Ransomware at Month-End: Pay, Rebuild, or Both
A 900-employee specialty chemical distributor's ERP is encrypted by ransomware on day three of month-end close. Backups exist, but the most recent immutable copy is nine days old, and the on-premise replication target sits on the same domain as production. The company carries a $5 million cyber policy with a $250,000 retention, a $1 million sublimit for contingent business interruption, and a $1.5 million ransomware sublimit. The threat actor demands $1.8 million in cryptocurrency within 72 hours and has posted sample customer invoices. Two customers representing 22% of revenue require EDI connectivity restored within one week or they will invoke supply penalties. The CFO wants to pay and restore quickly.
1. Frame the pay-versus-rebuild decision. Which factors dominate, and how does the policy structure change the economics?
Read the worked answer
Reject the binary first. Paying and rebuilding are not mutually exclusive, and the 72-hour deadline is a negotiating device. The decision to make now is how to run both tracks in parallel and what criteria would cause you to authorize a payment.
Factors that dominate, in order:
- Legality and sanctions. Screen the wallet and actor against sanctions lists before any transfer. Paying a sanctioned entity is a legal exposure that dwarfs the ransom, and no insurer will indemnify it.
- Whether payment actually restores operations. Decryption tools are frequently incomplete or deliberately defective, and the actor has already demonstrated double extortion by posting invoices. Payment buys a decryption key, not silence and not uptime.
- Insurance mechanics. The $1.8 million demand exceeds the $1.5 million ransomware sublimit, leaving at least $300,000 uninsured before the retention is applied. Insurer consent is typically a condition of coverage for a voluntary payment; paying without it risks the claim. Confirm how the retention applies across sublimits.
- The real recovery path. A nine-day-old immutable backup is a workable recovery point for an ERP; the pain is nine days of transactions to reconcile and re-established EDI. That is measured in days, not months, which materially weakens the actor's leverage.
- Customer exposure. Quantify the 22%-of-revenue supply penalties against the $1 million BI sublimit. If the penalties exceed the sublimit, recovery speed is worth more than the ransom.
Recommended framing: engage breach counsel and a forensics firm, begin restore-and-reconcile targeting EDI connectivity first, open a negotiation to buy time, and pre-clear a contingent payment decision with the insurer and counsel with explicit criteria and a decision point at roughly 36 hours.
2. You have $600,000 post-event for controls. Allocate it and justify the priorities, including why not simply buying more limit is the wrong first move.
Read the worked answer
Diagnose before allocating. This loss was amplified by two specific failures: a nine-day recovery point objective and backups that were reachable from production. Those are cheap relative to the damage they caused, and they are exactly what additional limit would not fix.
| Priority | Approx. cost | Why |
|---|---|---|
| Immutable, offline backup architecture with tested restore; reduce RPO from 9 days to under 24 hours | $180k | Directly addresses the amplifier; converts future events from existential to inconvenient |
| Identity hardening: MFA everywhere, privileged access management | $120k | Most ransomware paths begin with credentials; highest frequency reduction per dollar |
| EDR plus segmentation of IT and OT environments | $150k | Limits lateral movement and protects plant systems that were not designed to be patched |
| IR retainer, tabletop exercise, documented manual EDI fallback | $80k | Buys speed and pre-agreed decisions at the moment when both are scarcest |
| Phishing simulation and awareness | $70k | Cheap, maintains the human layer |
Why not buy limit first: higher limits do not shorten a nine-day RPO, do not restore EDI, and underwriters increasingly require the controls anyway before offering meaningful capacity or sublimits. You would be paying a recurring premium for a financing answer to an operational problem. Buy limit second, at renewal, once the controls exist and can be evidenced to the underwriter at a better price. The exception is if the board specifically wants to raise the $1.5 million ransomware sublimit to match realistic extortion demands; that is a legitimate financing decision, but it should be made after the control spend, not instead of it.
3. The board asks whether the $5 million program was adequate. What do you tell them, and what does the event reveal about how the program was structured?
Read the worked answer
The headline limit is misleading, and that is the finding. A $5 million limit does not mean $5 million of protection for an event like this one; sublimits stack and do not aggregate back to the headline.
Walk the board through the actual recoverable amount for this scenario:
- Ransomware response is capped at $1.5 million against a $1.8 million demand, so the gap is at least $300,000 before the $250,000 retention is applied, and the retention may apply again to the broader loss.
- Contingent BI is capped at $1 million against customers representing 22% of revenue with contractual penalties. Model the penalty exposure against that sublimit rather than assuming it is adequate.
- Restoration costs, forensics, and counsel usually sit inside their own sublimits with their own retentions; confirm which sublimit each invoice draws on and whether they share a single aggregate.
What the structure reveals: the program was bought by limit and price rather than built from scenarios. Nobody had asked what a realistic ransomware event costs end to end, so the sublimits were set to market convention. There is also no evidence the program was tested against a single-point-of-failure scenario.
Recommendations: re-underwrite against three or four named scenarios; re-market at renewal with the new controls as evidence; consider whether the retention is set where the company can genuinely absorb two events in one year; and report sublimit adequacy to the board annually, in dollars, per scenario.