The Hague appeal court orders insurer to reimburse ransom paid after ransomware attack
The Hague Court of Appeal has ruled that an insurance company must reimburse the ransom a client paid after a ransomware attack, upholding the lower court's judgment against the insurer.
The Court of Appeal in The Hague has ruled on appeal that an insurance company must reimburse the ransom a client paid after a ransomware attack. In 2021 the affected company, which was not named, was hit by DoppelPaymer ransomware. Vital backup systems of the company were affected in the attack, and the attackers managed to steal more than thirteen thousand files.
The affected company brought in a cybersecurity firm, which ultimately paid the ransom to the criminals on the company's behalf. The size of the ransom has not been made public. The company did hold cyber insurance and then submitted a claim to the insurer. The insurer refused to reimburse the ransom because the ransomware group is on a US government sanctions list, and the sanctions clauses therefore applied.
The company then went to court and demanded that the damage be paid after all. According to the court, the insurer had insufficiently substantiated that it risks sanctions from the US government if it reimburses the ransom payment. “The mere possibility that OFAC can impose secondary sanctions on [the appellant] is insufficient to attach legal consequences to that claim in these proceedings,” the court said, upholding the district court's judgment. Because the insurer again came off worst, it must also pay the company's legal costs.
Sources
- Security.nl · 21-Oct-2026