extortion cover may pay for negotiation and related fees. Rebuilding systems, notifying people, defending claims and replacing lost income may sit in separate sections.
Double extortion combines encrypted systems with a threat to leak copied data. One event can then cause outage, privacy, contract and reputation costs.
A ransom demand is rarely the only bill.
Compare sublimits before the headline policy limit
Compare sublimits and claim triggers, not just the headline figure. A £1 million policy can still leave a firm short.
That can happen when restoration, extortion or business interruption has a lower cap. The policy wording sets the real scope of cover.
| Incident scenario | Cover sections to check | Common shortfall | Question for the insurer |
|---|
| Systems encrypted | Forensics, restoration, interruption | Short restoration cap or waiting period | When does lost-income cover start? |
| Data stolen, no encryption | Extortion, legal advice, notification | Low extortion or privacy-response sublimit | Does the policy cover a leak threat alone? |
| Threatened public leak | Negotiation, crisis support, liability | Reputation harm with no direct income proof | Which crisis-management costs are pre-approved? |
| Managed provider compromised | Dependent business interruption | [Supplier](https://dealergen.uk/your-sme-cyber-policy-may-exclude-a-supplier-caused-breach/) outage excluded or narrowly defined | Are named cloud and IT suppliers covered? |
Which sublimits matter most to SMEs?
Key SME sublimits usually cover forensics, restoration, cyber extortion, legal expenses and business interruption. Firms that rely on cloud systems should also check dependent business interruption cover.
A dental practice, accountancy firm, recruiter or care provider may face high privacy and notification costs. These firms often hold sensitive personal information.
Manufacturers, logistics firms and wholesalers face a different risk. An unavailable IT provider may halt production, dispatches or invoicing.
Does business interruption start at once?
Business interruption cover often has an eight- to 24-hour waiting period. It may calculate loss through turnover, gross profit or increased working costs.
The wording must match how your business earns money. This is where many claims become harder to prove.
Are backups enough to reduce the limit?
Tested, isolated backups reduce recovery risk. They do not pay for forensics, legal advice, breach response or customer communication.
They also do not replace lost income during an outage. Think of backups as a spare key, not the whole emergency service.
Map suppliers needed for orders, payments, customer records and services. Then check cover for unnamed providers, cloud services and outsourced IT.
The policy must match your real points of dependency. The next section explains why early actions can protect that cover.
After an attack, notify before acting
Preserve evidence, isolate systems safely and notify the insurer at once. Use approved specialists before you commit to major recovery costs.
Notify the insurer before appointing suppliers or starting costly recovery work. Many policies need consent before they repay those costs.
Should you switch off infected devices?
Disconnecting a device may limit spread. Switching it off can remove useful live evidence.
Follow the insurer’s incident team unless safety or ongoing damage needs an immediate shutdown. Keep people away from affected systems until advice arrives.
When must the ICO be told?
Assess a personal-data breach promptly. The ICO generally expects notice within 72 hours of awareness when people’s rights and freedoms face likely risk.
The 72-hour period does not mean every ransomware attack needs a report. The facts about personal data and likely harm decide this.
Can you hire your own forensic firm?
You can ask to hire your own forensic firm. Policies often need insurer consent before costs are incurred.
Using unapproved suppliers can put repayment at risk. Get written approval where possible.
A disciplined ransomware attack response also protects the claim. Keep a dated log of discovery, affected systems and management decisions.
Record every instruction from the insurer or its panel. Preserve ransom notes, email headers, screenshots, firewall logs and relevant contracts.
Do not alter original evidence.
Approved digital forensics specialists can help find the intrusion route and scope. Keep invoices, payroll records, cancelled orders and extra-cost evidence.
These records support ransomware recovery costs, lost-income calculations and data breach notification expenses. Clear records make a hard claim easier to assess.
Avoid exclusions hidden in cyber wording
Exclusions and conditions can remove cover after a genuine attack. Read them as carefully as you consider the premium and policy limit.
The most common mistake here is checking the price but not the conditions. A cheap policy can have narrow cover when you need it most.
Sanctions, crime and war exclusions
Sanctions checks can block a ransom payment. Policies may also exclude deliberate acts by senior staff or incidents that began before cover.
Some policies use war wording for certain state-backed attacks. Ask how that wording works in practice.
Patches and social engineering traps
Insurers may require multi-factor authentication, patching and offline backups. Fraudulent payment instructions may need separate crime or funds-transfer cover.
Multi-factor authentication means a password plus a second proof, such as a phone code. It is like needing both a key and a door code.
This cover may be less relevant if a business barely uses digital systems. It may also be less relevant for a business that holds no customer data. It never replaces multi-factor authentication, tested isolated backups, patching and a simple response plan. Poor controls do not automatically turn an uninsured loss into a covered one.
Controls and insurance work together. The following answers deal with the questions owners ask most often.
Frequently asked questions
Does cyber insurance cover ransomware?
Cyber insurance can cover ransomware response, restoration and lost income when the policy includes those sections. Its conditions must also be met.
Check separate sublimits, the excess and any waiting period. Do this before you rely on the headline policy limit.
What should a business do after ransomware?
A business should preserve evidence, isolate affected systems safely and notify its insurer immediately. Avoid wiping devices, paying criminals or appointing outside specialists first.
Wait for the insurer’s incident-response process to start. This helps protect evidence and possible cover.
Do I need to report ransomware to the ICO?
You must assess ICO reporting if ransomware affects personal data and creates a risk to people’s rights. The normal UK GDPR deadline is 72 hours from awareness.
That deadline applies where notification is required. Not every attack meets that test.
Are cyber insurance fines covered in England?
Some policies cover certain defence costs or penalties where the law allows. They cannot insure unlawful payments.
Read the wording for UK GDPR, regulatory fines and penalties. Also check exclusions for deliberate conduct.
Are offline backups enough without insurance?
Offline tested backups can reduce restoration time, but they do not cover forensics, legal advice or lost income. Keep at least one backup separate from the main network.
Test recovery at regular intervals. A backup that cannot open is not a recovery plan.
Choose cover before an incident
Choose cover for your worst credible outage. Price several days without core systems and assess possible data exposure.
Confirm supplier failure cover where cloud or IT providers are essential. Ask for the full wording before renewal.
Test a realistic five-day loss of email, accounting software and customer records. Check every limit and condition against that scenario.
Choose limits from the cost of a real outage, not from the cheapest headline figure. Estimate gross profit and extra working costs for five-, 10- and 20-day outages.
Compare those figures with the business interruption limit and waiting period. A retailer reliant on online orders may need lower retention and higher interruption cover.
A professional firm with special-category data may need higher legal and notification limits. It may also need more cyber extortion cover.
Compare the excess with cash reserves. A retention that seems affordable at renewal may be hard to fund during an outage.
Ransomware insurance should support tested recovery plans and proportionate cyber security controls. It cannot replace them.
The essential points:- Ransomware cover can fund recovery work, but no policy guarantees a lawful ransom payment.
- Sublimits for forensics, restoration and lost income can matter more than the headline limit.
- Notify the insurer before appointing suppliers or starting major recovery work.
- UK GDPR may require ICO notification within 72 hours where personal-data risk exists.
Will cyber insurance pay a ransom?
Cyber insurance may consider a ransom payment only when it is lawful, necessary and approved under the policy. Sanctions checks can block payment.
Payment does not guarantee a working decryptor or deleted stolen data.
Further reading
If you want to learn more about this topic, these sources may interest you:
