ClaimPro^®

It depends. Most ransomware encryptions are essentially unbreakable, so if someone says they “reverse engineered” or “created an algorithm” to decrypt the files, it probably is not true. In ClaimPro’s experience these parties often pay the ransom but then misrepresent how they got the data back, marking the cost up significantly while falsely suggesting that ransom payment was avoided. ClaimPro’s extensive experience and one-of-a-kind resources can help figure out whether ransom payment is (or was) needed to get the data back. And ClaimPro’s unique expertise also helps weigh potential options for restoring data instead of making a ransom payment, allowing the best possible decisions to be made.

Since ransom payments typically must be made via untraceable virtual currency such as Bitcoin, the risk of “getting ripped off” can be high (particularly if an insured or insurer chooses to directly engage a hacker or cybercriminal). ClaimPro’s proprietary resources and familiarity with numerous ransomware variants allows informed decisions to be made before a potentially dubious payment is made. ClaimPro also has established relationships with the top 3^rd party decryption service companies, who can transparently and safely assist with ransom negotiation and payment if needed.

Generally, ransomware and other virus/malware infections do not cause actual physical damage to hardware. On the other hand, since software and data files typically are manipulated by such infections, in ClaimPro’s experience most insurers consider those aspects susceptible to claim-related damage. Potential coverage will depend on policy language, but ClaimPro can help sort everything out based on the individual loss circumstances and coverage particulars under any scenario.

From a strict damage standpoint, it is usually not necessary to replace hardware just because a ransomware or other virus/malware infection occurred. And typically, software users have the right to restore their rightfully licensed versions without having to purchase an entirely new program or license. However these loss circumstances can bring challenges related to hardware and/or software obsolescence, discontinuation and/or non-support status, or other such factors based on a product’s inherent characteristics even before the loss occurred. ClaimPro’s wide-ranging experience and expertise – and extensive knowledge of hardware, software and data – are invaluable in helping sort out which items (if any) might warrant replacement consideration.

In some cases, yes. However, all factors need to be considered in order to make proper decisions in line with policy guidelines. Many policies simply cannot consider hardware replacement as part of a ransomware or other cyber loss, where physical hardware damage is not sustained. At the same time, if an insured legitimately spent less doing so than it would have cost to restore, then that needs to be taken into consideration. ClaimPro will help evaluate all aspects to make the most accurate decisions in any loss or coverage circumstance.

The constantly increasing prevalence of cloud-based solutions and other remotely hosted IT environments means that not all equipment or software/data is always at an insured’s physical location. This can impact potential coverage and subrogation possibilities, but ClaimPro will ask all the right questions and ClaimPro’s exclusive Pre-Forensics™ services can collect the additional details needed for proper determination.

If the remediation or restoration process is not done properly (and sometimes even when it is), re-infection or other recurrence is definitely possible. Even though the original loss event may be long over with when this happens, it can lead to questions about what happened and whether such additional damage should be classified as a separate claim event. ClaimPro and its exclusive Pre-Forensics™ services can help figure out what went wrong even after the fact, allowing any additional damage to be properly categorized for the insurer. ClaimPro can also work with the insured and their IT resources during the process to ensure that proper steps are followed, thereby minimizing the risk of such scenarios in the first place.

When a cyber or ransomware loss occurs, impact is often widespread affecting multiple facets of an insured’s operations. This inter-connection and the inherent complexity of variables can lead to uncertainty about what really happened, and potential difficulty determining causation. No matter the circumstances, ClaimPro can properly sort out the claim and whether multiple losses occurred, and ClaimPro’s exclusive Pre-Forensics™ services often provide the final answers needed.

Nearly always, restoring an insured back to pre-loss condition does not require the purchase of anything they did not already have when the loss occurred. If software was affected, those programs can typically be reloaded or otherwise restored without the need for a new purchase. But depending on the circumstances, for some ransomware/malware variants it has been established that purchasing certain programs may help ensure that all loss-related damage is completely eradicated. ClaimPro can help make the proper determination about potential inclusion of these costs as part of a claim, and document accordingly why or why not.

Again, restoring pre-loss condition means getting an insured as closely as possible back to the same position they were in before the loss occurred. Logically though, this can involve placing an insured into a situation where they may be susceptible to additional loss or damage. Each situation needs to be evaluated on a claim-by-claim basis to accurately determine proper measure of loss-related cost in line with policy and coverage stipulations. ClaimPro’s exclusive Pre-Forensics™ services can also perform vulnerability assessments if needed.

Depending on the policy and coverage, this can be an important question and in ClaimPro’s experience, one that may be up for debate. ClaimPro’s exclusive Pre-Forensics™ services will help narrow down basic details, and often yield sufficient answers allowing an informed coverage decision to be made. On the other hand, if a more comprehensive analysis is needed about how the attack occurred and whether the insured was targeted, ClaimPro has access to key forensics resources who can be considered. ClaimPro can also arrange and coordinate the engagement of full forensics analysis as needed.

For a variety of reasons, some losses require more comprehensive forensic analysis and/or digital investigation to figure out exactly what happened. For instance, sometimes it needs to be established whether data may have been exfiltrated and/or sensitive information compromised. These types of investigations can be costly, but ClaimPro’s unique access to multiple forensics and cybersecurity resources facilitates competitive pricing and fosters the ability to objectively compare multiple options depending on the situation. And as an alternative before engaging full forensics, ClaimPro’s exclusive Pre-Forensics™ delivers a more basic, cost-effective initial analysis where findings may be adequate for a loss determination to be made without the need for additional expense.

This answer can vary depending on nature of the data and what industry the insured is in, and very often requires careful higher-level forensics. In particular, the compromise of medical/health or financial-related data stipulates certain compliance actions which may or may not be covered by the insured’s policy. ClaimPro’s exclusive Pre-Forensics™ services, and relationships with the leading forensics companies, allow insurers access to the complete range of possibilities no matter what the loss situation.

In those instances, a subrogation referral may be justified; but it is also important to objectively consider all factors of the situation and what occurred leading up to the loss. For instance, vulnerable software and/or operating systems are often culprits in facilitating this type of attack. In those instances, establishing an accurate timeline and documenting the sequence of events can be critical. ClaimPro’s exclusive Pre-Forensics™ services can accurately gather key details about potential responsibility and how the vulnerability may have happened, and also help determine whether more extensive forensic analysis may be needed.

With nearly 30 years of experience and thousands of successfully completed claim evaluations, ClaimPro has highly specialized knowledge and the capability to properly evaluate this important question. By recognizing exactly what to ask for and discussing with the involved parties as needed, ClaimPro can accurately review everything and make the right determination every time.

It can sometimes be difficult to discern what should or should not be considered as part of the final claim loss & damage estimate. Often during the course of restoration/remediation, additional work ends up being done which may fall outside the scope of “restoring pre-loss condition”. This work may be worthwhile and/or prudent business decisions made by an insured and their IT vendor. However, it is important regardless to accurately determine proper measure of cost associated with necessary loss-related work only – without avoidable improvement or upgrades, optional hardware or software replacement, or other such costs outside the scope of the claim. ClaimPro delivers reliable, consistently accurate estimates leading to fair settlements and cost control.

Some cyber policies afford more broad coverage potentially encompassing forensics, legal services or even credit monitoring when personal data has been compromised. But other polices are more limited in scope, where it is critical to properly identify and accurately categorize each cost component in order to make the right claim loss & damage determination. ClaimPro’s extensive experience and exclusive resources mean dependable results in any loss or coverage circumstance.

This important question can dictate potential coverage and may also impact potential subrogation. Therefore, it is imperative to make an accurate and objective evaluation from the outset. ClaimPro’s familiarity with the full cyber claims landscape, and ability to work seamlessly with all parties on a loss, gives insurers a valuable resource for proper claim loss & damage determinations. ClaimPro’s exclusive Pre-Forensics™ services can dig even deeper if needed, and help figure out what happened and how.

Unfortunately, this question typically comes up only after a loss has occurred, but can be important in determining potential coverage, responsibility and/or subrogation possibilities. ClaimPro’s objective methodology and exclusive Pre-Forensics™ services help gather the details needed to make the correct determination.

In the current computer and IT landscape with so many options available to insureds, there is really no reason cyber loss-affected data shouldn’t be restorable via backup. But the reality is, often there are issues with data backups that aren’t known until it’s too late. Figuring out what went wrong gives insurers valuable information allowing accurate coverage and subrogation decisions to be made. ClaimPro’s consistent procedures and exclusive Pre-Forensics™ services can provide all the key details needed.