The first call decides the claim

How cyber insurance claims work in practice: the insurer's panel, the consent gates and the forensic requirements that decide whether a policy pays, for organisations operating in Illinois, United States, across all industries.

Most buyers picture a cyber insurance claim as reimbursement after the fact. A breach happens, you add up the forensics, the lawyers, the notification and the downtime, you send the insurer the bill, and it pays. A cost you incur, then recover.

That is not how the money moves. A cyber policy pays as a process the insurer runs, and from the first phone call the insurer's panel takes over: its breach lawyer, its forensic firm, its rules on what you may spend and when. The decisions that decide whether the claim is paid in full, in part, or not at all are made in the first 48 hours, and most of them are not yours to make.

In Illinois the loss is rarely what defeats a claim. It fails at the procedural edges: the wrong forensic firm is hired, consent is not obtained, notice is late, or the loss cannot be mapped to a narrowly drafted trigger that only a forensic report can prove. Roughly a quarter of breach claims are found to carry a policy problem of this kind, and Illinois courts read the wording strictly enough that a real, attack-caused loss can still go unpaid.

So the policy is best read as a playbook you did not write. The breach is the first incident; the claim is the second, and it runs under someone else's procedure. Learning that procedure before the day, rather than at two in the morning during the incident, is most of what separates a claim that pays from one that does not.

The first call is to a lawyer, not your IT team

The biggest surprise for a first-time claimant is that they usually do not choose their own investigators. Most cyber carriers provide a panel of pre-approved responders, forensic firms, breach-notification companies, public-relations consultants and legal counsel, and using the panel is often not encouraged but required by the policy. The practical effect is a loss of control: the incident manager, the breach counsel and the forensic examiner may be strangers to the business, working to the carrier's rate cards rather than yours.

That is why the first call after a suspected breach should be to the insurer's incident hotline, not to the security firm you already trust. A business with an outside counsel or a managed-security provider on retainer, common in financial services and healthcare, is the classic candidate for an unreimbursed bill: it instructs its own firm reflexively, and the carrier declines the spend because consent came afterwards. The place to fix that is at purchase or renewal, by negotiating the right to use your preferred adviser and getting it named on the panel while you still have the leverage.

There is a second reason counsel comes first, and it is not cost. The breach lawyer, often called a breach coach, sits on top of the forensics to protect legal privilege over what the investigation finds. An incident touching personal data is a legal problem before it is a technical one, because the same forensic work that proves your claim also decides who you must notify and hands a future plaintiff their evidence. The lawyer runs the clock and the privilege; the technician runs the servers.

A cyber claim runs through the carrier's gates, not yours

The gate	Who controls it	Get it wrong and
Notice	The insurer, on a prompt-notice condition	late notice can defeat a real claim
Vendors and counsel	The insurer's pre-approved panel	your own firm, hired without consent, goes unpaid
Consent to pay or settle	The insurer's authorisation process	a ransom or settlement paid first can forfeit that cost, and others
Forensic proof	A panel firm, engaged by breach counsel	no proof of a covered trigger means no payout

Note. Four gates decide whether a real loss is paid. The insured controls the conduct at each one, and that is where most avoidable denials happen.

Nothing moves without a yes

The most expensive procedural trap is spending money before the carrier agrees to it. Policies require prior consent before you engage vendors, settle a claim, or pay a ransom, and the consequence of acting first is real: the cost you incurred without approval can be excluded, and in some wordings that failure reaches other claim costs too. You keep the final decision, the insurer cannot force you to pay a ransom or forbid it, but you cannot bypass the process and still expect the cheque.

Ransom is where this bites hardest, because the consent step now carries a second layer of law underneath it. Before a payment is transmitted, carriers require authorisation on three points: that the payment is legal under United States sanctions rules, that the criminal can actually decrypt what was locked, and that the payment has cleared the carrier's internal process. The sanctions point is unforgiving. The Treasury's Office of Foreign Assets Control can impose penalties on a strict-liability basis, meaning a victim can break the rules even without knowing the attacker was a sanctioned entity. On 13 July 2026 the Treasury designated two individuals and one entity that enable ransomware actors, under a March 2026 executive order on cybercrime, confirming an active enforcement posture that lengthens the consent step at exactly the moment an insured is under pressure to pay.

The pressure to pay is not abstract, and the wider claims data shows why the gate matters. Across the market in 2025, initial ransom demands rose by nearly half year on year to more than a million dollars, attacks combining data theft with encryption made up most ransomware claims, and a record share of victims refused to pay at all. A business that pays first, outside the process, can end up funding the ransom itself and carrying independent sanctions risk on a payment it made without a screening trail.

Note. Demands are rising and most victims now refuse to pay, which is exactly the moment the carrier's consent and sanctions checks slow a payment down.

The report you must run, used against you

A cyber claim cannot be paid without forensic proof. The examiner establishes root cause, dwell time, the data affected, and whether the incident meets a defined policy trigger such as a security failure or a network interruption. An event a chief executive experiences as a catastrophe can still fall outside the wording if the forensics cannot map it to one of those defined terms. The report, in other words, is not a technical afterthought. It is the document that decides whether the policy responds at all.

Here is the sting. The same report can be prised out of your hands and read back to you in court. Federal judges have repeatedly ordered breach reports produced to plaintiffs. In the Capital One litigation, a report on a breach affecting 100 million people was ordered disclosed because there was no evidence the forensic firm's work would have differed had litigation not been looming. In the Clark Hill matter a law firm could not prove that a report prepared by Duff and Phelps was privileged, even under a two-track structure meant to protect it. In Leonard v McMenamins, a report a response lawyer had commissioned from Stroz Friedberg was pulled into class-action discovery all the same.

This is the real reason the breach lawyer engages the forensic firm rather than your IT department. Privilege now turns on three things: counsel directing the work, a scope written to enable legal advice, and tight distribution. A report that reads like an ordinary security engagement, or that is circulated to IT and the leadership team, loses the protection, and every candid line about a control that failed becomes a line a plaintiff can quote. Let IT commission the forensics directly and you have forfeited the shield before the investigation even begins.

The forensic report you must run can become the plaintiffs' evidence

Matter	Year	The forensic report	Ordered handed over because
Capital One	2020	on a breach affecting 100 million people	no evidence the work would have differed absent litigation
Clark Hill	2021	prepared by Duff and Phelps	a two-track structure did not prove it privileged
Leonard v McMenamins	2024	prepared by Stroz Friedberg for counsel	the report was pulled into class-action discovery

Note. The report that supports your claim can become the document that funds the plaintiff's case. It stays protected only when counsel, not you, directs the work and holds it close.

In Illinois, the wording wins

Illinois reads cyber policies strictly, and recent decisions show a real loss going unpaid on the words rather than the facts. When a ransomware attack on a payroll provider led an Illinois employer to overpay staff by about $1.2 million, the Appellate Court held the overpayment was not necessarily incurred and so fell outside the policy's extra-expense cover. The court accepted the loss followed the attack. It still was not a covered loss. Consequential cost is not the same as insured cost.

The same court has let insurers invoke an exclusion using the policyholder's own words. In the Galey Consulting dispute it applied a cyber-event exclusion to bar a wire-fraud loss under a professional-liability policy, and confirmed that an insurer may reach for an exclusion on the strength of the insured's own claim notice, where the facts are undisputed. What you write in your first notice of loss can be handed straight back to you as the reason it is denied, which is why that notice benefits from a lawyer's eye before it is filed.

And Illinois carries an exposure no other state matches. In Tony's Finer Foods the court found a cyber policy owed no duty to defend a class action under the state's biometric privacy law, because the claim did not arise from a data breach, a security failure or an extortion threat. A business scanning fingerprints or faces that assumes its cyber tower answers a biometric claim will often find it does not. The lesson running through all three is the same: coverage is defined by the wording, not by how plainly the loss flowed from the attack.

Three Illinois rulings where a real loss went unpaid

Case	Year	What the policyholder lost	Why
Villa Financial v Underwriters at Lloyd's	2025	about $1.2m in post-ransomware payroll overpayments	not 'necessarily incurred', so outside 'extra expense'
Underwriters at Lloyd's v Galey Consulting	2025	a wire-fraud loss under a professional-liability policy	a cyber-event exclusion barred it, invoked from the insured's own notice
Tony's Finer Foods v Certain Underwriters	2024	the defence of a biometric-privacy (BIPA) class action	it did not arise from a breach, security failure or extortion

Note. In each, the loss plainly followed the attack. The wording, not the causal link, decided the money.

Two clocks, not one

While the carrier's consent process runs, a separate statutory clock is already ticking, and the two are not the same clock. Illinois law requires notice to affected residents in the most expedient time possible, notice to the Attorney General once a breach reaches more than 500 residents, and, for insurers and their licensees, notice to the state Department of Insurance within three business days of discovering a breach affecting more than 250 people. Those duties are statutory and cannot be waived by satisfying the carrier. A firm can keep its insurer happy and still break Illinois law, or the reverse, if it treats the two as one.

For a business that operates across states, several such clocks run at once, and the tightest one governs. New York's financial regulator demands notice within 72 hours and a further report within 24 hours of any extortion payment; healthcare answers to a federal breach rule with an outer limit of 60 days. All of this has to be filed while the forensic picture is still forming and the panel is still being assembled, which is precisely when a rushed, imprecise notice does the most damage.

Five ways to turn a real loss into an uninsured one

The detail resolves into a short list of self-inflicted failures. Worst first.

1. Pay the ransom before the insurer authorises it. You skip the sanctions screen and the consent step in one move, and you can end up funding the payment yourself while carrying strict-liability sanctions risk on a transfer made with no screening trail. It is the single most expensive thing a panicked response can do.

2. Call your own forensics or response firm before consent. Off-panel and unapproved, the bill is often refused even though the loss is genuine, and if IT rather than counsel commissions the work you may lose the privilege too. One reflexive phone call, two failures.

3. Let IT, not counsel, own the forensic report. A report written as an ordinary security engagement, and circulated widely, is the report a plaintiff gets to read. The protection is lost at the moment of engagement, not in court.

4. Treat notice as administration. Late notice can defeat a real claim on its own, and a careless first notice can hand the insurer an exclusion. The breach hotline is call one, and the notice is a legal document, not a form.

5. Assume cover means every downstream cost is paid. Consequential losses can sit outside a defined term, as the payroll overpayment did, and a biometric class action can sit outside cyber cover entirely. Autonomy and reimbursement are not the same thing.

Engineer the claim before the fire

A cyber policy is worth holding, and for most incidents the panel is the right and cheapest route: the expertise is real and the policy pays for it. The error is to treat the claim as a reimbursement you direct, when it is a process the carrier runs and a set of conditions you must clear. The work that decides the outcome is done before the incident, not argued after it.

That work is concrete and cheap. Read the consent, vendor and notice clauses and reduce them to a one-page cheat-sheet. Pre-clear your preferred forensic firm and counsel onto the panel at renewal, while you still have leverage. Wire the carrier's breach hotline into the response plan as the first call. Name, in advance, who may authorise notice, instruct counsel and approve a ransom recommendation, so the consent workflow does not stall on an absent signatory at two in the morning. And build a single decision tree that fires carrier notice, Attorney General notice and, for licensees, Department of Insurance notice from the same confirmed-breach trigger.

So the question worth asking of your own organisation is simple, and awkward. If you were breached tonight, does your team know to call the insurer's lawyer before anyone else, and to touch nothing that costs money until the carrier says yes? If the honest answer is that someone would reach for the firm they trust and sort the insurance out later, that is the gap, and it is far cheaper to close now than to discover during the claim.

Rulings and figures drawn from TheRiskAgent's risk briefing on how cyber insurance claims work in practice in Illinois (September 2026): US federal privilege decisions, First District Illinois Appellate rulings, the Coalition 2026 Cyber Claims Report and OFAC guidance. Produced with AI research tools and reviewed before release. Reference material, not advice, and no substitute for your own policy and counsel.