Cyber Insurance Claim Support From a Public Adjuster

Ransomware, Business Interruption and Underpaid Cyber Claims for Businesses

✓ No Upfront Fee

✓ Featured in Forbes, Realtor.com & Insurance.com

✓ Licensed & Serving FL, MN, WI, ND & SD

Fill Out the Form Below to Get Started With Your Free Policy Review:

When ransomware or a network attack stops your business, your cyber policy and your property policy each owe part of the loss. We document and present the business's own losses, from lost income to data restoration, and negotiate them with your insurer. We work only for policyholders, never for insurance companies.

As Seen On:

What Clients Say About Shoreline

★★★★★ 5.0 Google Reviews

Leave Us a Review ★

What a Cyber Claim Pays, and What We Handle

A cyber policy is really several coverages under one limit: business interruption, extra expense, data restoration, hardware replacement, incident response costs and, in many forms, extortion costs. Each has its own trigger, its own sublimit and its own consent rules, and the business's own losses are the part we work on.

We handle your business's own (first-party) losses under its insurance policies. Shoreline is not a law firm and does not give legal advice. Liability claims against your business, regulatory inquiries, breach-notification duties, ransom decisions and lawsuits belong with your breach counsel or another licensed attorney.

Which parts of a cyber claim a public adjuster may handle depends on your policy and your state. We confirm that at the free policy review, before any contract is signed. Shoreline Public Adjusters, LLC works for businesses in Florida, Minnesota, Wisconsin, North Dakota and South Dakota.

Our lead public adjuster holds the CISSP and CISA certifications and has spent more than a decade in information security, IT audit and vendor risk. That background matters most in translating system logs, recovery tickets and vendor notes into the language the policy uses.

The claim is decided by a different set of facts than the ones IT needs to restore the systems, and most of them are easiest to capture in the first three days.

What the Cyber Claims Data Shows

From NetDiligence's 2025 Cyber Claims Study (incidents from 2020 to 2024), the NAIC's 2025 cyber insurance market report (2024 data) and the standard ISO commercial property forms.

81%

of SME cyber claims with a business interruption component were ransomware

Small and midsize businesses, incidents from 2020 to 2024. That makes the waiting period and the restoration date the two terms most worth reading before an incident. NetDiligence 2025 Cyber Claims Study

69%

of total incident cost was paid out for small and midsize businesses

The five-year figure. Part of the gap is retentions and uninsured costs; the rest is where a claim is negotiated. NetDiligence 2025 Cyber Claims Study

16,422

primary-policy cyber claims closed without payment in 2024

Against 8,838 closed with payment. The report does not give reasons, and some claims close below the retention. NAIC 2025 cyber insurance market report

$2,500

standard property-policy limit to restore corrupted data

The ISO commercial property forms (10 12 edition) carry a separate $2,500 for income lost when corrupted data interrupts operations, unless the declarations show more. ISO CP 00 10 and CP 00 30

The Policy Terms That Decide a Cyber Claim

Two published carrier specimen forms show how far the wording varies. Read your own policy against each of these before an incident, not during one.

A call to the hotline is not noticeNotice

Written notice is due the way the policy's notice section directs. One carrier's specimen cyber form states in capital letters that using its incident response coach for a consultation "DOES NOT constitute notice under this Policy." Send written notice as the policy directs, as soon as the incident is discovered.

Approved vendors, and the 72-hour windowConsent

Another carrier's specimen form lets the business hire a firm from the insurer's approved panel without prior consent for the first 72 hours after discovery, then requires written consent. Under the first form, costs from a vendor outside the panel fall under a separate limit. Accountant fees can need consent too, and they are the easiest items to strike.

What counts as an interruptionTrigger

One specimen form pays for "any unintentional and unplanned" outage. Another pays only for an interruption "caused by a Malicious Computer Act." We read which one you bought before anyone characterizes the incident.

When the restoration period endsRestoration

Both specimen forms end it when systems "could have been" restored with reasonable speed. One ends it when the business is back to its prior level of service, capped at 180 days; the other when the computer system is restored, never more than sixty days. We build the timeline that shows why the actual date was the reasonable one.

What the waiting period does to the checkWaiting period

Business interruption pays only after a waiting period measured in hours. In one specimen form, losses inside the waiting period "shall reduce and may exhaust any applicable Retention," while extra expense is covered from the start of the interruption.

Proof of loss and the dispute processProof & disputes

One specimen form requires a sworn proof of loss within 6 months after discovery and has an appraisal clause for business interruption. The other offers only non-binding mediation or arbitration. We use the process your policy actually provides and bring in counsel where it calls for one.

Exclusions and application disputesCoverage

War and state-backed attack exclusions, prior-knowledge exclusions and questions about what the application said about controls such as multi-factor authentication are coverage questions. We identify them early and bring them to your counsel.

What cyber insurance does not cover, exclusion by exclusion

Which Policy Pays: Cyber, Property or Crime

A single incident can touch three policies. Both carrier specimen cyber forms are written as excess over other valid insurance, so each loss has to be documented against the right policy from the start.

The cyber policy

Standalone or an endorsement

Carries the income loss, extra expense, data restoration, replacement hardware and response costs, each under its own sublimit and consent rule.

Business interruptionExtra expenseData restorationUnusable hardwareResponse costs

The commercial property policy

$2,500 data limits, and physical damage

The standard ISO forms give $2,500 a policy year to restore corrupted data and a separate $2,500 for income lost when corrupted data interrupts operations. The virus coverage does not apply when the system was manipulated by an employee or by a company you hired to install, maintain or repair it. Physical damage that follows a cyber event is a property claim in its own right: the standard causes-of-loss form excludes electrical disturbance to electronic systems but adds, "if fire results, we will pay for the loss or damage caused by that fire."

Commercial property claims Business disruption Fire & smoke Water & flood

The crime or fidelity policy

Funds transfer and social engineering

Funds-transfer and social-engineering losses often sit here rather than in the cyber form. We flag it at the free policy review so nothing is filed against the wrong policy.

Funds transferSocial engineering

Public Adjuster, Breach Counsel or On Your Own

A cyber incident brings several professionals to the table. Only one of them works solely on the business's own losses.

Recommended

Public Adjuster

The business's own losses, documented and negotiated

Builds the income calculation from your own books, documents extra expense, data restoration and hardware, and negotiates the amount with the insurer.
No upfront fee, with the share written into the agreement before work begins.

Breach Counsel or Coverage Attorney

Notification, regulators, liability and coverage disputes

Breach counsel directs the incident response and handles notification and regulatory obligations, and your policy may provide one.
A coverage attorney handles disputes over whether coverage applies at all, and any lawsuit.

On Your Own

A short outage close to the retention

Reasonable when the outage was brief and the loss sits close to the retention.
Harder once the claim turns on the waiting period, the restoration date or how fixed costs are counted.

The Losses We Document and Present

Each sits under its own coverage, sublimit and consent rule, so each is built as its own part of the claim.

Cyber policy

Ransomware downtime

Income lost while systems are down or running at part capacity, calculated from your own books as a shortfall against normal operations, from the end of the waiting period through the period of restoration. Rough out your own figures with our business interruption loss calculator.

Cyber policy

Extra expense

Overtime, rented equipment, temporary workarounds and other costs of keeping the business running. Tracked separately from lost income from the first hour, because some forms pay it from the start of the interruption while income loss waits for the waiting period.

Cyber policy

Data restoration

Restoring, recreating or replacing damaged data and software, documented against the form's limits on upgrades. One specimen form excludes improving systems beyond their prior level; another allows a limited upgrade when the insurer's approved forensic firm recommends it.

Cyber policy

Unusable hardware

Laptops, servers and network devices an attack left inoperable. Some forms replace them with like-kind equipment after reasonable efforts to restore them, and we document those efforts and the replacement pricing.

Cyber policy

Extortion costs

Some policies reimburse an extortion payment and related costs made with the insurer's prior written consent. Whether to pay is a decision for your counsel and the insurer; where the policy reimburses an approved payment, we document it as part of the claim.

Property policy

Physical damage

Fire, water or equipment damage that follows a cyber event is handled as a commercial property claim, with the property policy's own electronic data and computer operations coverages claimed alongside it.

How a Cyber Claim Works With Us

Four steps, starting before any contract is signed.

1

Free policy review

We read the cyber, property and crime policies and confirm which parts of the claim a public adjuster may handle under your policy and your state, before any contract is signed.

2

Map the coverage and the clocks

Every limit, sublimit, retention, waiting period and deadline on one page. Notice, vendor consent, proof of loss and data-restoration windows go on a calendar the day we are hired.

3

Build the claim

The interruption log, the income calculation from your own books, and every extra expense, data-restoration and hardware cost, each documented against its own limit.

4

Present and negotiate

We submit the claim and negotiate the amount with your insurer. If the disagreement is about coverage rather than amount, it goes to your counsel.

Breach counsel usually retains the forensic firm, and counsel decides who sees its report. We work from the facts counsel and your IT team are able to share: which systems were affected, when they went down, what was restored first and when normal service returned. Those facts become the waiting-period position, the restoration date and the scope of the data-restoration and hardware claim.

Cyber Insurance Claim QuestionsCan a public adjuster help with a cyber insurance claim?Yes, with the business's own losses: lost income, extra expense, data restoration, replacement hardware and covered response costs, plus any property claim the incident causes. Which parts of a cyber claim a public adjuster may handle depends on your policy and your state, and we confirm that at the free policy review before any contract is signed. Liability claims, regulatory matters and notification duties belong with your attorney.
Does cyber insurance actually pay out?NAIC's 2025 report on the cyber insurance market counted 8,838 primary-policy claims closed with payment and 16,422 closed without payment in 2024. The report does not give reasons, and some claims close below the retention. NetDiligence's 2025 study found payouts covered 69 percent of total incident cost for small and midsize businesses.
How do I file a cyber insurance claim?Give written notice exactly as the policy's notice section directs, as soon as the incident is discovered. One specimen form says a call to the insurer's incident hotline does not count as notice. Then log the interruption hour by hour, keep every invoice separate, and check the consent rules before hiring vendors.
How long does a cyber insurance claim take?There is no reliable published average, but the policy sets the clocks that matter. One specimen form requires a sworn proof of loss within six months after discovery. Restoration periods are capped, at 60 days in one specimen form and 180 days in another, so the business interruption part of the claim cannot run longer than the cap allows.
My cyber claim was closed without payment. What now?Start with the letter and find the specific provision it relies on. If the disagreement is about the amount, the policy's own process applies: appraisal in some forms, mediation or arbitration in others. If it is about whether coverage applies at all, that is a question for coverage counsel. Either way, the interruption records and invoices decide how strong the file is.
Does my commercial property policy cover a cyber attack?Only a little, in most standard forms. The ISO commercial property forms (10 12 edition) provide $2,500 a policy year to restore corrupted data and a separate $2,500 for income lost when corrupted data interrupts operations, unless your declarations show more. Physical damage that follows the incident, such as a fire or water damage, is a property claim.
Should I hire a lawyer or a public adjuster for a cyber claim?Often both, for different jobs. Your attorney handles notification, regulators, liability claims and coverage disputes. A public adjuster documents and calculates the business's own losses and negotiates the amount with the insurer.
What does a public adjuster charge on a cyber claim?A percentage of the claim payment, set in a written contract before any work starts. No upfront fee.
What does cyber insurance not cover?Common exclusions include war and state-backed attacks, known prior incidents, upgrades beyond what you had before, and physical damage, which belongs to the property policy. Our guide to what cyber insurance does not cover walks through them.

Need Help With A Different Type of Claim?

Wisconsin Residential Public Adjuster - Shoreline Public Adjusters

Aerial view of Wisconsin HOA community with pool and residential homes - Shoreline Public Adjusters handles HOA and condo association insurance claims

Residential Claims

HOA Claims

Downtown WI commercial high-rise buildings - Shoreline Public Adjusters handles business and commercial property insurance claims

Black SUV with wind damage from a storm - Shoreline Public Adjusters handles car insurance claims and diminished value claims in Wisconsin

Business & Commercial Claims

Auto Claims

Historic Wisconsin law firm building exterior - Shoreline Public Adjusters provides insurance appraisal and umpire services

Appraisal Services

The First 72 Hours: Protect the Claim While IT Restores the Systems

Your IT team and your insurer's response vendors will be focused on getting systems back. The claim is decided by a different set of facts, and most of them are easiest to capture now.

1

Give notice in writing

Send written notice the way the policy's notice section directs, and check the vendor consent window before hiring anyone outside the insurer's panel. A call to a hotline is not the same as notice.

2

Start the interruption log

Record when each system went down, when it came back partly and when normal service returned, and keep every invoice and timesheet separate from day one. That log decides the waiting period and the restoration date.

3

Preserve the evidence

CISA's ransomware checklist tells organizations to isolate affected systems, take images and memory captures, and take care to preserve highly volatile evidence.

CISA's guidance is at cisa.gov/stopransomware, and incidents can be reported to the FBI at ic3.gov. Before you sign a proof of loss or accept a first offer, request a free policy review. No upfront fee.

Business Interruption After a Cyber Attack: How the Number Is Built

Cyber business interruption pays two things: the pre-tax net income the business would have earned, and the normal operating expenses that continued anyway. It pays them only after a waiting period measured in hours, and only for a defined period of restoration.

A worked example, with every figure hypothetical. A distribution business earns $30,000 a day in revenue. Costs that stop when sales stop run $15,000, fixed costs run $11,000, and pre-tax profit is $4,000 a day. Ransomware takes it fully offline for four days, then it runs at half capacity for ten more.

A full day offline loses $15,000 against a normal day: the $4,000 profit plus $11,000 of fixed costs with no revenue to pay them. A half-capacity day loses $7,500, because half the revenue still covered part of the fixed costs. Counting the full fixed costs again on those days is the error that gets a claim cut. The total is $60,000 for the 96 hours offline plus $75,000 for the ten partial days, $135,000 in all.

With a 12-hour waiting period and a $25,000 retention, the payment is $102,500 or $110,000 depending only on whether losses inside the waiting period count toward the retention. If the insurer argues systems could have been restored by day 9 instead of day 14, five partial days, $37,500, come off the claim, and the interruption log is the answer to that argument.

If sales run at 80 percent for three weeks after systems return, that is $63,000 of lost margin. One specimen form ends restoration when the computer system is restored, so none of it is covered. Another ends it when the business is back to its prior level of service, capped at 180 days, so it can be claimed.

Our guide to filing a business interruption claim covers the documentation insurers ask for, and our guide to denied versus underpaid claims explains why the difference changes the next step.

Free Cyber Claim Review

Start Your Cyber Insurance Claim Consultation

We are extremely proud to serve the following states:

Wisconsin | Minnesota | Florida | North Dakota | South Dakota

We are based in Naples, FL but are licensed and our team services the entire states of Florida, Minnesota, Wisconsin, North Dakota & South Dakota - contact us today to get started!

Start Here

Talk Through a Cyber Claim

No upfront fee. Send us your cyber and property policies and anything the insurer has sent you. We will tell you what the policies cover, what we can handle and what belongs with your attorney.

Request a Free Policy Review