Are GDPR fines covered?

Fines are excluded in the model wording unless agreed otherwise. Legal costs, notifying affected people and defending claims are often covered.

Insurance broker / Insurance questions / Cyber insurance

When does cyber insurance not pay out in Germany?

In short

When does cyber insurance not pay out in Germany? Mainly when questions on the application were answered wrongly, security duties such as updates and backups were seriously neglected, the attack started before the policy began, or an exclusion applies: war, a wide power or internet outage, ransom, or money your staff sent to fraudsters. A mistake alone is often not enough: it must have contributed to the loss.

Request a quote +49 3375 29 12 77

What it costs

What a small business in Germany may still carry after a cyber claim despite having insurance.

Example	Typical range
Average reported cyber claim in Germany, 2025	about EUR 43,200
Deductible per claim, small business	about EUR 500 to 2,500
Time deductible for business interruption	about 6 to 24 hours not reimbursed
Security duty breached intentionally	EUR 0 paid
Security duty breached with gross negligence	reduction between 0 and 100 percent depending on fault

Average claim according to the German insurers' association for 2025.

Consequences of breaches follow the model wording of February 2024; your policy may differ.

Deductibles and time deductibles are guide values from quoting practice.

Worked example

Trades business, 8 employees, encryption after a fake email

How a EUR 60,000 loss can be split when part of it is not insured.

IT forensics and recovery	EUR 25,000, insured
Business interruption, 5 days	EUR 30,000, of which EUR 3,000 for the first 12 hours is not paid
Ransom demand	not paid and not insured
Transfer to a fake bank account the same week	EUR 5,000, not insured without an extra module
Deductible	EUR 1,000

The cyber policy pays about EUR 51,000. Around EUR 9,000 stays with the business, mostly the transfer and the deductibles.

Four reasons a cyber policy refuses to pay

Whether your cyber insurance pays depends on four things: your answers on the application, the security duties in the contract (Obliegenheiten), the exclusions, and whether the loss is a type the policy covers at all. An attack can be real and expensive and still not be insured.

Most German insurers base their wording on the model conditions of their trade association, the GDV. These are not binding, so each policy can be narrower or wider. Treat this page as a map of the usual pitfalls, not as a substitute for reading your own terms.

Reason	What happens	How to protect yourself
Wrong answers on the application	insurer withdraws or reduces, if the error contributed to the loss	answer together with whoever runs your IT, keep a copy
Security duty breached	no payment if intentional, reduction if grossly negligent	keep updates, backups and anti-malware documented
Exclusion applies	no payment however careful you were	read and compare exclusions before signing
Loss type not covered	for example your own transfer to a fraudster	add the missing module on purpose

Wrong answers on the application

Before signing, the insurer asks risk questions: do you have backups, are updates installed promptly, does every employee have their own login? Ticking yes too quickly hands the insurer its strongest argument after a claim. Under the German Insurance Contract Act (VVG), it may withdraw, terminate or adjust the contract if your answers were wrong.

It still has to pay if the misstated fact caused neither the attack nor the size of the loss, unless you deceived it on purpose. A regional court in Tübingen decided exactly that in 2023: not all servers were up to date, but the attackers used a route those updates would not have closed, so the insurer had to pay. The ruling was not final, so do not count on the same outcome.

Security duties before an attack

The model cyber wording requires, among other things, individual logins for every user, passwords meeting minimum rules, anti-malware that updates itself, prompt security updates and a backup at least once a week that an attacker cannot encrypt along with everything else.

If you breach one of these duties intentionally, the insurer pays nothing. If you were grossly negligent, it may reduce the payment in proportion to the fault. Here too: if you can show the breach did not cause the attack or increase the damage, the payment stands. A short log of updates and backup tests is worth keeping.

Exclusions that care cannot fix

Some losses are simply not covered by cyber insurance. In the model wording they include war and state attacks that also hit critical infrastructure, wide outages of power, phone or internet, terrorism, ransom payments, fines and penalties, and attacks that happened before the policy started.

One exclusion many people miss is the outflow of assets (Abfluss von Vermögenswerten): money leaving your account because someone believed a fake invoice or a fake instruction from the boss. That needs a separate module or fidelity insurance (Vertrauensschadenversicherung).

What can go wrong after the attack

After an attack you also have duties: report it at once, use the insurer's hotline, follow its instructions and do not destroy evidence. Hiring your own IT firm and wiping the systems before anyone has secured the cause invites a dispute about the costs.

For business interruption there is almost always a time deductible: you carry the first hours of downtime yourself. On top comes the agreed deductible per claim. Several attacks with the same cause count as one claim with one shared limit under the model wording.

When a refusal can be challenged

If the insurer refuses a cyber claim, check its reasons calmly. It has to prove that you breached a duty, and for withdrawal or reduction it matters whether that breach really caused the loss. For a state attack, the burden of proof also lies with the insurer under the model wording.

An insurance broker (Versicherungsmakler) works for you when choosing the policy and can help you understand the insurer's arguments in a dispute. For large sums, the case belongs with a lawyer specialising in insurance law.

Step by step

Answer the risk questions together with whoever looks after your IT.
Keep a copy of the completed application with your policy documents.
Log updates, backups and backup tests briefly and regularly.
Read the exclusions and security duties before you sign.
Check whether payment fraud is covered by a module or by fidelity insurance.
In an emergency, call the insurer's hotline first, then act.

Checklist

Risk questions answered truthfully and agreed with IT
Every user has an individual login, admin accounts separate
Security updates installed promptly, with evidence
Backup at least weekly and kept offline
Restoring from backup tested at least once
Payment fraud module checked
Insurer's hotline number available offline

Common mistakes

Ticking yes to every risk question
Assuming cyber cover replaces money sent to fraudsters
Rebuilding systems after an attack before the cause is secured
Not reporting new sites or systems when the policy requires it
Accepting a refusal without checking whether the breach actually caused the loss

Questions and answers

Frequently asked

Does cyber insurance pay if an update was missing?

Not automatically no.

What counts is whether the missing update contributed to the attack or its size.

Gross negligence allows a reduction, intent allows a refusal.

Is ransom reimbursed?

Not under the model wording.

Some policies have their own rules.

Never pay without agreeing it with the insurer and the police.

Are attacks by foreign state hackers excluded?

Not all of them.

The model wording excludes war and state attacks that also hit critical infrastructure.

The insurer has to prove the link to a state.

Does it pay for a power cut?

Usually not for a wide outage of power, phone or internet.

Your own server going down because of an attack is the core of the policy.

Can the insurer cancel after a claim?

Yes, many policies allow this.

After a large claim, expect a new offer on different terms.

Sources

NAMMERT insurance broker

Request a quote: Cyber insurance

We compare insurers and come back to you, in English.

Free; the insurer pays our fee.

1Who is it for?

Personal My company

Company Industry Number of employees Annual turnover (roughly)

2Which insurance?

Choose as many as you like. For each one, the details an insurer needs for a quote appear below.

Personal

Business

Please review all my existing policies

3Details

Cyber insurance for businesses in Germany

Annual company turnover *

Number of employees *

Sector and business activity *

Do you sell online or accept card payments? *

How is your data backed up? *

Is multi-factor authentication set up for email and remote access? *

Security incidents in the last five years *

Preferred limit of indemnity

Rule of thumb: cost of three to four weeks of downtime plus recovery

4Your current policy

Current insurer Policy ends on What matters more to you?

5How can we reach you?

Name * Email * Phone Postcode Town Preferred contact Anything else we should know