Can My Insurer Refuse to Pay a Ransom?

Yes. Most policies require your insurer to pre-authorize any ransom payment, and that authorization isn’t automatic. The most common reason an insurer would decline is OFAC sanctions screening: if the threat actor is linked to a party on the U.S. Treasury’s Specially Designated Nationals list, paying them is illegal regardless of what your policy covers, and your insurer will not authorize or facilitate that payment.

Insurers may also decline or push back on payment if negotiation through their approved incident response vendors suggests a better path (like restoring from backups) is available. This is part of why working with an insurer’s incident response team from the start of an incident matters. See more in Does Cyber Insurance Cover Ransomware Payments?