Cyber Insurance Claims: Real Examples, Statistics, and Why Claims Get Denied

Buying cyber insurance is an act of faith: you pay premiums for years and find out whether the product works on the single worst day of your company's life. So before trusting any policy, it is worth studying the moment of truth. What do real claims look like? How often do insurers actually pay? And when they refuse, why?

What a typical claim actually looks like

Forget the movie version. The most common cyber claims are mundane:

Ransomware. Systems encrypted on a Friday night. The claim covers the forensics team, the negotiator, the ransom itself where legal, rebuilding servers, and the revenue lost during two weeks of downtime. This category drove the hard market of 2020 to 2022 and still produces the largest single losses.

Funds transfer fraud. An employee pays a fake invoice or wires money to a "supplier" whose bank details changed in a convincing email. No malware involved, which is exactly why it is the most disputed claim type: classic cyber wordings cover damage to systems and data, not money handed over voluntarily. In the Ryskly catalog, only 49% of products include cyber crime or funds transfer fraud cover.

Data breach with notification duties. Customer records leak. The costs are less about the hack and more about the aftermath: legal advice, notifying regulators and affected people, credit monitoring, and defending claims from customers.

Business email compromise. An attacker sits inside a mailbox for weeks, reads everything, then strikes. Often ends as one of the two categories above.

The pattern across all of them: the biggest line items are usually services and downtime, not the headline ransom. This is why 77% of products in our catalog bundle incident response services directly into the policy. The insurer would rather send its own experts at hour one than pay a bigger bill at month three.

Famous denials: what court cases teach buyers

A handful of public disputes shaped how cyber policies are written and read today. Each one is a lesson.

Merck and the war exclusion. After the NotPetya malware caused Merck roughly 1.4 billion in damage in 2017, insurers invoked the war exclusion because the attack was attributed to a state. Courts sided with Merck: an exclusion written for armies and missiles did not clearly apply to malware hitting a civilian company. The industry answered with explicit cyber war clauses, which now appear in modern wordings. War exclusions of some form appear in 100% of the policies we track.

Mondelez and the same storm. Mondelez fought a parallel NotPetya battle with its property insurer over the same "hostile or warlike action" language and settled confidentially in 2022. Lesson: the same incident can trigger completely different outcomes depending on which policy and which wording it lands on.

Cottage Health and the security questionnaire. A US healthcare network suffered a breach, and its insurer sought to avoid paying, citing a policy condition about failing to follow the "minimum required practices" declared in the application. The case settled, but it put every buyer on notice: the security answers you give during the application are not marketing, they are contract.

P.F. Chang's and the gap nobody read. The restaurant chain had a cyber policy and still ended up paying nearly 2 million in card brand assessments after a payment card breach, because that specific cost category was not covered. Lesson: a policy can respond exactly as written and still leave the largest bill on your desk.

Why claims get denied: the practical list

Full denials are rarer than the horror stories suggest, but they cluster around predictable causes:

1. Misrepresentation in the application. You declared MFA everywhere; forensics found a VPN account without it. This is the most preventable denial there is. Answer what is true today and keep evidence.
2. The loss falls into an uncovered category. Social engineering losses without cyber crime cover, card scheme assessments, regulatory fines where the law does not allow insuring them.
3. Late notification. Policies require prompt notice, and some are strict about it. Involving the insurer late, after you have already hired your own lawyers and negotiated with attackers, can reduce or void the payout. Call the hotline first.
4. Acting without consent. Paying a ransom or settling with a claimant without the insurer's sign-off usually breaks a policy condition.
5. Prior knowledge. The incident, or the vulnerability that caused it, was known before the policy started.

Notice what is missing from the list: insurers refusing to pay simply because the bill is large. That happens in disputes about amounts, but wholesale denial almost always traces back to one of the five causes above.

What the statistics say

Industry loss data is published unevenly across markets, but a few patterns hold everywhere:

• Ransomware and funds transfer fraud dominate claim counts for small and mid-sized businesses.
• Most claims are settled and paid without litigation. The court cases are famous precisely because they are exceptions.
• Claim severity keeps rising faster than frequency: fewer but bigger incidents, driven by downtime costs.
• The businesses with tested backups and rehearsed response plans consistently show smaller losses on identical incidents. Insurers know this, which is why 39% of products now bundle staff security training and 28% include managed detection services: prevention is cheaper than claims.

How to be the claim that gets paid

• Read the exclusions and sub-limits before you buy, not after the incident. Our guide to what cyber insurance covers walks through the categories.
• Treat the application as a legal document. Screenshot your MFA settings, keep backup test logs.
• Save the insurer's hotline number outside your own network. If your systems are encrypted, the PDF with the emergency contacts is encrypted too.
• Call the insurer before you touch anything, pay anyone, or promise anything.
• At renewal, update your answers. Your environment changed; your declarations must change with it.

And when comparing products, look specifically at claim-relevant features: incident response included, cyber crime cover, clear war wording. Our comparison table tracks these dimensions across 682 products in 57 countries.

FAQ

How often do cyber insurance claims get denied?
Full denials are the minority of outcomes. Most claims are paid, though sometimes less than the insured hoped due to sub-limits and deductibles. Denials concentrate around misrepresentation, uncovered loss categories, and broken policy conditions.

What is the most common cyber insurance claim?
By frequency: funds transfer fraud and ransomware, followed by data breach response. By severity: ransomware with long downtime remains the most expensive category for most businesses.

Can an insurer refuse to pay a ransomware ransom?
Yes, in specific cases: where payment is illegal under sanctions, where the policy excludes or sub-limits ransom payments, or where the insured paid without the insurer's consent. Where payment is legal and the policy covers it, ransom reimbursement is a normal part of the claim.

Does a denied claim mean the insurance was useless?
Usually it means the loss fell outside what was bought: a missing cyber crime module, an unread sub-limit, an application answered optimistically. The fix is not skipping insurance, it is reading the wording and comparing products on the dimensions that decide claims.