Who Pays After The Hack? Emerging Paths For Cyber Recovery

Cyber claims have traditionally been treated as loss-containment files: identify the breach, stop the bleeding, restore operations, and pay the covered response costs. However, recent cases suggest a developing category of subrogation claims with meaningful recovery potential where a vendor, financial institution, managed service provider, professional advisor, or other commercial actor failed to meet a specific cybersecurity, verification, or incident-response obligation that contributed to the loss. These cases point to a developing area of recovery for cyber insurers and insured businesses, where cyber losses can sometimes be recovered from a third party even where a criminal is the immediate cause of the loss.