The first call decides the claim

How cyber insurance claims work in practice: the insurer's panel, the consent gates and the forensic requirements that decide whether a policy pays, for organisations operating in Illinois, United States, across all industries.

Most buyers picture a cyber insurance claim as reimbursement after the fact. A breach happens, the business adds up the forensics, the lawyers, the notification and the downtime, sends the insurer the bill, and the insurer pays. A cost incurred, then recovered.

That is not how the money moves. A cyber policy pays as a process the insurer runs, and from the first phone call the insurer's panel takes over: its breach lawyer, its forensic firm, its rules on what the insured may spend and when. The decisions that decide whether the claim is paid in full, in part, or not at all are made in the first hours, and most of them are not the insured's to make.

In Illinois the loss is rarely what defeats a claim. It fails at the procedural edges: the wrong forensic firm is hired, consent is not obtained, notice is late, or the loss cannot be mapped to a narrowly drafted trigger that only a forensic report can prove. Illinois courts read the wording strictly enough that a real, attack-caused loss can still go unpaid.

The first call is to a lawyer, not the IT team

The biggest surprise for a first-time claimant is that it usually does not choose its own investigators. Most cyber carriers provide a panel of pre-approved responders, forensic firms, breach-notification companies, public-relations consultants and legal counsel, and using the panel is often not encouraged but required by the policy. The practical effect is a loss of control: the incident manager, the breach counsel and the forensic examiner may be strangers to the business, working to the carrier's rate cards rather than the insured's.

Most cyber policies route the first notice through the insurer's incident hotline. A business that instructs its own outside counsel or managed-security provider before the carrier consents can find the carrier declining that spend because consent came afterwards.

There is a second reason counsel comes first, and it is not cost. The breach lawyer, often called a breach coach, sits on top of the forensics to protect legal privilege over what the investigation finds. An incident touching personal data is a legal problem before it is a technical one, because the same forensic work that supports the claim also decides who must be notified and can give a future plaintiff its evidence. The lawyer runs the clock and the privilege; the technician runs the servers.

Nothing moves without a yes

The most expensive procedural trap is spending money before the carrier agrees to it. Policies require prior consent before the insured engages vendors, settles a claim, or pays a ransom, and the consequence of acting first is real: a cost incurred without approval can be excluded, and in some wordings that failure reaches other claim costs too.

Ransom is where this bites hardest, because the consent step now carries a second layer of law underneath it: United States sanctions rules. The Treasury's Office of Foreign Assets Control can impose penalties on a strict-liability basis, meaning a victim can break the rules even without knowing the attacker was a sanctioned entity. On 13 July 2026 the Treasury designated two individuals and one entity that enable ransomware actors, under a March 2026 executive order on cybercrime, confirming an active enforcement posture that lengthens the consent step at exactly the moment an insured is under pressure to pay.

The pressure to pay is not abstract, and claims data shows why the gate matters. Across Coalition's policyholders in the United States, Canada, the United Kingdom, Australia and Germany in 2025, initial ransom demands rose by 47% year on year to more than $1 million, attacks combining data theft with encryption made up 70% of ransomware claims, and 86% of affected policyholders refused to pay at all. A business that pays first, outside the process, can end up funding the ransom itself and carrying independent sanctions risk on a payment it made without a screening trail.

Note. Initial demands rose by 47% to more than $1 million, and 86% of affected policyholders refused to pay.

Forensic reports and privilege

A cyber claim cannot be paid without forensic proof. The examiner establishes root cause, dwell time, the data affected, and whether the incident meets a defined policy trigger such as a security failure or a network interruption. An event a chief executive experiences as a catastrophe can still fall outside the wording if the forensics cannot map it to one of those defined terms. The report, in other words, is not a technical afterthought. It is the document that decides whether the policy responds at all.

The same report can be ordered produced to plaintiffs. Federal judges have repeatedly ordered breach reports produced. In the Capital One litigation, the Eastern District of Virginia ordered the Mandiant report on the 2019 breach, which affected about 100 million people in the United States and about 6 million in Canada, produced on 26 May 2020, and upheld that order on 25 June 2020. In Wengui v. Clark Hill, the District Court for the District of Columbia ordered a report prepared by Duff and Phelps produced on 12 January 2021. In Leonard v McMenamins, the Western District of Washington ordered a report prepared by Stroz Friedberg produced in a class action on 6 December 2023, with its engagement letter and scopes of work.

This is why the breach lawyer, rather than the IT department, engages the forensic firm. Privilege now turns on three things: counsel directing the work, a scope written to enable legal advice, and tight distribution. A report that reads like an ordinary security engagement, or that is circulated to IT and the leadership team, loses the protection, and every candid line about a control that failed becomes a line a plaintiff can quote.

Forensic breach reports ordered produced in US federal litigation

Matter	Year	The forensic report	What the court ordered
In re Capital One	2020	prepared by Mandiant on the 2019 breach affecting about 100 million people in the US and about 6 million in Canada	ordered produced (E.D. Va., 26 May 2020, upheld 25 June 2020)
Wengui v Clark Hill	2021	prepared by Duff and Phelps	ordered produced (D.D.C., 12 January 2021)
Leonard v McMenamins	2023	prepared by Stroz Friedberg	ordered produced in a class action, with its engagement letter and scopes of work (W.D. Wash., 6 December 2023)

Note. In each matter the court ordered the forensic report produced to plaintiffs.

In Illinois, the wording wins

Illinois reads cyber policies strictly, and recent decisions show cover turning on the words rather than the facts. The Illinois Appellate Court has let an insurer rely on the insured's own words. In Underwriters at Lloyd's v Galey Consulting, an unpublished Rule 23 order (2025 IL App (1st) 241909-U), it held that an exclusion barred the insurer's duty to defend a negligence suit brought by the client whose payment had been diverted, with the insurer relying on the insured's sworn statement.

Illinois's Biometric Information Privacy Act gives individuals a private right of action (740 ILCS 14/20). In Tony's Finer Foods (2024 IL App (1st) 231712, 10 September 2024) the court found a cyber policy owed no duty to defend a class action under that Act, because the claim did not arise from a data breach, a security failure or an extortion threat, and reversed and remanded. In both rulings, coverage was defined by the wording, not by how plainly the loss flowed from the incident.

Two Illinois Appellate Court rulings where the policy did not respond

Case	Citation	What was at stake	Outcome
Underwriters at Lloyd's v Galey Consulting	2025 IL App (1st) 241909-U (unpublished Rule 23 order)	the defence of a negligence suit by the client whose payment was diverted	an exclusion barred the insurer's duty to defend; the insurer relied on the insured's sworn statement
Tony's Finer Foods v Certain Underwriters	2024 IL App (1st) 231712 (10 September 2024)	the defence of a biometric-privacy (BIPA) class action under a cyber policy	no duty to defend; reversed and remanded

Note. In each ruling the policy wording, not the cause of the loss, decided whether the insurer had to defend.

Two clocks, not one

While the carrier's consent process runs, a separate statutory clock is already ticking, and the two are not the same clock. Illinois law requires notice to affected residents in the most expedient time possible, and notice to the Attorney General once a breach reaches more than 500 Illinois residents (815 ILCS 530/10). For licensees of the Illinois Department of Insurance, the Insurance Data Security Law requires notice to the Department within three business days after a determination that a cybersecurity event has occurred, where the statutory criteria are met, including where 250 or more Illinois consumers are involved (215 ILCS 215/20). Those duties are statutory and cannot be waived by satisfying the carrier. A firm can keep its insurer happy and still break Illinois law, or the reverse, if it treats the two as one.

For a business that operates across states, several such clocks run at once, and the tightest one governs. New York's financial regulator demands notice within 72 hours and a further report within 24 hours of any extortion payment (23 NYCRR 500.17); healthcare answers to a federal breach rule with an outer limit of 60 days. All of this has to be filed while the forensic picture is still forming and the panel is still being assembled, which is precisely when a rushed, imprecise notice does the most damage.

Five points at which a covered loss has gone unpaid

The rulings and policy terms above identify five points at which a covered loss has gone unpaid: payment before consent; off-panel vendors; forensic reports not directed by counsel; late or inaccurate notice; and losses outside a defined term.

Conditions set before the incident

Policy wordings set consent, panel and notice conditions in advance of any incident; statutory notice duties in Illinois run separately from them. The claim is a process the carrier runs under those conditions, not a reimbursement the insured directs.

Rulings and figures drawn from TheRiskAgent's risk briefing on how cyber insurance claims work in practice in Illinois (September 2026): US federal court orders, Illinois Appellate Court rulings, Illinois and New York statutes and regulations, US Treasury and OFAC releases and the Coalition 2026 Cyber Claims Report. Figures checked against the issuing official sources in October 2026. Reference material, not advice, and no substitute for a policyholder's own policy wording and counsel.