This article in brief
- For professionals, compensation for losses caused by a cyberattack requires a criminal complaint to be filed within 72 hours of discovering the facts (Article L. 12-10-1 of the French Insurance Code (Code des assurances)).
- This 72-hour period is not the same as the one for notifying the CNIL (French data protection authority), which is governed by Article 33 of the GDPR and serves a different purpose.
- An insurer can only rely on “formal and limited” exclusions written into the policy (Article L. 113-1 of the Insurance Code).
- Claim refusals are most often based on a late complaint, a risk declaration considered inaccurate, a policy exclusion or a disputed causal link.
- A refusal is not the end of the matter: a review of the policy, an exchange of arguments with the insurer, mediation and then legal action all remain open.
- Actions arising from the insurance contract are in principle time-barred after two years (Article L. 114-1 of the Insurance Code): time works against the policyholder.
Has your insurer refused to pay out? The refusal can be challenged, but the time limit to act is two years. Our cyber litigation lawyer (in French) page sets out the grounds for refusal that we challenge and the process. For an initial discussion, call the firm on 01 85 73 56 66 or write to us.
Cyber insurance covers the financial consequences of a cyberattack: incident management costs, business interruption losses, liability to third parties. But compensation is by no means automatic. Since the LOPMI Law of 24 January 2023 (law on the orientation and programming of the Ministry of the Interior), professionals must file a criminal complaint within 72 hours to keep their right to compensation for losses linked to the attack. And policies contain exclusions that the insurer can only rely on if they are formal and limited. This article reviews the cover, the legal conditions and the remedies when a claim is refused. Every situation is different.
What does a cyber insurance policy actually cover?
Cyber policies on the market generally combine three components. The first funds the incident response: technical investigation, restoration of systems, legal and notification costs, crisis communication. The second compensates the losses suffered by the company itself, chief among them business interruption losses caused by the halt in activity. The third covers the policyholder’s civil liability to third parties, for example its clients whose data has been compromised.
The exact scope varies widely from one contract to another. Some policies cover payment of a ransom, others exclude it. Some cap business interruption at a few days of downtime, others extend it to attacks suffered by a cloud provider. Reading the contract, clause by clause, comes before any other step. Our team does this upstream, when the policy is taken out, or downstream, when the loss has already occurred. For an overall view of the risk, see our cybersecurity lawyer page.
The complaint within 72 hours: the condition set by law
What Article L. 12-10-1 of the Insurance Code says
Introduced by Law No. 2023-22 of 24 January 2023 (LOPMI), Article L. 12-10-1 of the Insurance Code makes the payment of an indemnity covering losses caused by an attack on an automated data processing system (Articles 323-1 to 323-3-1 of the French Criminal Code (Code pénal)) subject to one condition: the victim must file a criminal complaint no later than 72 hours after becoming aware of the attack. Without a complaint within that period, the insurer may refuse to compensate the losses covered by this clause.
The starting point is not the date of the attack, which is sometimes earlier, but the date of its discovery by the victim. In practice, the complaint must therefore be one of the very first steps, even before systems are restored. We set out this sequence in our guide cyber attack: what to do in the first hours.
Who this condition applies to
Article L. 12-10-1 only covers legal entities and professionals acting in the course of their business. A private individual who is the victim of hacking does not have to meet this time limit to be compensated by their insurer. The condition also applies only to losses caused by the attack on the system: the other covers in the contract follow their own terms.
72 hours for the insurer, 72 hours for the CNIL: two separate time limits
The confusion is frequent and costly. The 72-hour period in Article L. 12-10-1 is a condition for insurance compensation and runs from the time the victim becomes aware of the attack. The period in Article 33 of the GDPR concerns the notification of a personal data breach to the CNIL, runs from the time the breach becomes known and applies only if the breach presents a risk to individuals. An attack may trigger one without the other. On this second aspect, see our personal data breach lawyer page.
Policy exclusions: what the insurer can rule out
Article L. 113-1 of the Insurance Code sets the rule: losses and damage are borne by the insurer, except for a “formal and limited” exclusion contained in the policy. A vague exclusion clause, open to interpretation, or so broad that it empties the cover of its substance, may be set aside by the court. The same provision excludes from any cover losses resulting from an intentional or fraudulent fault of the policyholder.
In cyber policies, the most disputed exclusions concern attacks attributed to a State or treated as acts of war, unmaintained or unpatched systems, ransom payments and failures of external providers. Each of these clauses is assessed against the legal test: is it precise, and does it leave real cover in place? A challenge to a refusal is often won on this ground.
On the specific question of the ransom, no French provision prohibits paying it as such; insurability is governed by the conditions of the LOPMI and the terms of the contract. Our article should you pay a ransomware ransom? sets out this framework.
Why cyber insurance claims are denied: the most common grounds
Four types of grounds recur in the claims handled by cyber insurers.
First, the late complaint: once the 72 hours of Article L. 12-10-1 have passed, the insurer invokes forfeiture of the right to compensation for losses. The debate then shifts to the actual date on which the victim became aware of the attack, which can be proved by any means: internal alerts, reports from technical teams, system logs.
Next, the risk declaration. When taking out the policy, the company answers a questionnaire on its level of security: backups, multi-factor authentication, business continuity plan. If reality departs from the answers given, the insurer may rely on a false declaration to reduce the indemnity or dispute the cover. The accuracy of the answers to the questionnaire is therefore a legal issue, not just a technical one.
The policy exclusion is the third ground: the insurer links the loss to an exclusion clause. The response is to test the clause against the requirements of Article L. 113-1: formal, limited, and strictly interpreted.
Finally, the amount of the loss and the causal link. Business interruption losses are calculated from accounting data that the insurer readily disputes: what share of the drop in activity comes from the attack, and what share from other factors? The demonstration relies on a quantified reconstruction, often debated by both parties, with the support of an expert.
How to challenge a claim refusal
The first step is a full legal review of the policy: general terms, specific terms, endorsements, application questionnaire. Many refusals rest on a broad reading of a clause that does not stand up to analysis. The second step is a written exchange of arguments with the insurer, with supporting documents: chronology of the discovery, proof that the complaint was filed, accounting data.
If the disagreement persists, mediation may be considered. The Médiation de l’assurance (French insurance ombudsman scheme), which is free, is however reserved for consumers under its charter: in principle, it has no jurisdiction over a policy taken out for the purposes of a business activity. Legal action remains open at any time, with one point to watch: actions arising from the insurance contract are in principle time-barred after two years from the event giving rise to them (Article L. 114-1 of the Insurance Code). A file left dormant may therefore expire before it has been argued. Our cyber litigation lawyer (in French) page presents these actions, including against providers whose failure contributed to the loss.
What the lawyer does, what the expert does
The lawyer does not audit your firewalls. The lawyer analyses the policy and the application questionnaire, characterises the loss in legal terms, makes the chronology of the complaint and the CNIL notification legally sound, challenges poorly drafted exclusions and quantifies the claim with your chartered accountant or a loss assessor acting for the policyholder. The lawyer coordinates with your teams and technical providers, who remain in charge of the investigation and remediation. If an attack is under way, our cyberattack lawyer for businesses page describes our urgent assistance. In Paris, Hashtag Avocats assists business leaders in negotiation and in litigation, including when the attack results from CEO fraud.
Cyber insurance FAQ
Does the 72-hour complaint deadline apply to private individuals?
No. Article L. 12-10-1 of the French Insurance Code reserves this condition for legal entities and professionals acting in the course of their business. A private individual who is the victim of hacking can still be compensated without a prior complaint, according to the terms of their contract.
Is filing a complaint within 72 hours enough to be compensated?
No. The complaint is a necessary condition, not a sufficient one. Compensation then depends on the cover taken out, the exclusions, the limits and excesses, and proof of the loss. A late complaint, on the other hand, means losing the right to compensation for the losses covered.
Can the insurer refuse to cover a ransom payment?
Yes, if the policy excludes it or does not provide for it. Where the cover exists, its payment is subject to the complaint condition in Article L. 12-10-1. Paying a ransom to a person targeted by European restrictive measures remains prohibited in any event.
What should you do if the insurer relies on a policy exclusion?
Check that it is “formal and limited” within the meaning of Article L. 113-1 of the French Insurance Code. An imprecise clause, or one that empties the cover of its substance, may be set aside. Analysing the exact wording of the clause is decisive.
How long do I have to take action against my insurer?
In principle two years from the event giving rise to the action (Article L. 114-1 of the French Insurance Code), subject to grounds for interruption. It is better to structure the challenge without delay.
Official sources
- Article L. 12-10-1 of the French Insurance Code, complaint within 72 hours and compensation for cyber risks (Law No. 2023-22 of 24 January 2023, LOPMI) – Légifrance (in French)
- Article L. 113-1 of the French Insurance Code, formal and limited exclusions, intentional or fraudulent fault – Légifrance (in French)
- Article L. 114-1 of the French Insurance Code, two-year limitation period for actions arising from the insurance contract – Légifrance (in French)
- Articles 323-1 to 323-3-1 of the French Criminal Code, attacks on automated data processing systems – Légifrance (in French)
- Articles 33 and 34 of Regulation (EU) 2016/679 (GDPR), notification of data breaches – EUR-Lex
- Cybermalveillance.gouv.fr (French government cyber-assistance platform), quick-response fact sheet (French title: “Rançongiciel ou ransomware : que faire si votre organisation est victime d’une attaque ?”; translation: Ransomware: what to do if your organisation is the victim of an attack?), reminder of the complaint within 72 hours – cybermalveillance.gouv.fr (in French)
This article presents the law for general information purposes. It does not constitute legal advice. Every situation is different and calls for a specific analysis. Content compliant with the professional conduct rules of the legal profession.
