Ransomware at a platform provider, a 31-hour outage and a cyber policy with exclusions

Gross loss £1.8m lost commissions + £450,000 recovery costs + £220,000 legal and notification = £2.47m.

Business interruption element The policy has a 12-hour waiting period. On a simple assumption that lost commissions accrue evenly over the 31-hour outage, the recoverable period is 19 hours: 19/31 × £1.8m = £1.10m. That is below the £2m contingent business interruption sub-limit, so the sub-limit does not bite on this calculation, but the waiting period does.

Other costs Assume recovery costs and legal/notification costs are covered in full: £450,000 + £220,000 = £670,000. Applying the £500,000 deductible: £1.10m + £0.67m − £0.50m = £1.27m.

Coverage gaps and sensitivities

• If lost commissions were concentrated in the first hours, the waiting-period deduction would be larger.
• The exclusion for a third party's failure to maintain security patches is potentially fatal to the whole claim if the insurer can show Cobalt failed to patch. The exclusion is the key issue, not the deductible.
• Legal and notification costs may be subject to their own sub-limits or exclusions for regulatory investigations.
• The policy limit of £10m is not the constraint here; the constraints are the waiting period, the deductible and the exclusion.

Conclusion At best, recovery is around £1.27m of £2.47m, or about 51%, and it could be much lower or nil if the exclusion applies. The broker should not treat the policy as covering the event until coverage counsel has reviewed the patch-management facts.

Insurance is not a substitute for resilience. The policy may transfer some financial loss, but it does not restore the order management system, protect clients from delayed orders, or preserve Halden's regulatory position during a 31-hour outage. The impact tolerance is four hours; the outage lasted 31 hours. Insurance pays after the event and only for covered heads of loss.

Effectiveness of the transfer

• Basis risk: the loss Halden cares about is client harm and regulatory breach, which the policy does not fully cover.
• Exclusion risk: the patch-management exclusion targets the most likely cause of a third-party ransomware event. A policy that excludes the scenario relied on is weak mitigation.
• Contract risk: Cobalt has no recovery time obligation and only 30 days' notice for termination. Halden cannot rely on the provider to restore service within tolerance, and insurance does not cure that.
• Capital recognition: under the standardised approach, insurance generally receives no operational risk capital credit; even where recognition exists, it is capped and conditional on insurer rating, term, cancellation notice and exclusions. This policy would need review against those conditions.

Conclusion Treat insurance as a financial recovery tool, not as a control. The board should not reduce investment in resilience because a policy exists. The firm should pursue the provider for contractual commitments and, if necessary, an exit plan. Insurance renewal should be used to negotiate the exclusion and the waiting period, but the primary response is service continuity.

Immediate actions

• Activate the crisis management plan, notify affected clients and provide a manual order route with clear limits and controls.
• Preserve evidence and coordinate with Cobalt on containment and restoration.
• Assess regulatory notification obligations and record the decisions taken.

Resilience actions

• Map the important business service end to end, including Cobalt, connectivity, staff, data and the client portal.
• Test a severe but plausible scenario in which Cobalt is unavailable for at least 31 hours and the contract gives no recovery commitment.
• Establish a manual workaround with trained staff, defined risk limits, dual control and a client communication plan.
• Require Cobalt to provide recovery time and recovery point commitments, security patch evidence, audit rights, subcontractor notification and termination assistance.
• Develop an exit plan and identify an alternative provider or in-house capability.
• Improve backup and restore testing; confirm whether the lost orders can be recovered from logs or client instructions.

Setting the impact tolerance The four-hour tolerance should be justified by reference to client harm, market exposure and regulatory obligations, not by what Cobalt can currently deliver. If order submission cannot be restored within four hours, the firm must either remediate or set a tolerance it can evidence and explain. The board should approve the tolerance, the scenario testing and the remediation plan. The 31-hour event should be treated as a breach of tolerance and reported as such, with lessons learned and owners for each action.