Cyber insurance claims process: what happens after a breach

Your accountant calls on a Monday morning to say she can't log in. Your systems team checks the server and finds ransomware sitting across four drives, a demand note on the desktop, and backup files that haven't run since Thursday. The damage is done before anyone thinks to call their broker. A property claim leans on the fire marshal's report to carry the argument; a cyber claim is decided by what you do in the first 24 hours, and whether procedural missteps shrink what you recover before the assessment even begins.

What the cyber insurance claims process involves

The cyber insurance claims process is the sequence of steps activating your policy after a cyberattack or data breach, from the initial notification to your insurer through forensic investigation, incident response, regulatory reporting, and eventual financial settlement. Unlike property claims, a cyber claim runs on several tracks at once: technical, legal, and financial, often simultaneously, which is why understanding the sequence in advance counts as much as having the policy in the first place.

Key Takeaways

• Notify immediately: most cyber policies require notification within 24 to 72 hours of discovering a breach; missing that window can reduce or void your claim.
• Preserve evidence: don't wipe or restore systems before your insurer's forensic team has examined them, even if restoring feels urgent.
• The policy pays for more than losses: cyber cover typically includes crisis response, legal fees, forensic investigation costs, and regulatory fines, depending on your wording.
• South Africa's cyber insurance market is growing fast: the market is valued at around USD 50 million in 2025 and is on track to double by 2030, which means insurer appetite and policy terms are still evolving.
• Settlement depends on documentation: the strength of your cyber insurance claims file, the logs, the contracts, the evidence of your security controls, determines how quickly and how fully a settlement resolves.
• Loss prevention services are part of the product: many policies include pre-breach risk assessments, employee phishing training, and 24-hour incident hotlines at no additional cost.

How the first 24 hours shape your entire claim

The worst thing you can do after discovering a breach is spend the first day trying to fix it quietly. Cyber insurance claims have strict notification requirements built into the policy wording, and those requirements aren't suggestions. Most wordings specify a notification window of 24 to 72 hours from discovery, and "discovery" is interpreted as the moment a reasonable person in your organisation would have understood a breach had occurred, not the moment your IT provider confirms it in writing.

South Africa's cyber insurance market is growing at a compound annual rate of nearly 16%, according to market research on cyber insurance, which means insurers are refining their claims criteria as the local market matures. Early claims are being assessed carefully, and procedural non-compliance is one of the most common reasons a valid cyber claim pays out less than the insured expected.

In practice, the first 24 hours require you to do three things in parallel: notify your broker or insurer through the dedicated cyber claims channel; contain the incident by isolating affected systems without destroying forensic evidence; and document everything, the alert timestamp, the first person notified, the systems affected, and the actions already taken. The policy's incident response panel, a list of approved forensic investigators, legal advisers, and crisis communicators provided by the insurer, activates at this point. Using unapproved service providers before the insurer confirms the panel can result in those costs sitting outside the policy.

The forensic investigation: evidence your insurer needs

Once the insurer is notified, a forensic investigation begins. This is the process of reconstructing what happened, when, how, and through which vulnerability. Think of it as the loss adjuster's equivalent for cyber claims, except the clipboard is a network log, and the floor being walked is your server architecture.

The forensic team, usually appointed from the insurer's approved panel, will look at access logs, firewall records, email server data, endpoint activity, and backup integrity. Their report serves two purposes: it determines the cause and scope of the breach, which drives the quantum of the claim; and it identifies whether the breach originated from a vector the policy covers or one falling under a cyber insurance exclusion, such as a known vulnerability left unpatched after a vendor advisory.

Preserving evidence counts for more than speed. A business wiping and restoring systems on day two, with entirely understandable urgency, may find the forensic team unable to confirm the cause. Without that confirmation, the insurer can't settle the technical components of the claim. According to guidance on cyber insurance claims after a breach, the forensic phase typically takes between two and six weeks for a mid-sized incident, longer where the attacker has been inside the environment for an extended period before the breach was detected.

Regulatory notification: the POPIA clock is running

South Africa's Protection of Personal Information Act, POPIA (the law governing how businesses collect, store, and use personal data), requires the Information Regulator and affected data subjects to be notified of a breach "as soon as reasonably possible" after the responsible party becomes aware of it. That phrase has teeth. The Information Regulator has published enforcement guidance, and delayed notification is treated as a separate compliance failure, independent of the breach.

Your cyber policy's legal response component covers the cost of legal advisers guiding you through the POPIA notification process, drafting the required communications, and liaising with the Information Regulator. It also typically covers the regulatory fines resulting from a breach, up to the limits in your policy schedule, so confirm those limits with your broker before you need them, not after.

The POPIA obligation and the insurer's notification obligation run on different clocks. Meeting one doesn't satisfy the other. A business notifying the Information Regulator on day three but its insurer on day five may find its regulatory compliance record clean and its cyber insurance claim technically late. The South African Insurance Association has noted the financial sector's exposure to regulatory notification risk is one of the fastest-growing drivers of cyber insurance uptake, precisely because the fines are real and the timelines are unforgiving.

What cyber insurance claims actually pay for

A well-structured cyber policy responds to more than the direct cost of a breach. The wording typically covers several categories of loss, and understanding each one before an incident helps you submit a complete claim rather than an undercooked one.

Typical cyber claims cover components by category

The indemnity period for business interruption under a cyber policy works the same way it does under a standard BI policy: it is the clock on how long the insurer pays for lost revenue, and it starts running from the date of the incident, not the date the claim is submitted. If your systems take three weeks to restore but your indemnity period is fourteen days, the last seven days of downtime are yours to carry. Review that period at renewal, because a ransomware recovery unlikely in 2022 is now a documented risk pattern for South African businesses.

Ransomware payments sit in a category of their own. The policy may respond to the payment, but only where the insurer pre-approves it, where payment isn't prohibited under applicable law, and where the forensic team has advised paying is the most practical recovery path. Paying a ransom and then asking the insurer to reimburse it falls outside the policy in most cases.

Submitting the claims file: what your insurer needs from you

Settlement of cyber insurance claims depends on documentation the way a property claim depends on the loss adjuster's report. A disorganised claim file extends the assessment period and gives an underwriter legitimate reasons to query quantum. A well-built file accelerates the process.

The core documents most insurers require are: the initial breach notification and timeline; the forensic investigator's report; evidence of business interruption losses, including revenue figures for the equivalent period in the prior year and for the affected period; invoices for approved incident response costs; legal and regulatory correspondence; and evidence of the security controls in place at the time of the breach.

That last item is worth dwelling on. Cyber policies are underwritten on the basis of the security posture declared in the cyber insurance questionnaire at inception. If the forensic report reveals multi-factor authentication wasn't deployed across remote access points, despite the questionnaire indicating it was, the insurer may treat that as a material misrepresentation. A reduced settlement or a repudiation on that ground isn't uncommon in markets where cyber claims experience is maturing, and South Africa's market is maturing fast. Guidance for managed service providers navigating client breach claims consistently identifies the gap between declared controls and actual controls as the primary friction point in claims assessment.

Loss prevention services: the part of your policy nobody uses

Most cyber policies include pre-breach services alongside the claims mechanism, and most policyholders never use them. These services are part of what you've paid for. They include vulnerability scanning, employee phishing simulation, dark web monitoring for your domain and credentials, and access to a 24-hour incident hotline staffed by cyber specialists.

The incident hotline is particularly relevant to the claims process. When your accountant calls on that Monday morning, the first call should go to the hotline, not the IT helpdesk. The hotline connects you to the insurer's response team, starts the notification clock correctly, and ensures the approved forensic panel is engaged before any remediation begins. Using it also creates a timestamped record of when you reported, which protects you against any later argument about notification timing.

The SAIA's analysis of cybersecurity threats facing the financial services sector notes proactive loss prevention remains underused relative to its potential, and businesses drawing on insurer-provided pre-breach services report materially better claims outcomes. Whether the relationship is causal or correlational is a debate for actuaries; from a practical standpoint, using the tools you've already paid for before an incident reduces the likelihood of needing the claims process at all.

When claims take longer than expected

Cyber insurance claims settling quickly share a common profile: early notification, preserved forensic evidence, complete documentation, and security controls matching what was declared at inception. Claims extending for months typically diverge from that profile at one or more points.

The most common delay factors are: a notification submitted outside the required window; a forensic gap caused by premature system restoration; a quantum dispute where business interruption figures lack supporting documentation; and a coverage question about whether the breach vector falls inside or outside the policy's defined cyber perils. That last factor is where cyber insurance exclusions become relevant: social engineering losses, nation-state attacks, and infrastructure failures are areas where policy wording varies substantially across the market.

The settlement process, once the forensic report is complete and the claims file is submitted, typically runs four to eight weeks for a straightforward mid-market claim. A large or disputed claim involving regulatory proceedings, third-party liability, and business interruption running across an extended indemnity period can take considerably longer. An experienced cyber insurance broker, one who has worked claims through to settlement rather than simply placed policies, is worth considerably more at that stage than a premium saving found elsewhere.

After the breach, before the next one

The claim settling isn't the end. Most cyber insurers conduct a post-loss review, and the findings feed directly into your next renewal. A business suffering a ransomware attack and recovering with solid incident management may find its renewal terms broadly unchanged. A business where the forensic report revealed systemic control failures may find the market considerably less welcoming. The claims process, properly navigated, is also an audit of your security posture, one the insurer has now paid for, and the results belong to both of you.

Key takeaways from a claim gone wrong

The scenario playing out for too many South African businesses follows the same pattern: the breach happens, the IT team responds before the broker is called, systems are restored before the forensic window closes, and the claims file arrives incomplete. The insurer has grounds to reduce the settlement, the indemnity period runs short, and the business carries losses the policy was supposed to absorb. Your cyber insurance claim is decided as much by your first hour of response as by the wording you signed at inception. Structure your incident response plan around the policy, not around what feels natural in a crisis, and the process runs considerably closer to what you paid for.

You shouldn't have to learn the cyber insurance claims process at 2 am with ransomware on your server. With Mont Blanc Financial Services you won't.

Contact Mont Blanc Financial Services to have your cyber policy reviewed against your actual risk profile, your incident response procedures tested against what the wording requires, and your claims obligations understood well before you need to meet them.

The questions below are the ones South African business owners most often ask when they start thinking seriously about what happens after a breach. If your own question isn't here, it's almost certainly one worth putting to your broker before you need the answer urgently.

Frequently Asked Questions

What is the track record of cyber insurance companies for paying cyber insurance claims?

Cyber insurance claims payment rates vary by insurer, policy wording, and how well the insured met their notification and documentation obligations. Globally, the cyber insurance market has seen growing claims volumes alongside growing scrutiny of policy conditions. Insurers specialising in cyber with dedicated in-house claims teams tend to produce faster and more complete settlements than generalist insurers offering cyber as an add-on product. In South Africa, the market is relatively young and published claims data at insurer level is limited. The most reliable indicator of an insurer's claims track record for cyber is the experience of brokers who have worked claims through to settlement with that insurer, not the marketing material. When evaluating a cyber policy, ask your broker for concrete examples of claims they have managed with that insurer, how long settlement took, and what the friction points were. A broker who can't answer those questions with specifics hasn't managed enough cyber claims to be your first call at 2 am.

Is there a 24/7 dedicated number for cyber insurance claims?

Most specialist cyber policies include a 24-hour incident response hotline as a standard policy feature, not a premium add-on. The number is typically listed on your policy schedule or in a separate incident response card issued at inception. Save it in your phone and in your incident response procedure document before you need it. The hotline connects you directly to the insurer's cyber response team, which can include forensic specialists, legal advisers, and crisis communications consultants. Calling that number the moment you discover a breach starts the notification clock correctly, triggers the approved response panel, and creates a timestamped record protecting you against any later dispute about when you reported. Don't call your IT helpdesk first and your insurer second. The sequence counts, and the policy wording reflects that priority clearly. If your current cyber policy doesn't include a 24-hour response hotline, that gap is worth raising at the next renewal conversation with your broker.

What loss prevention services does a cyber insurance policy include?

Loss prevention services under a cyber policy typically include vulnerability scanning of your internet-facing systems, employee phishing simulation exercises, dark web monitoring for your business domain and credential sets, access to pre-breach legal guidance, and the 24-hour incident hotline. Some insurers also offer post-incident cyber hygiene reviews at no additional cost. These services are included in the premium you're already paying, and they reduce both the likelihood of a breach and the severity of one occurring. The underwriting rationale is straightforward: an insurer paying breach response costs has a direct financial interest in your security posture improving. Use these services actively, not because your insurer will reward you for it at renewal (though a cleaner risk profile helps), but because a phishing simulation catching ten employees before an attacker does is cheaper than a forensic investigation after one succeeds. Ask your broker for the full list of pre-breach services your current policy includes, because most policyholders are using fewer than half of what they've paid for.

Do cyber insurers have dedicated claims teams, and where are they based?

Specialist cyber insurers operate dedicated cyber claims units, often staffed by professionals with backgrounds in digital forensics, technology law, and incident response rather than general insurance claims handling. In South Africa, most of that specialist capacity sits with the Lloyd's market, international specialty insurers with local underwriting presence, and a small number of domestic insurers investing in cyber-specific claims infrastructure. The practical implication for your business is the claims team handling your breach may be based in Johannesburg, London, or both, with local legal and forensic panel firms engaged on the ground. What counts is whether the panel firms are pre-approved, locally present, and available within hours of notification, not where the claims manager's desk sits. When reviewing a cyber policy, confirm with your broker the insurer's South African incident response panel is established, panel firms are local, and the 24-hour hotline connects to someone with authority to engage the panel immediately, not to a call centre routing your call to a general queue.