Recently, a ransomware attack, known as the “Petya” cyberattack, spread from Ukraine to more than 60 countries, and shut down major shipping companies, a pharmaceutical company, an airline booking company, hospitals in Pennsylvania, a major international law firm and even a Cadbury chocolate factory in Australia. This comes only a month after the “WannaCry” malware attack, one of the worst and most widespread cyberattacks, which affected over 200,000 victims in at least 150 countries, including Britain's National Health Service, FedEx and automakers Renault and Nissan. A ransomware attack, like the Petya and WannaCry attacks, disables the user's computer system and all its data. A note in a text file then appears stating that in order to unlock the computer and access its data, a ransom must be paid, typically in the form of Bitcoin. The hackers threaten to delete all data on the computer system if payment is not sent.

These attacks, which are expected to be on the rise, are a reminder of the importance of cyberinsurance coverage. It is estimated by risk-modeling firm Cyence that the recent Petya and WannaCry attacks will result in $8 billion in economic losses. Businesses affected by these types of attacks can incur significant loss, including for the ransom amount, resulting business interruption, the cost of any lost data, damage to customers and other third parties, and associated public relation expenses. Most commercial general liability policies and property policies exclude coverage for cyber-related losses. Thus, it is important for businesses to ensure they have comprehensive coverage for cyber-related attacks.

To be covered for ransomware attacks, cyberinsurance policies should explicitly include coverage for cyberextortion, including for the payment of ransom to unencrypt data and restore network access after an attack has already occurred—not just to prevent a potential future attack. Most policies only cover “threats” to commit an attack, and do not explicitly cover ransom to unencrypt data after unauthorized access has already occurred. Additionally, it is important to ensure that this coverage includes expert and consultant costs for responding to the threat. In some instances, paying the ransom amount may not be enough and a “kill switch” for the malware software may be necessary to stop the attack. After the attack, investigation costs may be necessary to determine why the business' network was vulnerable in the first place and to determine the source of the attack. It is also essential that coverage for cyberextortion provide for the payment of ransom in the form of Bitcoin or other digital currency.