Does General Liability Cover Ransomware?

Ransomware may encrypt or steal data and disrupt operations, creating costs that differ from third-party bodily injury or physical property-damage liability. The ISO specimen’s electronic-data exclusion addresses damages from data loss, corruption, or inability to access information. It does not establish coverage for ransom demands, forensic investigation, data restoration, business interruption, or crisis services. A CGL policy should not be treated as ransomware insurance.

A cyber policy may address some extortion and response expenses, but the quoted wording controls. Ask about covered extortion events, insurer consent before payment, sanctions and legal restrictions, waiting periods, incident-response vendors, recovery costs, and interruption sublimits. Report the incident according to the policy’s notice requirements. Compare the CGL and cyber forms, including endorsements, rather than relying on a general statement that cyber liability is included.