Does cyber insurance cover ransomware in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What does a typical Indian cyber policy cover?

Four blocks, and the named sub-limits matter more than the headline figure. First, incident response costs: forensics, legal advice, crisis communication and the responder's time, usually sub-limited per incident. Second, restoration and data recreation: the cost of rebuilding systems and restoring data, which is where the money often goes, and which is lower if you have good backups. Third, business interruption: lost gross profit and continuing costs during the outage, which for a small business with thin margins can be the largest block. Fourth, third-party liability, covering claims from customers whose data was exposed, and regulatory defence costs. Some policies add a ransom sub-limit, and some exclude ransom entirely. A policy for a small Indian business is commonly priced in the low lakhs of rupees of annual premium, with sub-limits in the lakhs per incident.

Why do claims get declined?

Four reasons dominate. Late notification, which is the most common by a wide margin, because policies usually require notification as soon as practicable and often within 48 hours. Failure to meet the stated controls, for example a policy that requires enforced MFA, offline or immutable backups and endpoint detection, where a breach shows those were not in place. Scope creep, where the activity was a deliberate policy violation, an unauthorised payment channel or use of a recovery service the insurer has not approved. And misrepresentation at application, where the answers about controls were not accurate. The pattern is consistent across markets: the claim is usually not defeated by the attack, it is defeated by the paperwork around it.

What should I check before buying a policy?

Nine things, and the first three decide most of it. Whether ransom payment itself is covered, and whether the sub-limit is realistic for your business size. Whether the control requirements are things you can evidence today, and whether they would be re-checked on renewal. The per-incident sub-limit and the aggregate annual limit, because a small business may find the per-incident limit is far below its rebuild cost. The notification window and the exact clock it starts from. Whether you have to use the insurer's panel, and what happens if the first responders are chosen for you. Whether business interruption is calculated on gross profit and what the indemnity period is. The excess or deductible, because a Rs 2 lakh excess on a Rs 5 lakh claim is a very different policy. How the policy treats a pre-existing breach, and whether you have to declare one. And whether the insurer's claims process is realistic for your size of business.

Does buying insurance change what I do in an incident?

Yes, and this is where policyholders lose cover by accident. Notify immediately, even if you think it is a false alarm or a minor incident, because late notification is the leading cause of decline. Use the panel or get written consent before engaging a non-approved forensic team, and keep every invoice. Do not wipe, reimage or restore until the insurer or its panel has scoped it, because the state of the machines is evidence. Do not pay a ransom without written insurer consent, both because it may not be covered and because a payment can create legal exposure. Keep evidence of the controls the policy requires, such as MFA enforcement reports, backup test records and EDR coverage, and store it where you can produce it in a day.

What are the frequently asked questions?