Cyber Insurance Disputes Post-Ransomware

Introduction : In the contemporary integrated cyber supply chain and cloud workflows, media organizations and production houses are the primary targets of digital blackmail. A data breach in M&E can put a company's most prized possession - intellectual property - at stake. In other industries, such as the healthcare sector, data breaches are mostly personal information. Whereas in the M&E sector, unreleased movies, proprietary algorithms, and celebrity contracts can be promptly encrypted or threatened to be leaked, rendering a project's commercial value unviable. As a result, entertainment companies must have cyber liability insurance in place.

These insurance claims lead to intense litigation between the insurance provider and the policy holder, with disputes relating to the computation for business interruption and the payment of ransom and compliance with mandatory reporting.

Legal Provisions

Handling a digital breach requires navigating overlapping criminal statutes, privacy rules, and IP frameworks. Understanding this legal matrix is vital for assessing how an insurance policy will respond.

Legal Framework	Key Provisions and Mechanisms	Applicability to Ransomware in the M&E Sector
Information Technology Act, 2000	Sections 43 and 66 define civil and criminal liabilities for unauthorized system access and data extraction. Section 66F tackles cyberterrorism.	Forms the statutory foundation for defining a "breach event" in insurance claims. Data extraction compensation is handled under Section 46.
Bharatiya Nyaya Sanhita (BNS), 2023	Section 308 penalizes extortion, including electronic threats demanding property or cryptocurrency. Section 111 addresses organized cybercrime syndicates.	Insurers require First Information Reports (FIRs) under these BNS provisions to validate an extortion event and trigger ransom coverage.
Digital Personal Data Protection Act (DPDPA), 2023	Imposes penalties up to ₹250 crore for inadequate security leading to a breach, and ₹200 crore for delayed reporting.	Triggers the "Privacy Liability" section of a cyber policy. M&E firms holding user data face immense regulatory exposure here.
CERT-In Directives (2022)	Mandates that corporate entities report severe incidents, including ransomware, within a strict six-hour window.	Insurers may use a failure to report within this tight window to invoke "failure to comply with laws" exclusions, potentially denying the claim.
IRDAI Cybersecurity Guidelines	Requires rigorous information security practices for insurers, including strict controls on third-party subcontracting.	Influences how insurers evaluate the cybersecurity posture of their clients. Poor vendor security can lead to claim denials.
Intellectual Property Laws	The Copyright Act, 1957, and Trade Marks Act, 1999, offer remedies for piracy, unauthorized reproduction, and brand impersonation.	Crucial during data leaks. Studios use these laws to secure "John Doe" injunctions against hackers threatening to leak copyrighted media.

Legal Analysis

The precise wording of the contract determines how a cyber insurance claim is resolved. Cyber coverage is much more personalized than traditional business property insurance. Small variations in definitions can be the difference between financial recovery and failure for entertainment companies.

Business Interruption and the Valuation of Intellectual Property

The purpose of business interruption (BI) clauses is to cover the costs of lost net income and the ongoing expenses incurred as a result of the interruption of business due to the outage of computer systems. There is, however, some disagreement on how this "period of restoration" is to be calculated. It is straightforward to quantify lost advertisement revenue in the event that a streaming service is inoperable for a period of two days. The real legal challenge comes when the value of intellectual property is diminished. If a hacker were to steal a master copy of a yet to be released box office hit and post it online, the studio would lose income from all future box office releases of that movie.

Claims for that income are routinely denied by insurers of standard BI policies. The reasoning is that, while a network outage may inhibit forecasting box office revenue, the forecast is still subjective and the relevance is determined by market conditions. From a legal standpoint, fundamental cyber regulations are engineered to restore normal operations as opposed to enabling the successful sale of a product. To prevent the loss in value of digital assets, M&E companies have to procure tailored Media Liability extensions or stand-alone IP insurance.

Extortion Payments: Regulatory Compliance and Coverage

Hackers typically seek a cryptocurrency ransom when they encrypt a network. Policies frequently have a "Cyber Extortion" clause that reimburses this amount as long as the insurer provides prior written approval. The legitimacy of the payment itself is the central legal question. Paying for the recovery of stolen data is not specifically prohibited in India. However, the transaction becomes a federal felony if the ransom is paid to a terrorist group that is prohibited by the Unlawful Activities (Prevention) Act (UAPA) or if it violates the Prevention of Money Laundering Act (PMLA). If a sanctioned body is engaged, insurers will instantly invoke the "criminal acts" exclusion. Therefore, before sending any money, policyholders must employ specialized threat-intelligence companies to perform thorough background checks (such as OFAC and UAPA lists) on the hacker's cryptocurrency wallet. The insurer has unquestionable grounds to reject the claim if this due diligence is not documented.

Media Liability Distinctions in Cyber Policies

Many production companies erroneously think that all digital hazards are covered by conventional cyber insurance. Differentiating between media culpability and a cyber breach is crucial. Network hacking, forensic investigations, and privacy fines are all covered under cyber insurance. It purposefully leaves out allegations of defamation, plagiarism, and copyright violation.

A simple cyber policy will probably reject any third-party lawsuits that emerge from a rogue employee hacking a company's social media account to post deepfakes or defamatory content. Businesses require specific Media Liability (Errors and Omissions) insurance to bridge this gap. This coverage, which covers defamation, copyright violations, and trademark infringement (although patent infringement is still not covered), guards against the legal dangers associated with producing and distributing content.

Notice Obligations and the CERT-In Mandate

Policyholders are obligated by insurance contracts to notify violations "as soon as practicable." A legitimate claim denial frequently results from delays that prohibit the insurance from using its authorized forensic specialists. The CERT-In mandate in India, which mandates reporting serious occurrences within six hours, complicates this contractual obligation. This results in a load of dual-track notifications. Insurers may claim that a corporation breached statutory regulations by concentrating solely on IT system repairs and missing the six-hour regulatory window, which would contradict the terms of the policy and render coverage void.

The War Exclusion and State-Sponsored Cyber Operations

The most contentious provision in cyber insurance at the moment is the "Act of War" exclusion. Ransomware is often used by state-sponsored hacker organizations to finance governments or sabotage economies. The international insurance market implemented clear exclusions for state-backed cyber activities in response to enormous payouts. This widespread exclusion is risky for the entertainment business, which has been targeted by foreign countries due to contentious film releases. Insurance companies may fully reject a claim if they classify a targeted hack as an act of war. In order to guaranty that reimbursements are still accessible in the event that an assault occurs outside of a physically designated war zone, companies must negotiate "carve-backs" in their contracts that specifically retain coverage for cyberterrorism.

Security Posture Misrepresentation and Policy Rescission

Companies are no longer given the benefit of the doubt by insurers, who actively employ security questionnaires to reject claims. The insurer will cancel the complete coverage if a studio states on its insurance application that it employs Multi-Factor Authentication (MFA) everyplace and investigators discover that hackers gained access using an outdated, unprotected account. When a contract is revoked, it is regarded as though it never happened. Legal teams must keep auditable evidence that all pledged security safeguards were in place during the policy term in order to avoid this.

Case Laws

Niva Bupa Health Insurance Co. Ltd. v. Nicenic International Group Co. (Delhi High Court, 2025)

Context and Ruling: Hackers broke into Niva Bupa at the beginning of 2025, taking client data and demanding a ransom. The hackers used Niva Bupa's trademarks to build rogue websites that leaked the data in order to put pressure on the corporation. The Delhi High Court granted the company's request for an immediate "John Doe" injunction (CS(COMM) 171/2025). Internet service providers and domain registrars were instructed by the court to block the extortion websites right away.

Legal Impact and Relevance: This decision provides a vital tactic for the M&E industry even tho it is not an insurance case. Policyholders are required by insurers to actively reduce damages. A studio can restrict the unapproved distribution of its intellectual property by employing trademark law to obtain quick takedown orders against hacker websites. By taking this preemptive legal action, the company's position during the insurance payout procedure is strengthened and the duty to reduce losses is satisfied.

Merck & Co., Inc. v. ACE American Insurance Co. (New Jersey Supreme Court, 2024/2025)

Context and Decision: Pharmaceutical behemoth Merck suffered $1.4 billion in losses as a result of the NotPetya hack in 2017. The insurer rejected Merck's claim under its property insurance, claiming NotPetya was an excluded "act of war" since it was a Russian cyberweapon.

Legal Impact and Relevance: The courts decided in Merck's favor, holding that malware was not covered by customary war exclusions, which only related to actual military force. The court interpreted the clause against the insurer because of the ambiguity. The insurance industry substantially revised its policies in response to this huge loss, which resulted in the stringent, cyber-specific nation-state exclusions that currently rule the market.

G&G Oil Co. of Indiana v. Continental Western Insurance Co. (Indiana Supreme Court, 2021)

Context and Ruling: G&G Oil paid a Bitcoin ransom after hackers encrypted its systems. The corporation submitted a claim under the "Computer Fraud" clause of its general commercial crime policy because it lacked specific cyber insurance. The insurer contended that rather than being the result of direct computer fraud, the ransom was a voluntary payment.

Legal Relevance and Impact: The ransomware assault was a misleading act that directly induced the payment, according to the Indiana Supreme Court, which sided with the policyholder. This case shows that where specialist cyber coverage is disputed, courts will occasionally interpret vague traditional insurance broadly to embrace digital extortion.

Practical Implications

Stricter insurance underwriting and changing cyberthreats necessitate a new strategy for enterprise risk management. One of the biggest blind spots in the digital supply chain is vulnerabilities. Post-production is often contracted out to smaller suppliers by studios. Complex liability disputes arise when pre-release video from a visual effects firm is compromised. M&E companies must impose stringent contractual indemnities to ensure that all third-party vendors have adequate cyber insurance in order to comply with regulatory standards such as the IRDAI 2026 criteria.

Furthermore, the distinction between media culpability and technical cyber breaches is becoming increasingly hazy due to the emergence of deepfakes and artificial intelligence. These days, hackers threaten performers with fake media or sanction fraudulent payments using cloned executive voices. As a result, board members have a crucial fiduciary responsibility to handle cybersecurity as well as an IT concern. Some large media companies are completely avoiding commercial marketplaces in order to establish their own captive self-insurance models in response to soaring premiums and dwindling coverage.

Making an effective ransomware claim: 

1. Prompt Notification: In order to comply with policy requirements, report the breach to the insurer's hotline right away. At the same time, notify CERT-In within six hours to prevent fines.

2. Deploy Approved Panels: Make use of the insurer-approved forensic investigators and outside legal counsel only. Internal teams that are not authorized may void coverage.

3. Sanctions Checks: To make sure that paying a ransom won't breach anti-terror legislation, legal counsel must check the hacker's bitcoin wallet against international sanctions lists prior to any negotiations.

4. Consent to Pay: Before sending any money to threat actors, always get official, written permission from the insurance provider. 

5. Determine Loss: To support the intricate business interruption claim, use forensic accountants to chart past revenue and out-of-pocket mitigating costs.

Conclusion

Ransomware is a threat to the media and entertainment industry because of how it impacts the economically sustainable future of protection of intellectual property. The ensuing cyber insurance claims are a result of the extremely convoluted policy language, speculative business interruption, and rigid statutory limits, especially in the case of media companies. Companies in the entertainment sector must insist on the availability of media liability extensions, as standard policies are significantly deficient when it comes to protecting IP devaluation or state-sponsored actions. Ultimately, production companies will be able to protect their intellectual property rights and creative assets through the combination of rapid legal actions, such as an injunction, and good faith compliance with policy provisions.

Author: Abhishek Agarwal in case of any queries please contact/write back to us via email to content@khuranaandkhurana.com or at  Khurana & Khurana, Advocates and IP Attorney.

References

1. Information Technology Act, 2000, No. 21 of 2000, §§ 43, 43A, 66, 66F & 70B (India). These provisions address, inter alia, unauthorised access and damage to computer systems, failure to protect data, computer-related offences, cyberterrorism and CERT-In's statutory functions.

2. Indian Computer Emergency Response Team (CERT-In), Directions relating to Information Security Practices, Procedure, Prevention, Response and Reporting of Cyber Incidents for Safe & Trusted Internet (28 Apr. 2022), issued under § 70B(6) of the Information Technology Act, 2000. The Directions require specified entities to report covered cyber incidents, including ransomware-related incidents, within six hours of noticing or being informed of them.

3. Bharatiya Nyaya Sanhita, 2023, No. 45 of 2023, § 308 (India). Section 308 defines and penalises extortion, including conduct involving threats communicated through electronic devices to induce delivery of property or money.

4. Merck & Co., Inc. v. ACE American Insurance Co., 479 N.J. Super. 387, 279 A.3d 366 (App. Div. 2022/2023). The New Jersey Appellate Division held that the insurers had not established that the NotPetya cyberattack fell within the policies' hostile or warlike action exclusion, emphasising the language and context of the exclusion. The decision is relevant to the evolving treatment of cyberattacks under traditional war exclusions in insurance policies.

5. G&G Oil Co. of Indiana, Inc. v. Continental Western Insurance Co., 165 N.E.3d 82 (Ind. 2021). The Indiana Supreme Court considered whether losses arising from a ransomware attack and Bitcoin ransom payment fell within a commercial crime policy's computer-fraud provision. The Court held that the loss resulted directly from the use of a computer but concluded that neither party was entitled to summary judgment on the remaining coverage issue, remanding the matter for further proceedings.