Cyber claim: unpatched VPN, ransomware and exclusion
A 200-bed private hospital in Hyderabad holds a cyber liability policy with a limit of ₹2 crore and a deductible of ₹10 lakh. The policy covers ransomware, business interruption, forensic costs and third-party privacy claims, but excludes loss arising from ‘failure to maintain the security of the system as required by the minimum security standards’ and ‘any prior known vulnerability’. A ransomware attack encrypted patient records and disrupted hospital operations for six days. The hospital paid a ransom of ₹1.2 crore through an intermediary. Forensic investigation later found that a critical VPN appliance had not been patched for eight months despite a vendor advisory. The hospital claims ₹1.2 crore ransom, ₹40 lakh forensic costs, ₹1.2 crore business interruption loss and ₹50 lakh from patients. The insurer appoints you as surveyor.
1. Identify the key coverage issues you must examine before recommending payment.
Read the worked answer
First, establish the insured event: was the loss caused by a covered cyber peril, and did it occur during the policy period? Second, examine the two exclusions. The ‘minimum security standards’ exclusion requires the insurer to show what standards were incorporated into the policy and whether the hospital failed to meet them. The ‘prior known vulnerability’ exclusion requires evidence that the hospital knew of the vulnerability before the attack or before inception. Third, separate the heads of claim: ransom, forensic costs, business interruption and third-party patient claims may have different sub-limits, waiting periods and deductibles. Fourth, check whether paying the ransom was lawful and whether the recipient was subject to sanctions; an insurer should not indemnify an illegal payment. Fifth, apply the ₹2 crore limit and ₹10 lakh deductible after determining which heads are covered.
2. How do you determine whether the unpatched VPN triggers the exclusion?
Read the worked answer
Do not rely on the forensic report alone. Obtain the policy’s security schedule and the proposal form to see what the hospital warranted. Obtain the vendor advisory, the hospital’s patch policy, patch logs, internal emails, IT meeting notes and any risk assessment. Establish who knew about the advisory, when they knew it, and why the patch was not applied. Then test causation: was the unpatched VPN the proximate cause of the intrusion, or merely a condition that made the attack easier while the immediate cause was a separate phishing or credential compromise? If the policy exclusion is drafted as a warranty or condition precedent, breach may defeat the whole claim; if it is an exclusion, the insurer must show the excluded cause operated. Record the factual findings without deciding legal liability, and recommend that the insurer take a coverage view on the policy wording.
3. What is your recommendation on the ransom payment and the overall claim?
Read the worked answer
Recommend that the insurer obtain a sanctions screening report and legal advice before accepting the ransom head. If the payment was made to a sanctioned entity or otherwise unlawfully, the insurer should not indemnify it. If lawful, check whether the policy sub-limit for ransomware payments is sufficient. For forensic costs, allow only reasonable costs incurred to investigate and contain the incident, supported by invoices and a scope of work. For business interruption, apply the waiting period, verify the loss of gross profit or additional expenditure, and check whether the six-day disruption is within the indemnity period. For patient claims, examine whether they are third-party privacy claims covered by the policy and whether they are quantified. Because the unpatched VPN may trigger an exclusion, present the coverage analysis in the alternative: if the exclusion applies, the claim may be repudiated or reduced; if it does not, pay covered heads subject to the limit and deductible.