Cyber Insurance: What Counts in a Claim

In short: In a cyber insurance claim, three things above all count: inform the insurer early, preserve evidence instead of rebuilding hastily, and coordinate important steps beforehand. What exactly applies is set out in your insurance terms. This page gives general guidance, is not legal advice and does not replace coordination with the insurer, broker or lawyer.

Why a claim is special with cyber risks

With water damage, it is obvious what happened. With an attack on a web server, it is different: at the start there is often only a suspicion, such as a strange file, an unusual process or a warning from the host. Whether damage has actually occurred only becomes clear in the investigation.

PHP2Shell is a good example. The two vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow code execution without logging in. Anyone who patched only days after 21 October 2026 cannot rule out with certainty that something happened beforehand. A patch does not remove malware that has already been planted and does not prove that nothing happened. The question of whether and when an insured event exists is therefore often not clear-cut.

Cyber insurance claim: the typical obligations

Obligations are duties of the policyholder whose breach can endanger the payout. Many policies contain similar points, but they differ considerably in detail:

• Notification: inform the insurer without undue delay as soon as an insured event has occurred or is imminent.
• Loss mitigation: take reasonable measures to keep the loss small, for example taking affected systems off the network.
• Coordination: clarify essential steps, engagements and payments with the insurer beforehand.
• Information and documents: provide information and supply documents necessary to establish the loss.
• Evidence preservation: do not destroy traces unnecessarily, so that cause and extent remain determinable.

Some contracts also contain requirements for security before the loss, such as regular updates, backups or multi-factor authentication. The information given in the risk questionnaire when the contract was concluded can also play a role.

The first call to the insurer

Many cyber insurers offer an emergency hotline. Have your policy number and a short description of the situation ready. At the first contact, clarify these questions and note the answers with the date, time and name of the person you spoke to:

1. Should the case be officially reported, and in what form?
2. Does the insurer provide its own service providers for forensics and recovery, or may we engage our own?
3. Which costs are approved in advance, and which need consent?
4. Which documents are needed?
5. Are there requirements for external communication or for involving lawyers?

Preserve evidence before rebuilding

The understandable reflex after an attack is to rebuild the server immediately. For insurance, data protection and a possible criminal complaint, this is often unfavorable, because traces disappear. Better: isolate affected systems, preserve logs and memory images, create file lists with timestamps, and only then clean up or rebuild.

For PHP2Shell, the trade press recommends keeping server logs from 20 October 2026 onward. So far there are no published, confirmed indicators of compromise; detection relies on behavioral analysis. That makes it all the more important that the raw data is preserved. IT forensics provides professional preservation.

Interplay with data protection and criminal complaints

An insured event rarely stands alone. If personal data may be affected, the reporting obligation under Art. 33 GDPR applies, where possible within 72 hours of becoming aware. More under GDPR reporting obligation. Many insurers help with this by arranging lawyers.

A report to the police can also be sensible or desired by the insurer. The central contact points for cybercrime at the state criminal police offices (Zentrale Ansprechstellen Cybercrime) are the right address for this, see Filing a criminal complaint. Coordinate the order with the insurer.

Preparation: align contract and emergency plan

Use the current situation as an occasion to read your contract and carry the obligations over into your emergency plan. Enter the hotline number and the policy number in a place that is reachable even without working IT. Check whether your statements about your security level are still accurate. A structured IT emergency plan helps with this.

A short conversation with your broker or insurer outside of a claim is also helpful. Ask how the insurer handles precautionary measures such as taking a website offline, what evidence it expects on updates and whether there are recommendations on log retention. The answers belong in writing in the emergency plan.

How does PHP SOS help?

• We preserve logs and system states in a traceable way before cleanup and document every measure with the time.
• We prepare a technical report on cause, extent and measures taken, which you can present to the insurer.
• At your request, we coordinate with the insurer's service providers.
• Through incident response, we accompany the incident through to documented recovery.

Frequently asked questions

Sources

• BSI (German Federal Office for Information Security)
• GDPR Art. 33
• php.net: Security announcements