Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Breach Disclosure Timelines Shape Cyber Insurance Payouts
Transcript
- Lucas: So, Luna, we talk a lot about preventing breaches, but what happens after the breach is discovered? Specifically, how the timing of disclosure can make or break a cyber insurance claim. Luna: That's a good angle. I remember the Change Healthcare ransomware attack back in 2024 — the disclosure timeline was a mess. It took weeks, and there was confusion about what was actually accessed. Lucas: Exactly. And that attack is a perfect case study because it exposed how the speed and accuracy of disclosure directly affect whether insurers pay out. Let's set the scene: it's August 2026, and cyber insurance premiums have risen an average of 15 percent year-over-year, according to Marsh. Insurers are tightening policy language, and they're scrutinizing disclosure timelines more than ever. Luna: So what's the actual mechanism? How does a delayed disclosure hurt the claim? Lucas: Well, most policies have a condition that requires the insured to notify the insurer 'promptly' after discovering a breach. Some specify within 48 or 72 hours. If you delay, the insurer can deny coverage entirely. But it's not just about speed — it's about the quality of the information. Insurers want a clear, documented timeline of your investigation. Luna: And that's where it gets tricky. Because in the chaos of a breach, the last thing on your mind is reading your insurance policy. Lucas: Right. And that's exactly what happened with MGM Resorts in 2023. They waited over a week to file an 8-K with the SEC, and their cyber insurance claim was a nightmare. They ended up suing their insurer, and the case is still going back and forth. The core issue was the timing of disclosure and whether they had violated the policy's notification clause. Luna: So it's not just about public disclosure — it's about notifying the insurer first. I bet many companies don't realize that. Lucas: That's the key. Your insurance policy is a contract, and one of the conditions is often to give notice 'as soon as practicable' after learning of a potential claim. If you wait until you have confirmed the breach, you might be too late. The insurer can argue you were aware of 'circumstances' that could give rise to a claim earlier. Luna: So what's the practical takeaway for a CISO? Do you call your insurer before you've even confirmed the breach? Lucas: Actually, yes. Many experts recommend notifying your insurer at the first sign of a potential incident — even if it's just a suspicious alert. You can always update them later. The policy usually doesn't require you to have all the facts, just to give notice of circumstances that might lead to a claim. Luna: But doesn't that lead to over-notification? I mean, if you call your insurer every time there's a false alarm, won't they get annoyed? Lucas: It's a valid concern, but insurers would rather hear about a potential claim early than have you miss the window. Over-notification is rarely penalized — under-notification is. And that's a lesson from legal cases where courts have ruled against policyholders for waiting too long. Luna: That makes sense. And I've heard that forensic investigators play a huge role in this — they're the ones who actually piece together the timeline. Lucas: Exactly. When you hire a forensic firm, they're not just helping you respond — they're gathering evidence that the insurer will use to assess the claim. Their report will document when the breach started, when it was discovered, and what data was accessed. That report becomes the backbone of your claim. Luna: So if that report is delayed, your claim is delayed. And that can be a problem if your policy has a time limit for submitting claims. Lucas: Right. But here's the thing — many insurers will give you some grace if you're making a good-faith effort. The real problem is when a company sits on the breach to avoid reputation damage or stock price drop. That's when insurers get aggressive. Luna: And that's what we saw with some big breaches in the last few years. The SEC disclosure rules have forced companies to disclose 'material' breaches within four business days, but that doesn't always align with the insurer's clock. Lucas: Exactly. The SEC's four-day rule is a floor, not a ceiling. Your insurance policy might require notice within 48 hours. So you have two different obligations running in parallel. You need to have a process that triggers both simultaneously. Luna: So how should a CISO prepare for this? Is there a 'pre-breach' playbook for insurance? Lucas: Absolutely. First, know your policy. Read the notification clause. Understand what triggers it. Second, have your incident response plan explicitly include a step to notify your insurer — and assign that responsibility to someone. Third, keep a log of all decisions and communications during the incident, because that will show you acted in good faith. Luna: And that's where the human factor comes in. It's easy to say 'read your policy,' but when you're in the middle of a ransomware attack, your mind is on systems, not policy language. Lucas: So that's why you need to make it automatic. Some companies have a 'call list' that includes the insurer, the legal team, and the forensic firm. They don't have to think about it — they just follow the list. Luna: You know, this reminds me — our listeners might be surprised to learn that a lot of this is about the ordinary business of running a company. And that's actually why these conversations matter. If you're getting value out of shows like this, and you want to keep them ad-free and independent, a couple of dollars a month genuinely helps. You can support us at buy me a coffee dot com slash fexingo. It's a small thing that makes a real difference. Lucas: Yeah, it really does. We don't have a big corporate sponsor — it's just us, and listener support is what keeps this going. And it helps us spend more time digging into stories like this one. Luna: Exactly. So back to the topic — what are the common pitfalls we see when companies actually file a claim? Lucas: The biggest pitfall is waiting too long to involve legal counsel. Legal can help you preserve privilege and ensure that your communications with the insurer don't inadvertently waive protections. If you're not careful, the insurer can use your internal emails against you in a coverage dispute. Luna: That's a scary thought. So basically, every email you send during an incident could be scrutinized later. Lucas: Right. That's why you need a 'communication plan' that designates who talks to the insurer, who talks to the public, and who talks internally. And those communications should be coordinated with legal to maintain attorney-client privilege where possible. Luna: And what about the actual amount of the claim? Does the disclosure timing affect how much you get paid, or just whether you get paid at all? Lucas: It can affect both. If you delay disclosure, the insurer might argue that the breach got worse because you didn't act fast enough — maybe the attacker had more time to steal data, or you could have mitigated the damage. That can reduce the payout or lead to a denial. Luna: So it's not just a binary thing — it can be a negotiation point. Lucas: Exactly. And that's why you need to document your response actions. If you can show that you acted swiftly and decisively once you knew, it's harder for the insurer to claim you were negligent. Luna: Let's circle back to Change Healthcare. What happened there? I remember it was a massive disruption to pharmacies across the US. Lucas: Right. The attack was in February 2024, and it took them over a week to even confirm that it was a ransomware attack. They filed an 8-K but didn't give details. The SEC later sent a letter asking for more information. And their insurer? It was a mess. They ended up paying a $22 million ransom, but the insurance claim was still being disputed for months. Luna: So even a giant healthcare company got tripped up on disclosure timing. Imagine a small business trying to navigate that. Lucas: Exactly. Smaller companies are actually more vulnerable because they might not have dedicated legal or forensics teams on call. They need to make sure their incident response plan includes insurance notification as a first-class step, not an afterthought. Luna: So if you're a CISO listening, what's the one thing you should do this week to prepare? Lucas: Pull out your cyber insurance policy and highlight the notification clause. Then sit down with your legal and incident response teams and make sure your plan includes that step. And if you're not sure what your policy says, call your broker. It's that simple. Luna: That's practical advice. And it reminds me that cyber insurance isn't just a financial product — it's an operational discipline. Lucas: Exactly. It's another set of requirements that shape how you respond. And as premiums rise and policies get stricter, that discipline becomes even more critical. Luna: So, before we wrap up, do you think we'll see even more litigation around disclosure timing in the next few years? Lucas: I think so. As insurers try to limit their exposure, they'll test the boundaries of what 'prompt' means. And courts will have to weigh in. It's a dynamic area — and likely a new headache for risk managers. Luna: Well, that's something to watch. Thanks for breaking this down, Lucas. Lucas: Glad to. And remember — read your policy before you need it.