Cyber insurance claims

Responding icon - umbrella icon

Read time: 5 minutes

As a condition of coverage, most insurance policies require policyholders to provide timely notice of any claim under the policy. This notice enables the insurers to investigate the claim and determine the extent to which the policy may provide coverage for the loss. Failing to provide proper and timely notice may put a policyholder at risk of not being able to recover under the policy, regardless of whether the policy would otherwise provide coverage.

Further, Policyholders must directly provide timely notice even where the insurer may be independently aware of the claim or loss. For example, some courts have found that a policyholder may forfeit their rights to recovery where they fail to provide notice of the claim as required under the terms of the policy, even though a co-insured provides notice of that same claim to the insurer. Although the insurer is undoubtedly aware of the potentially covered claim, the co-insured’s notice may not be imputed to the policyholder.

Carefully review policies to know when notice is required, what information is required, and how and where it should be sent

Specific policy terms determine what a policyholder must do to provide timely and sufficient notice of the claim or loss.

Understanding notification requirements is critical. Policyholders should review the notification provisions in all of their insurance policies to determine: (1) when a claim or loss must be reported; (2) the details of the insurance claim that must be included in the notice; and (3) to whom and how the loss must be reported. Unless the policy states otherwise, notice to a broker alone may not constitute notice to the insurer. Policyholders, however, may request that the broker transmit notice to the insurer on behalf of the policyholder rather than sending notice to the insurer directly, but the broker’s acts or omissions in giving notice may be imputed to the policyholder.

Although some policies may provide a set amount of time within which the policyholder should provide notice of the loss, many others will simply require the policyholder to provide “prompt” notice, or notice as soon as practicable or within a reasonable time. Regardless of the terms, notice should be provided as promptly as possible. For instance, courts construe notice requirements for occurrence-based liability policies – which may provide lifetime coverage for loss occurring during the policy period – and claims-made liability policies – providing coverage for claims that are first made against insureds during the policy period – differently in different jurisdictions. Some courts hold that insurers may not deny coverage on the basis of late notice absent proof of prejudice to the insurer in adjusting the claim, but others may apply this “notice-prejudice” rule only to occurrence-based policies, and construe claims-made notification requirements strictly. Moreover, unnecessary delay in providing notice may prejudice the policyholder in other ways even if it does not result in a forfeiture of coverage. For instance, the insurer may assert that legal fees incurred in responding to a claim prior to notification may not be covered (or may not erode a deductible or retention). To avoid any potential forfeiture of or limitations on coverage, policyholders should carefully review the notification requirements under their policies before a claim or loss occurs, and provide notice of the claim or loss as promptly as possible in accordance with those requirements.

Key takeaways
  • Policyholders must notify their insurer of any potentially covered claims or losses in order to recover them under their policy.
  • Notice should be given as quickly as possible.
  • Policyholders should review the notification provisions of all of their policies before a claim or loss occurs.
  • Policyholders should consider and prepare for issues that may arise with respect to notifying their insurer of a cyber-related loss or claim.