Ransomware
Also called Cyber extortion
Definition
Ransomware is malicious software that encrypts a business’s files and systems so criminals can demand payment to unlock them, often while threatening to leak stolen data.
Ransomware is a type of malware. The Cybersecurity and Infrastructure Security Agency (CISA) describes it as software designed to encrypt files on a device, making those files and the systems that rely on them unusable, followed by a demand for ransom in exchange for decryption. Attackers may also steal data first and threaten to sell or leak it if the ransom isn’t paid.
For a small business, that can mean a point-of-sale system that won’t start, a booking calendar that’s gone or customer records in criminals’ hands.
How cyber insurance can respond
Property and general liability policies usually aren’t built for this. Cyber insurance is. Depending on the policy, it can help pay for:
- incident response, such as forensic investigators and a breach coach
- restoring data and systems
- income lost while your systems are down, after a waiting period usually measured in hours
- notifying customers whose data was exposed, where the law requires it
- extortion costs, in some policies, usually only with the insurer’s consent in advance
- claims from customers or others whose data was exposed
Ransomware and extortion coverage may come with a sublimit or its own deductible. Everything is subject to the policy’s terms, limits and exclusions.
If it happens to you
Call your insurer early, before paying anyone or wiping systems. Many policies require prompt notice and consent before you spend money, and the insurer may connect you with response firms. Preserve evidence, including the ransom note. CISA says every ransomware incident should be reported to the U.S. government, and that one report to the FBI, CISA or the U.S. Secret Service is enough, because the agencies share it.