Coverage description
Cyber extortion coverage addresses threats to damage, disclose, encrypt, or deny access to systems or data unless money or another demand is paid. Definitions of a cyber extortion threat can differ between professional liability and homeowners products.
Coverage classification
- Form type
- Endorsements
Compare Cyber extortion coverage forms
| Form | Intent | Threat | Conditions |
|---|---|---|---|
The Hanover Insurance CompanyCyber Extortion Coverage 915-1127 01/20 Professional Errors and Omissions Liability | Defines a cyber extortion threat for coverage purposes. | Threats involving system access, data or services. | Requires a payment demand as a condition of mitigating or removing the threat. |
Stillwater Insurance CompanyHome Cyber Protection Coverage Cyber Attack, Cyber Extortion, Online Fraud, Data Breach and Cyberbullying SP2002 02 26 Homeowners | Adds home cyber protection, including cyber extortion coverage. | A demand for money or other consideration involving a computing or connected home device. | The event must be discovered during the policy period and reported as specified, including a 60-day deadline. |
Hartford Fire Insurance CompanyCyber Extortion Loss Amended - Pay or Reimburse CB 00 H069 00 0225 Cyber Liability | Amends the cyber extortion insuring agreement so the insurer will either pay or reimburse extortion payments. | A cyber extortion threat first made against the organization during the policy period and reported to the insurer. | Payments, including bitcoin and cryptocurrencies, need prior written consent, must be insurable and remain subject to sanctions. |
Atlantic Specialty Insurance CompanyAmend Definition of Extortion Payments and Rewards OBTI PR 321 09 20 Cyber Liability | Amends the definition of extortion payments and rewards to condition ransom payments and add informant rewards. | Payment to someone who commits extortion, or a reward for information leading to the identification and arrest of that person. | Requires written approval, a designated vendor, a prior report to law enforcement and no disclosure of the coverage; rewards cannot exceed the demand. |
Travelers Casualty and Surety Company of AmericaCyber Extortion Event Endorsement CY-F-026 Ed. 10-26 Cyber Liability | Adds a separate limit, retention and coparticipation for cyber extortion event loss under the CyberRisk coverage. | All loss arising out of a cyber extortion threat or the encryption of a computer system. | The insured pays a scheduled coparticipation share above a separate retention; the limit is within and reduces the CyberRisk aggregate. |
Notable clauses
“where there exists a demand for an extortion payment”
The Hanover Insurance Company · Cyber Extortion Coverage · 915-1127 01/20
Payment demand. The threat definition includes an extortion payment demand.
“A demand for money or other consideration based on a credible threat”
Stillwater Insurance Company · Home Cyber Protection Coverage Cyber Attack, Cyber Extortion, Online Fraud, Data Breach and Cyberbullying · SP2002 02 26
Demand and threat. The event definition includes demands based on a credible threat to the insured’s device, system or data.
“Extortion Payments will also include any reasonable and necessary expenses incurred in order to facilitate, mitigate or negotiate any actual amount paid to satisfy the Cyber Extortion Threat.”
Hartford Fire Insurance Company · Cyber Extortion Loss Amended - Pay or Reimburse · CB 00 H069 00 0225
Negotiation expenses. The payment definition covers the costs of facilitating and negotiating the ransom as well as the ransom itself, which the insurer may pay directly or reimburse.
“As a reward, to someone who provides information that leads to the identification and arrest of one who commits extortion”
Atlantic Specialty Insurance Company · Amend Definition of Extortion Payments and Rewards · OBTI PR 321 09 20
Informant rewards. Rewards for information leading to an arrest are payable alongside ransom, but not to employees or insureds and never above the extortion demand or amount paid.
“You previously reported the extortion to applicable law enforcement or regulatory agencies;”
Atlantic Specialty Insurance Company · Amend Definition of Extortion Payments and Rewards · OBTI PR 321 09 20
Law enforcement report. A ransom payment qualifies only if the extortion was already reported to law enforcement or regulators, a condition the Hartford and Travelers wording does not state.
“The Insured will pay the Coparticipation percentage of Cyber Extortion Event Loss shown in the Cyber Extortion Event Loss Schedule in excess of the Retention.”
Travelers Casualty and Surety Company of America · Cyber Extortion Event Endorsement · CY-F-026 Ed. 10-26
Coparticipation. Unlike the other forms, the insured shares each extortion loss above its own retention at a scheduled percentage, under a limit that erodes the CyberRisk aggregate.
Market activity
Matching form records, product lines, state activity, and recent examples for this coverage language.
Matching form records
Recent records
Product submissions
Companies
Insurance forms library
Related insurance form pages
Related coverage topics
A ransomware endorsement names ransomware and changes how a cyber policy treats it without being an exclusion form. Compares Palomar and Corgi forms; 24 insurers file it.
Ransomware exclusionA ransomware exclusion names ransomware and excludes or limits ransomware loss, extortion threats and related expense. Compares four insurers' forms; 15 insurers file it.
Artificial intelligence exclusionAn artificial intelligence exclusion limits coverage for claims involving AI systems, generative tools or outputs. Compares four insurers' forms; 47 insurers file it.
Cyber exclusionA cyber exclusion limits coverage for loss or liability from cyber incidents, malicious code or system intrusions. Compares two insurers' forms; 452 insurers file it.
Crypto and digital assets exclusionThis exclusion limits coverage for cryptocurrency, tokens, digital wallets and blockchain transactions. Compares two insurers' forms; 57 insurers file it.
Social engineering fraud coverageSocial engineering fraud coverage pays loss when impersonation or false instructions trick staff into sending funds. Compares four insurers' forms; 49 insurers file it.
Data breach coverageData breach coverage pays costs or liability after unauthorized access to or loss of protected information. Compares two insurers' forms; 90 insurers file it.
Funds transfer fraud coverageFunds transfer fraud coverage pays loss from fraudulent instructions to transfer money or securities. Compares Beazley and Next Insurance forms; 76 insurers file it.
More cyber coverage topics
- Access or disclosure exclusion
- Biometric privacy exclusion
- Computer fraud coverage
- Data privacy law violation exclusion
- Electronic data exclusion
- Electronic data liability
- Identity recovery coverage
- Intellectual property exclusion
- Network security liability coverage
- Recording and distribution exclusion
- Split retroactive date
- System failure coverage
- War exclusion
- Worldwide coverage territory