Cyber Insurance Claims: What to Do When Your Business Is Hit by a Cyber Incident

Cyber incidents can affect any business that uses email, online payments, customer data, cloud systems, operational software, or connected devices. A cyber-attack can stop trading, expose sensitive data, disrupt payments, damage customer trust, and create a complex insurance claim at the same time.

Cyber insurance is designed to help businesses respond to these events and recover from the financial impact. Policies can cover costs linked to incident response, legal support, forensic investigation, data recovery, business interruption, customer notification, PR support, and in some cases third-party claims or regulatory issues. The exact cover will depend on the wording of the policy.

For many businesses, the challenge starts when the incident happens. A cyber claim can move fast, involve several parties, and require clear evidence from the outset. Major Loss can step in to manage the insurance claim on your behalf, helping you understand what is covered, what evidence is needed, and how to keep the claim moving.

What counts as a cyber insurance claim?

A cyber insurance claim is a formal request made to an insurer after a cyber incident causes loss, damage, disruption, or liability. This could include a direct financial loss, a period of business interruption, the cost of restoring systems, the cost of expert support, or a claim made by a third party after data has been exposed.

Common cyber incidents include:

• Ransomware, where systems or data are locked until a payment is demanded.
• Business email compromise, where criminals gain access to email accounts or impersonate staff, suppliers, or directors.
• Funds transfer fraud, where payments are diverted to a criminal account.
• Data breaches, where personal, client, employee, or commercial data is exposed.
• System outages caused by a cyber event, which can prevent a business from trading.

Coalition identifies ransomware, business email compromise, and funds transfer fraud as common cyber-attacks that lead to insurance claims.

Why cyber claims can be complex

Cyber insurance claims are often more complex than standard business interruption claims because the loss is rarely limited to one obvious area. A single incident may involve IT systems, legal duties, customer data, lost income, extra operating costs, supplier disruption, and reputational risk.

There may also be urgent steps to take before the full loss is known. The insurer may need forensic reports, system logs, incident reports, invoices, legal correspondence, communication records, and proof of financial loss. Business interruption losses may need a clear link between the cyber incident and the loss of revenue or extra expense.

Policy terms also matter. Cyber policies vary, and cover can differ across first-party losses, third-party claims, exclusions, limits, excesses, notification rules, and insurer-approved suppliers. Prompt notification and accurate documentation are key parts of the claims process.

What to do if your business suffers a cyber incident

The first step is to avoid making the situation worse. Do not try to resolve the issue without checking the terms of your policy and the insurer’s incident response requirements. Many cyber insurance policies include access to an emergency response team or a 24/7 incident line.

You should also contact your broker or insurer as soon as possible, then contact Major Loss so we can help manage the claim from the beginning.

Key steps include:

• Notify your insurer or broker promptly.
• Contact Major Loss for claims management support.
• Record what happened, when it was discovered, and what systems or data may be affected.
• Preserve evidence, including emails, system logs, screenshots, payment records, ransom notes, IT reports, and internal communications.
• Keep a record of all downtime, lost revenue, extra costs, and recovery spend.
• Do not delete files, reset systems, or pay any demand without proper guidance.
• Follow the insurer’s instructions on forensic investigation, legal advice, PR support, and regulatory notification.
• Check whether the incident may need to be reported to the ICO or other relevant bodies.

The earlier the claim is handled in a structured way, the easier it is to evidence the loss and reduce avoidable disputes.

How Major Loss can help

Major Loss manages complex and high-value insurance claims on behalf of policyholders. In a cyber claim, our role is to help you deal with the insurance process while you focus on stabilising the business.

We can help by reviewing the policy wording, identifying relevant areas of cover, managing insurer communication, coordinating the evidence needed for the claim, tracking business interruption losses, and helping present the claim clearly.

Where insurers appoint experts, loss adjusters, forensic specialists, lawyers, or other parties, Major Loss can help manage the flow of information and ensure the claim remains focused on the policyholder’s position.

This can be especially important where the claim includes disputed cover, delayed settlement, complex financial losses, business interruption, third-party liability, or concerns around exclusions.

What evidence may be needed for a cyber insurance claim?

Every claim is different, but insurers may ask for:

• A written timeline of the incident.
• Details of when the issue was first discovered.
• System logs, forensic reports, or IT investigation findings.
• Copies of suspicious emails, ransom demands, or fraudulent payment instructions.
• Evidence of affected systems, files, accounts, or data.
• Records of downtime and operational disruption.
• Financial records showing lost income.
• Invoices for IT recovery, legal advice, PR support, customer notification, or temporary operating costs.
• Copies of communication with customers, suppliers, regulators, or affected parties.
• Details of any steps taken to contain the incident and reduce further loss.

Accurate documentation helps the insurer assess the claim and can reduce delays.

What if the insurer rejects the claim?

Cyber insurance claims can be declined for several reasons. Common issues include late notification, missing evidence, policy exclusions, failure to follow policy conditions, or disagreement over whether the loss falls within the cover.

A rejected claim does not always mean the matter is closed. The policy wording, insurer’s reasoning, evidence, and timeline should all be reviewed. In some cases, further evidence or clarification can support a challenge or complaint.

Major Loss can help review the position and support the policyholder through the next steps.

Cyber claims need fast action and clear management

A cyber incident can create pressure across the whole business. Systems may be down, customers may need answers, staff may be unable to work, and financial losses may start to grow.

The insurance claim needs the same level of control. Early action, clear records, and proper claims management can make a significant difference to how the claim progresses.

If your business has suffered a cyber incident, contact Major Loss as soon as possible. We can manage the insurance claim on your behalf, help gather the right evidence, and work to secure the settlement you are entitled to under your policy.