Ransomware Response
A ransomware event is a legal matter from the moment it is discovered—not after the technical cleanup is finished. Early decisions about communications, ransom negotiation, evidence preservation, and notification shape both regulatory exposure and the ability to recover under an insurance policy.
We help clients manage the response in coordination with forensic and incident-response teams, focusing on the decisions that carry legal consequences:
- Preserving privilege over forensic investigation and breach reports
- Evaluating the legal risk of ransom payment, including OFAC sanctions exposure where the threat actor may be a sanctioned entity
- Coordinating mandatory breach notification to regulators, customers, and affected individuals
- Documenting the incident to support an insurance claim and preserve recovery options
- Managing communications to limit litigation and reputational exposure
Data Breach Exposure
When a breach exposes personal, financial, or confidential business information, the organization faces overlapping obligations and risks: regulatory fines, mandatory notification under state and federal law, class action exposure, and loss of customer trust.
We advise clients on compliance with applicable data-privacy laws, coordinate the investigation and response, manage notification obligations across jurisdictions, and represent clients in regulatory proceedings and litigation that follow a breach.
Cyber Insurance Coverage Disputes
Most organizations carry cyber insurance expecting it to respond when an incident occurs.
Too often, the carrier denies or reduces the claim—relying on exclusions, conditions, and definitions buried in the policy. We fight those denials.
Common coverage disputes we handle include:
- Denial based on “failure to maintain” exclusions — the carrier claims the insured did not maintain the security controls represented in the application
- Application misrepresentation — the insurer attempts to rescind the policy based on alleged inaccuracies in the security questionnaire
- War / hostile act exclusions — the carrier characterizes a nation-state attack as an excluded “act of war”
- Social engineering vs. computer fraud — the insurer argues the loss falls under a coverage grant with a lower sublimit, or none at all
- Late notice — the carrier denies based on alleged failure to notify within policy deadlines
- Sublimits and definitional gaps — disputes over what counts as a covered “security failure,” “privacy event,” or “business interruption”
We pursue coverage through pre-litigation demands, bad-faith claims where the carrier’s denial is unreasonable, and litigation against the insurer where necessary.
Why These Matters Require Counsel Early
- Privilege is won or lost in the first hours. Forensic reports created without proper structuring become discoverable and can be used against the insured in coverage litigation.
- Ransom payment carries independent legal risk. Paying a sanctioned threat actor can itself violate federal law, regardless of the operational pressure to pay.
- Insurers investigate to deny. The carrier’s coverage counsel and forensic team are working to find a basis for denial from the moment the claim is filed. The insured needs its own counsel doing the same in reverse.
- Notification deadlines are short and overlapping. State, federal, and sector-specific notification rules run on different clocks, and missing them creates independent liability.
Contact Us
If your organization is facing an active ransomware demand, has suffered a data breach, or has had a cyber insurance claim denied, contact us at info@dilendorf.com or 212.457.9797 for a confidential consultation.
The decisions made in the first hours of an incident affect both regulatory exposure and the ability to recover under your policy.
Government Resources
Ransomware response & reporting
Sanctions & ransom-payment risk
Data breach & notification
Frameworks & standards
