Does Cyber Insurance Cover Ransomware Payments?

The Short Answer

Yes, most modern cyber liability policies cover ransom payments as part of cyber extortion coverage, but with real conditions attached.

The Conditions That Usually Apply

• Insurer pre-authorization is typically required before any payment is made
• You’re usually required to use the insurer’s approved incident response and negotiation vendors
• Cyber extortion coverage is sometimes sublimited to a fraction, in some cases as low as 25%, of your overall policy limit

The OFAC Rules That Apply No Matter What

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) prohibits payments to individuals or groups on its Specially Designated Nationals (SDN) list. Many ransomware operators are sanctioned or linked to sanctioned entities. Insurance does not provide legal safe harbor from this: both the business and anyone facilitating the payment remain exposed to civil or criminal enforcement if a sanctioned party is paid, insurance or not. This is why reputable insurers require OFAC sanctions screening before authorizing any ransom payment.

What This Means in Practice

If you’re ever in a ransomware situation, your insurer’s incident response team is there partly to help you pay safely and legally when payment is the right call, and to help you avoid it when it isn’t. That’s part of why having a policy in place before an incident matters more than most business owners expect: you get access to a team that already knows these rules, instead of figuring them out under pressure.