Presenting a cyber, crime or D&O claim: documents and evidence

In short. An insurance claim is an evidence-based process. Claims mostly fail not because there is no loss but because the loss cannot be proved or has not been presented in accordance with the policy terms. A successful claim rests on three pillars: documentation, proof of the loss and the involvement of experts.¹

For claims handlers and loss adjusters, this chapter describes the claim file that a well-advised Estonian insured is expected to assemble, and the statutory rules (mitigation costs, advance payment, the one-year period for bringing an action) that frame the adjustment.

1. Documentation

The basis of the claim is correct and complete documentation describing what happened, when, how the company responded and what loss arose. Documentation must begin in the first hours: all decisions and actions are recorded, technical logs are preserved, and internal and external communications are documented.

Example. A company suffers a loss through fraud but cannot show when and how the payment was made, who approved it and what controls were in place. The insurer disputes the claim, although the loss did in fact occur.

Documentation must be consistent, accurate as to time and verifiable. The insurer may ask for original documents, system logs, internal rules and procedures. The company must therefore make sure, even before a loss, that the necessary documents exist and can be found.

Core package for a typical claim:

2. Proving the loss

Insurance does not cover an abstract risk but a specific, proven loss. The company must show the existence of the loss, its extent and the causal link with the insured event. The law provides the starting point in indemnity insurance: the loss resulting from the insured event is compensated within the sum insured, but lost profit only if this has been separately agreed (Law of Obligations Act (võlaõigusseadus, VÕS) § 476 lg 4).²

• Cyber insurance: restoration costs (invoices, working hours), loss from business interruption (a comparison with turnover and cost structure in earlier periods), data breach costs (notification, call centre, credit monitoring, legal advice).
• Crime insurance: the direct monetary loss (bank statements), the movement of the money and the amounts recovered, the fraud mechanism, the time of discovery.
• D&O insurance: the existence and content of the claim, defence costs (lawyers' hourly fees, experts), the possible basis of liability and the reasonableness of a settlement.

Example. A company asserts that a cyber incident caused it a loss of one million euros but has no calculation of the business interruption impact (lost sales revenue, saved costs, additional costs). The insurer reduces the indemnity substantially.

Direct and indirect loss

Many policies cover only direct loss or limit indirect loss. The loss must therefore be structured in line with the policy terms:

• direct loss (stolen money, the cost of restoring destroyed data);
• additional costs of continuing operations;
• lost profit (only if agreed);
• third-party claims (liability cover);
• investigation, legal and communication costs (often a separate extension).

Costs of mitigating the loss

The insurer reimburses reasonable costs incurred to prevent and reduce the loss even if the measures were unsuccessful (VÕS § 488, § 491).³ These costs must be shown separately in the claim.

Advance payment

If the steps needed to determine the extent of the insurer's performance have not been completed within one month of notification of the insured event, the policyholder may, once the occurrence of the insured event has been established, demand payment on account of the minimum amount that the insurer should pay in the circumstances (VÕS § 450 lg 3).⁴ In a large business interruption loss, this is often decisive for liquidity.

3. The role of experts

In complex losses, the involvement of experts is decisive.

• IT forensic experts establish the nature and extent of the attack and support the technical proof.
• Financial forensic experts reconstruct cash flows, establish the exact amount of the loss and analyse transactions.
• Loss adjusters and forensic accountants calculate the business interruption loss.
• The lawyer qualifies the event, ensures that the claim complies with the policy, manages communication with the insurer and protects the company's interests in a dispute.

Example. In a complex cyber incident, the forensic firm prepares a detailed report. The lawyer uses it to structure the claim and to answer the insurer's questions. Without such cooperation, the claim remains weak.

In some cases the expert must be approved by the insurer, independent and qualified in the relevant field. The insurer's claims handler is not the policyholder's representative; in large losses it is reasonable for the policyholder to involve its own expert as well. The insurer must reimburse the necessary costs of establishing the loss and its amount, but not the cost of hiring an expert or adviser unless the policyholder was obliged by the contract to do so (VÕS § 491 lg 1).³

4. Presenting the claim strategically

The claim must be timely, clearly structured and take account of the policy terms and limitations. A claim that is too general, the omission of material circumstances and contradictory information must be avoided.

It is often sensible to present the claim in stages: first the notification, then a preliminary loss estimate and the first costs (forensics, restoration), and later supplements once the extent of the business interruption and of third-party claims has become clear. This allows the indemnification process to start early.

The insurer's decision must be awaited within the time provided by law and by the contract. If the insurer refuses, a written and reasoned decision should be requested, and it should be checked whether the decision gives notice of the one-year period for bringing an action (VÕS § 475 lg 3). The period starts to run from receipt of the decision.⁵

5. Typical mistakes

• insufficient documentation;
• an inaccurate or unsubstantiated estimate of the loss;
• late presentation of the claim;
• failure to involve experts;
• disregard of policy conditions (form, time limits, consents);
• failure to declare amounts recovered or other compensation received.

These mistakes can lead to a reduction of the indemnity, rejection of the claim and a prolonged dispute.

6. Structure of the claim: a model table of contents

For a larger claim, it is sensible to present the claim as a structured document.

1. Summary: what happened, when, the amount claimed by component, a reference to the contract and the policy.
2. Facts: a timeline with evidence (forensic report, bank documents, crisis log).
3. Insured event: why the event meets the definition of the insured event in the policy; where relevant, separately under several policies.
4. Compliance with obligations: when and how notice was given, which instructions were followed, how the loss was mitigated.
5. Loss calculation: the components (direct loss, restoration costs, business interruption, third-party claims, investigation costs) with supporting documents.
6. Exclusions and defences: why possible exclusions do not apply (for example, why the attack is not an act of war).
7. Request: payment of the indemnity and, where appropriate, an advance payment.
8. Annexes: a list of documents.

7. Principles for calculating the business interruption loss

The business interruption loss is often the largest and most disputed component. The usual approach is as follows.

• Comparison period: what turnover and profit would have been without the interruption (the same period of the previous year, trends, seasonality, order book).
• Actual result during the interruption.
• Saved costs: costs avoided during the interruption (for example raw materials, part of the labour costs) reduce the indemnity.
• Additional costs: the costs of continuing operations (overtime, temporary premises, subcontracting) are compensated if they are covered by the policy and reasonable.
• Waiting period and indemnity period: a loss arising during the waiting period is borne by the insured as a deductible; a loss arising after the end of the indemnity period is not covered.

Lost profit is compensated only if this has been agreed in the policy (VÕS § 476 lg 4).² The calculation should be made together with an accounting expert, and the data required should be agreed with the insurer's claims handler early on.

8. Mitigating the loss and maximising the indemnity

The policyholder's interest is to receive the indemnity quickly and in full; the insurer's interest is to be satisfied that the loss is covered and proven. The point where these interests meet is a well-documented and honestly presented claim. Practical steps:

• present the first costs (forensics, restoration) at once, with invoices, so that indemnification can start;
• agree with the insurer which data are needed to calculate the business interruption loss before you start collecting them;
• record every amount recovered and every compensation received from other sources (bank, service provider, wrongdoer);
• do not exaggerate the loss: a knowingly false claim may give the insurer grounds to be released and may be a criminal offence; staging or causing the insured event, or creating a false impression that it occurred, is insurance fraud (Penal Code (karistusseadustik, KarS) § 212), while knowingly inflating the amount of a genuine loss may be assessed as fraud (KarS § 209); an honest calculation or valuation error is neither.⁶

Related pages

• Evidence and forensics
• Typical coverage disputes
• Estonian Supreme Court: notification, proof and due date
• Ärikatkestuskindlustus (business interruption insurance, in Estonian)

References