# Cyber, crime and D&O insurance: interplay and boundaries URL: https://insurancelawestonia.ee/specialty-lines/handbook/cyber-crime-d-and-o-interaction/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-09 > Which policy covers which loss, where the grey areas lie and how a loss can fall between cyber, crime and D&O policies under Estonian law. > **In short.** Cyber, crime and D&O insurance are functionally different: the first answers the question "what happened to the systems", the second "where did the money go" and the third "who is liable". A real incident, however, moves between them. Grey areas arise above all in social engineering fraud, business interruption, the distinction between direct and indirect loss, and the war exclusion. Where definitions do not match, exclusions overlap or extensions are missing, the loss may fall between two stools.[^1] The lines of insurance themselves are covered in the guides on [cyber claims](https://insurancelawestonia.ee/guides/cyber-claims-estonia), [crime and fidelity claims](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia) and [D&O claims](https://insurancelawestonia.ee/guides/d-and-o-claims-estonia). This chapter concentrates on the boundaries between them, which is where most allocation questions between insurers of the same insured arise. **Figure 1. One incident, three policies: cyber, crime and D&O** Example: fraudsters take over a company's e-mail, send a falsified payment instruction in a supplier's name and the money is paid to the fraudster's account. Later the shareholders claim damages from the management board members. - **Cyber insurance** (Depends on the policy) Incident response, restoration of systems, data protection and notification costs and third-party claims, depending on the insuring clause. Loss of the transferred funds is often excluded or disputed. - **Crime insurance** (Depends on the policy) Paying on a falsified instruction may require a social engineering or impersonation extension; check the sub-limit and the call-back condition. Employee dishonesty and external fraud are different insuring clauses. - **D&O insurance** (Depends on the policy) Responds when a covered claim is made against a director, e.g. for breach of the duty of care. The company's own financial loss is not a D&O insured event. > Statutory rule: The same loss is not indemnified twice, but different policies may cover different parts of the loss from the same incident (Law of Obligations Act (võlaõigusseadus, VÕS) § 486(2)). The outcome depends on the actual policies. An e-mail takeover does not in itself establish a crime insured event. Legal basis: [VÕS § 422(1), § 486, § 510](https://www.riigiteataja.ee/akt/120062026018). Statutory text checked against the version in force on 9 November 2026. ## 1. Which policy covers what? The distinction is based on the nature of the loss and its legal classification. **Cyber insurance** focuses on technical and operational risks arising from disruptions of, or attacks on, IT systems: - the costs of restoring systems and data; - forensic and incident investigation costs; - loss from business interruption (where agreed, see Law of Obligations Act (*võlaõigusseadus*, VÕS) § 476 lg 4);[^2] - data breach costs (notification, call centre, credit monitoring, legal advice); - third-party claims for data protection and network security breaches; - often also the costs of crisis communications, extortion and regulatory proceedings. **Crime insurance** focuses on direct pecuniary loss resulting from fraud or embezzlement: - embezzlement or fraud committed by an employee (employee theft, employee dishonesty); - fraudulent payment instructions and social engineering (fraudulent instruction, social engineering); - computer fraud and funds transfer fraud; - forgery and the manipulation of payment orders; - often also client property that the policyholder holds or manages. **D&O insurance** covers neither the company's technical loss nor its direct pecuniary loss, but claims made against members of the management and supervisory boards: - defence costs (legal costs in civil, administrative and criminal proceedings according to the policy and VÕS § 511 lg 1–2);[^3] - claims by shareholders, creditors and the bankruptcy trustee; - the costs of regulatory proceedings; - liability for the publication of incorrect information or for management errors. **Simplified logic:** | Question | Risk | Primary policy | |---|---|---| | What happened to the systems? | Cyber risk | Cyber insurance | | Where did the money go? | Crime risk | Crime insurance | | Who is liable? | Management risk | D&O insurance | **Example.** A company falls victim to ransomware and its systems stop. Cyber insurance covers restoration and business interruption. If money is transferred to fraudsters at the same time, that may fall under crime insurance. If investors later make a claim against the board for inadequate risk management, D&O insurance is triggered. ## 2. Grey areas and conflicts The theoretical distinction is clear, but grey areas arise in practice. They are the main source of disputes. ### 2.1 Fraud by cyber means In a social engineering scheme in which an employee is induced to make a payment, the cyber insurer may argue that there was no attack on the system but the deception of a person. The crime insurer may argue that the loss was not "direct" because the employee made the payment personally. US case law is divided: Medidata (2nd Circuit, 2018) and American Tooling Center (6th Circuit, 2018) held that computer fraud cover applied, while Apache (5th Circuit, 2016) reached the opposite conclusion (see the [case collection](https://insurancelawestonia.ee/specialty-lines/handbook/cases)). From the perspective of Estonian law it is important that any ambiguity in delimiting the insured event in a standard term must be interpreted against the user of the term (VÕS § 39).[^4] This does not, however, create cover where the policy is clearly worded so that a payment entered by the employee personally is not computer fraud and there is no separate social engineering cover. ### 2.2 Business interruption If systems stop because of a cyber attack, that is a cyber risk. If the interruption results from fraud (for example, a lack of money to make payments) or from a supply-chain disruption, the question arises whether it falls under cyber or crime insurance. Crime insurance does not as a rule cover business interruption. ### 2.3 Direct and indirect loss Crime insurance usually covers only direct pecuniary loss. If the company pays EUR 500,000 to a fraudster, that is direct loss. On top of it come investigation costs, a systems audit, contractual penalties to partners and interest costs. Crime insurance may cover only the original payment (depending on whether the policy contains an investigation costs extension), and the cyber insurer may argue that there was no technical attack. US case law has also interpreted "direct loss" broadly: in Cargill, additional freight costs of USD 29 million were held to result directly from an employee's fraud (see the [case collection](https://insurancelawestonia.ee/specialty-lines/handbook/cases)). ### 2.4 Management liability If the incident leads to a claim against the board, that is a D&O risk. The D&O policy may, however, contain a cyber incident or data breach exclusion on the assumption that these are covered by cyber insurance, while cyber insurance in turn does not cover the personal liability of the executives. In addition, the insurer may challenge the extent of the indemnity by arguing that the event was caused by intent or by conscious risk-taking. ### 2.5 Conflicts between insurers One insurer may argue that the loss falls under another policy. The company must then initially bear the costs itself and resolve the dispute later. In the case of multiple insurance, the insurers are jointly and severally liable under Estonian law (VÕS § 486), but this presupposes that both policies cover the same interest.[^5] ## 3. The "falling between two stools" problem The practical expression of the grey areas is a situation in which the loss does not clearly qualify under any policy. This arises above all for three reasons: 1. the definitions in the policies do not match; 2. the exclusions overlap; 3. the necessary extensions are missing. **Example.** A company suffers a loss through cyber fraud with a possible geopolitical background. The cyber policy excludes state-sponsored cyber operations, the crime policy excludes indirect loss and the D&O policy does not cover direct financial loss. A significant part of the loss remains unprotected. On war exclusions, see [war exclusions and cyber insurance](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber). ## 4. Designing the boundaries deliberately These problems are not inevitable. Designing the boundaries deliberately means that: - **the definitions are consistent**: "computer system", "fraud", "direct loss", "insured person" and "claim" mean the same thing in all policies, or at least leave no gap between them; - **the exclusions do not create holes**: the war exclusion has the same wording in all policies, and cyber terrorism is distinguished from war between states; the cyber exclusion in the D&O policy does not exclude the personal liability of the executives; - **the significant risks are covered by extensions**: social engineering cover in either the crime or the cyber policy with an adequate sub-limit; business interruption in the event of an IT outage; investigation costs; client property. A practical check: | Scenario | Cyber | Crime | D&O | Gap? | |---|---|---|---|---| | Ransomware, restoration of systems | yes | no | no | Check the backup condition and the waiting period | | Fraudulent payment instruction in a supplier's name | disputed (often excluded) | yes, if there is a social engineering extension | no | Check the sub-limit and the call-back condition | | Employee embezzlement | no | yes | no | Check the discovery period and client property | | Data breach, customer claims | yes | no | no | Check the contractual liability exclusion | | Investor claim against the board after a data breach | no | no | yes | Check the cyber exclusion in the D&O policy | | State-sponsored cyber attack | depends on the exclusion | depends on the exclusion | possibly (defence costs of a claim against the directors, subject to the trigger, exclusions, the insurer's consent and the limit) | Harmonise the war exclusion | ## 5. Three practical questions for checking consistency between policies **1. Does the same word mean the same thing in all policies?** Compare the definitions of "computer system", "fraud", "loss", "claim" and "insured person". If the cyber policy defines the computer system more narrowly than the crime policy, a fraudulent payment made through a service provider's system may fall between the two policies. **2. Do the exclusions refer to each other?** Look for wording such as "loss covered by other insurance" or "except to the extent covered by cyber insurance". If two policies refer to each other, each may argue that the other is liable. **3. Do the triggers and periods match?** If the cyber policy is written on a loss-occurring basis, the crime policy on a discovery basis and the D&O policy on a claims-made basis, the same event may be split between different insurance periods. Check retroactive dates and extended reporting periods, especially when the insurer changes. These three questions should be put to the broker in writing before every renewal. ## 6. Summary The boundaries between the three lines are clear in theory but blurred in practice. Each policy covers a different type of risk, but the same event can touch all of them. For the company this means that the insurance programme cannot be handled piecemeal. What is needed is a holistic approach that takes account of the links between the policies; it is described in the chapters [avoiding coverage gaps](https://insurancelawestonia.ee/specialty-lines/handbook/coverage-gaps) and [notification and claims strategy across several policies](https://insurancelawestonia.ee/specialty-lines/handbook/notification-across-policies). ## Related pages - [Riskistsenaariumid](https://kindlustusoigus.ee/riskijuhtimine/stsenaariumid/) (practice-based scenarios, in Estonian) - [Integrated insurance programmes](https://insurancelawestonia.ee/specialty-lines/handbook/integrated-programmes) - [Cyber claims in Estonia](https://insurancelawestonia.ee/guides/cyber-claims-estonia) - [Crime and fidelity claims in Estonia](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia) - [D&O claims in Estonia](https://insurancelawestonia.ee/guides/d-and-o-claims-estonia) - [War exclusions and cyber insurance under Estonian law](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber) ## References [^1]: O.-J. Luik. Ettevõtte juhtkonna riskiraamat [A risk handbook for company management]. Manuscript, as of 03.05.2026, ch 28. [^2]: Law of Obligations Act (võlaõigusseadus, VÕS) § 476 lg 4. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: . [^3]: VÕS § 510, § 511 lg 1–2 (n 2). [^4]: VÕS § 39 (n 2); RKTKo 11.06.2007, 3-2-1-64-07, p 9–13. . [^5]: VÕS § 486 (n 2).