Blog Details | MyKava - Imana Insurance Agency

09 09

Author: Raymond
Category: Cyber Security Insurance

Cyber Insurance Claims Kenya: Incident Response Guide

Learn how to file a cyber insurance claim in Kenya after ransomware, data loss, cybercrime, business interruption or a personal-data breach.

A cyber incident moves quickly.

Within minutes, criminals can encrypt files, redirect payments, copy customer information and spread through connected systems. Within hours, the business may face operational disruption, customer questions and regulatory reporting decisions.

What an organisation does during those first hours can determine both the scale of the damage and whether its cyber insurance claim proceeds smoothly.

Quick answer: After discovering a cyber incident, activate the organisation’s response plan, contact the cyber insurer immediately, preserve digital evidence, isolate affected systems, engage approved specialists and begin assessing regulatory notification duties. Do not delete logs, rebuild systems, contact attackers or pay a ransom without professional guidance.

Imana Insurance Agency Kenya Ltd helps businesses notify cyber insurers, understand claims requirements and coordinate communication during the claims process.

Start a claim through the Imana Claims Request Page.

What is a cyber insurance claim?

A cyber insurance claim is a request for an insurer to meet eligible costs or liabilities arising from a cyber incident covered by the policy.

An incident may involve:

Ransomware
Data breach
Malware
Business-email compromise
Phishing
Social-engineering fraud
Unauthorised fund transfer
Data destruction
System interruption
Privacy liability
Network-security failure
Cyber extortion
Failure of a technology provider
Lost or stolen equipment containing data

Not every computer problem is an insured cyber incident.

Ordinary hardware failure, gradual deterioration, planned system maintenance and known problems existing before the policy began may be excluded.

The insurer must examine the incident against the policy wording, limits, exclusions and declarations made when the cover was purchased.

The first hour after discovering a cyber incident

The first hour should focus on containment, evidence and notification.

1. Activate the incident-response plan

Notify the people responsible for:

Information technology
Cybersecurity
Legal and compliance
Data protection
Finance
Senior management
Business continuity
Communications
Insurance

Appoint one incident coordinator. Uncontrolled decision-making can produce inconsistent instructions and destroy evidence.

2. Contact the cyber insurer immediately

Use the emergency telephone number or reporting channel shown in the policy.

Provide the available facts:

Policyholder’s name
Policy number
Date and time the incident was discovered
Systems affected
Nature of the suspected event
Whether operations have stopped
Whether personal data may be involved
Whether money has been lost
Whether a ransom demand has been received
Immediate containment steps taken

Do not wait until the investigation is complete. The full nature of a cyber incident may take days to understand.

3. Contact Imana Insurance Agency

Imana can help the policyholder:

Confirm insurer notification details
Locate the policy schedule
Obtain the claim form
Open communication with the insurer
Identify required documents
Follow up on appointment of specialists
Maintain a claims correspondence record

Imana cannot replace the organisation’s IT, legal or forensic advisers, but it can help coordinate the insurance pathway.

4. Isolate affected systems

The IT or cybersecurity team may need to disconnect affected devices from the network to prevent further spread.

Possible immediate actions include:

Disconnecting compromised devices
Restricting remote access
Disabling affected user accounts
Blocking malicious domains
Suspending compromised credentials
Separating clean backups
Restricting unnecessary network connections

Do not wipe, reformat or dispose of affected devices unless authorised by the incident-response specialists. Isolation preserves evidence; destruction can erase it.

5. Protect unaffected backups

Confirm whether backups are:

Available
Recent
Separated from the compromised network
Free from malware
Capable of being restored

Do not connect clean backups to infected systems prematurely. Attackers sometimes compromise backups before activating ransomware.

Preserve digital evidence

Evidence helps determine what happened, how the attacker entered, what information was accessed and whether the claim is covered.

Preserve:

System logs
Firewall logs
Email headers
Suspicious emails
Screenshots
Ransom notes
Malicious attachments
Affected devices
Access records
Login histories
Bank-payment instructions
CCTV where relevant
Security alerts
Backup records
Communications with the attacker
Employee statements
Service-provider correspondence

Record who collected each item, when it was collected and where it is stored.

Do not forward malicious attachments casually. The incident-response team should provide a secure evidence-transfer process.

Do not admit liability publicly

A serious breach can attract questions from customers, employees, journalists, regulators and business partners.

Avoid speculative statements about:

Who caused the incident
How much information was stolen
Whether customers are safe
Whether the business was negligent
Whether a ransom will be paid
When every system will return
Whether the insurer will pay

Public communication should be coordinated with legal, privacy and communications specialists.

Be truthful, but do not announce conclusions before the forensic investigation establishes the facts.

Use insurer-approved incident-response specialists

Cyber policies often provide access to an approved response panel.

This may include:

Digital-forensics investigators
Cybersecurity specialists
Privacy lawyers
Ransomware negotiators
Data-restoration professionals
Customer-notification providers
Public-relations advisers
Credit-monitoring services

Before appointing an external provider, ask the insurer:

Is prior approval required?
Is the provider on the insurer’s panel?
What rates are approved?
Which policy section will pay the cost?
Does a sublimit apply?
Will the cost erode the overall limit?

Emergency action may be necessary to prevent further loss, but all decisions and reasons should be documented.

Reporting a cyber incident to KE-CIRT

The National Kenya Computer Incident Response Team Coordination Centre provides an official channel for reporting cyber incidents and seeking assistance.

KE-CIRT’s published reporting channels include its online portal, incidents@ke-cirt.go.ke, and dedicated telephone hotlines.

Reporting to KE-CIRT may be appropriate for incidents involving:

Malware
Ransomware
Phishing
Website compromise
Distributed denial-of-service attacks
System intrusion
Online fraud
Compromised accounts
Critical infrastructure
Threats affecting multiple organisations

Contacting KE-CIRT does not replace insurer notification or reporting to the Office of the Data Protection Commissioner.

Does a data breach need to be reported to the ODPC?

Kenya’s Data Protection Act contains notification requirements where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the affected data subject.

A qualifying breach should be reported to the Data Commissioner without delay and within 72 hours of the data controller becoming aware of it. Where notification is submitted after 72 hours, reasons for the delay are required.

Data processors have separate duties to notify the data controller.

The Office of the Data Protection Commissioner provides an official breach-reporting form for data controllers and processors. The form requests details about:

The breach
The information involved
Affected people
Immediate containment
Planned corrective action
Communication with data subjects
Reports made to other regulators
Supporting documents

(Office of the Data Protection ...)

Not every technical event triggers the same notification requirement. Obtain prompt legal and data-protection advice.

The insurer should be informed before regulatory submissions where possible, but waiting for insurance confirmation must not cause the organisation to miss a legal deadline.

How to make a ransomware claim

After discovering ransomware:

Disconnect affected systems where technically appropriate.
Contact the insurer’s incident-response hotline.
Preserve the ransom note and evidence.
Do not delete encrypted files.
Protect clean backups.
Engage approved forensic specialists.
Notify legal advisers.
Assess reporting obligations.
Record operational downtime.
Document every recovery expense.

Do not pay the ransom independently.

Ransom payment may be unlawful, uninsurable or prohibited by the policy. Payment can also expose the organisation to further demands without guaranteeing system recovery.

Where cyber-extortion cover applies, the insurer may appoint specialists to evaluate the demand, threat actor and available recovery options.

How to make a data-restoration claim

The organisation should document:

Systems and data affected
Date of the last known clean backup
Restoration work required
Providers appointed
Labour hours
Software licences
Replacement configurations
Data reconstruction
Testing and verification
Costs already incurred

The policy may pay the reasonable cost of restoring data and systems to their pre-incident condition.

It may not pay for:

System improvements
Unrelated technology upgrades
Betterment
Ordinary maintenance
Pre-existing system problems
Unsupported software
Costs incurred without approval

Separate restoration work from general IT upgrades in quotations and invoices.

How to claim cyber business-interruption losses

Cyber business-interruption claims require detailed financial evidence.

Immediately begin recording:

When the interruption started
Which systems were unavailable
When each system was restored
Activities that could not be performed
Orders lost
Revenue affected
Additional operating costs
Temporary systems used
Staff overtime
Emergency vendor costs
Customer cancellations
Production delays
Mitigation measures

The insurer may require:

Audited financial statements
Management accounts
Sales records
Bank statements
Tax records
Historical revenue
Budgets and forecasts
Daily transaction records
Evidence of lost orders
Additional-expense invoices
Accountant’s report

The policy may include a waiting period. Losses arising during that initial period may remain with the insured.

The organisation must also take reasonable steps to reduce the interruption. Record every mitigation decision and its cost.

Claims involving an outsourced technology provider

If a cloud, payment, hosting, software or other technology provider suffers the incident:

Notify the cyber insurer immediately
Obtain the provider’s incident notice
Preserve the service contract
Request the incident timeline
Record system unavailability
Document financial loss
Ask whether customer information was affected
Request confirmation of restoration steps
Preserve service-level reports

Cover will depend on whether dependent business interruption or outsourced-provider failure is insured.

The provider’s outage does not automatically make the organisation’s cyber policy respond.

How to claim social-engineering or funds-transfer losses

Where an employee sends money after receiving fraudulent instructions:

Contact the bank or payment provider immediately.
Ask for the transfer to be recalled or frozen.
Notify the police and other relevant authorities.
Inform the cyber or crime insurer.
Preserve the fraudulent email or message.
Preserve email headers and login records.
Suspend compromised accounts.
Contact the genuine supplier or executive through a trusted channel.
Document the verification procedure that was followed.
Record recovery attempts.

The insurer may ask:

Who authorised the payment?
How were the instructions received?
Were bank details changed?
Was a call-back verification required?
Were two authorisations used?
Was the employee’s account compromised?
Was the transfer voluntary?
How quickly was the bank informed?

Social-engineering losses are not automatically covered under every cyber policy. A specific extension and sublimit may be required.

Documents required for a cyber insurance claim

Requirements will depend on the incident, but the insurer may request:

Completed claim form
Policy schedule
Incident timeline
Internal incident report
Forensic report
System and access logs
Ransom note
Suspicious emails
Screenshots
Police report
KE-CIRT report
ODPC notification
Correspondence with affected people
Legal reports
IT-provider invoices
Data-restoration invoices
Business-interruption calculation
Financial statements
Bank records
Proof of fraudulent transfers
Technology-provider contracts
Backup records
Security policies
Proof of declared security controls
Employee statements
Previous incident information

Keep a master document index showing when each item was requested and submitted.

Keep an incident and claims timeline

Create one chronological record showing:

When the incident began, if known
When it was discovered
Who discovered it
Systems affected
Containment actions
Insurer notification
Specialist appointments
Regulatory reports
Customer communication
System restoration
Expenses incurred
Business interruption
Decisions made

The timeline should use confirmed facts. Where a time or event remains uncertain, identify it as an estimate.

This record helps the insurer, forensic team, legal advisers and regulators work from consistent information.

How does the insurer assess a cyber claim?

The insurer may examine:

Whether the policy was active
Whether the incident meets an insured definition
When the organisation first knew about it
Whether it was disclosed before policy inception
Whether notification was prompt
Which systems and entities are insured
Whether required security controls existed
Whether approved providers were used
Which losses fall under each policy section
Whether exclusions apply
Whether costs were reasonable
Whether a waiting period or sublimit applies
Whether another insurance policy may respond

The insurer may appoint forensic accountants to evaluate business-interruption losses and technical experts to investigate the incident.

Cooperate with reasonable requests while maintaining legal privilege and confidentiality where applicable.

Common reasons cyber claims are delayed

Cyber claims can be delayed by:

Late notification
Incomplete forensic investigation
Unclear incident timeline
Missing system logs
Unauthorised response expenses
Delayed regulatory assessment
Difficulty identifying affected data
Business-interruption calculations
Disagreement about restoration costs
Several policies potentially responding
Questions about security controls
Third-party technology-provider investigations
Continuing law-enforcement enquiries

A delayed claim has not necessarily been declined.

Ask the insurer to identify the outstanding requirements and whether any undisputed expenses can be processed separately.

Common reasons cyber claims are declined

A cyber claim may be declined where:

The incident began before the policy or retroactive date
A known circumstance was not disclosed
The event does not meet the policy definition
The affected system or entity was not insured
The loss falls under an exclusion
Required security controls were misrepresented
The organisation failed to maintain a policy condition
The loss involves ordinary system failure
Social engineering was not included
The stolen money was outside the cybercrime section
Costs were incurred without necessary approval
The organisation voluntarily shut down systems without a covered trigger
The claim involves an excluded war or infrastructure event
The loss exceeds the relevant sublimit

Request every rejection in writing together with the policy clauses relied upon.

For dispute guidance, read How to Challenge a Rejected Insurance Claim in Kenya.

What should the business avoid after an incident?

Avoid:

Wiping affected devices
Deleting logs
Paying ransom independently
Reconnecting infected systems
Restoring untested backups
Appointing expensive providers without checking the policy
Concealing information from the insurer
Making speculative public statements
Admitting legal liability
Altering evidence
Continuing compromised payment instructions
Waiting for complete answers before notifying the insurer
Assuming an external IT provider has reported the claim

Every emergency decision should be recorded with the reason it was necessary.

Who should lead the cyber claim?

A cyber claim normally requires cooperation among:

Senior management
IT and cybersecurity
Legal counsel
Data-protection officer
Finance
Communications
Business-continuity team
Insurer
Insurance intermediary
Forensic specialists
External technology providers

One authorised incident leader should coordinate decisions and maintain the official timeline.

Employees should know where to direct customer, media and regulator questions.

What can Imana do during a cyber claim?

Imana Insurance Agency Kenya Ltd can help the insured organisation:

Locate the policy and reporting contacts
Notify the insurer
Obtain the claim form
Clarify document requirements
Follow up on specialist appointment
Track insurer requests
Coordinate claims correspondence
Request progress updates
Explain limits, excesses and sublimits
Support a structured complaint where necessary
Review coverage before renewal

Imana cannot:

Conduct the forensic investigation
Determine whether a breach must be reported
Give legal advice
Negotiate with attackers without authority
Guarantee claim payment
Approve expenses for the insurer
Overrule a claim decision

The insurer retains responsibility for assessing the insurance claim. Legal and regulatory decisions require appropriately qualified advisers.

Cyber insurance claim checklist

After an incident, confirm that the organisation has:

Activated its incident-response plan
Contacted the insurer
Contacted Imana
Isolated affected systems
Protected clean backups
Preserved digital evidence
Appointed approved specialists
Opened an incident timeline
Assessed ODPC reporting duties
Considered KE-CIRT notification
Notified the bank where money is involved
Recorded downtime
Preserved invoices and receipts
Avoided unauthorised ransom payments
Kept communication controlled
Submitted the claim form
Responded to insurer requests
Retained copies of every document

Frequently asked questions

How quickly should a cyber claim be reported?

Immediately after discovery. Do not wait for the forensic investigation to establish every detail.

Should the business switch off every system?

Not automatically. Isolate affected systems under technical guidance. A careless shutdown can destroy evidence or interrupt essential services unnecessarily.

Can the company use its regular IT provider?

Possibly, but check whether the insurer requires an approved incident-response provider. The regular IT company may also lack forensic or breach-response expertise.

Does the business have 72 hours to notify the insurer?

Not necessarily. The 72-hour provision relates to qualifying personal-data breach notification under the Data Protection Act. The insurance policy may require immediate notification.

Must every cyber incident be reported to the ODPC?

Not every technical event necessarily meets the statutory reporting threshold. Obtain prompt legal or data-protection advice.

Does the policy pay ransomware demands?

Only where cyber-extortion payments are lawful, insurable and covered. Never pay independently.

Is stolen money automatically covered?

No. Cybercrime, social-engineering or funds-transfer protection may require a specific extension.

Can the business restore systems immediately?

Containment and recovery should begin quickly, but evidence must be preserved and insurer approval obtained where required.

How is cyber business interruption calculated?

The insurer examines lost income and reasonable additional expenses, considering historical financial records, trends, mitigation and the policy’s waiting and indemnity periods.

Can Imana approve the claim?

No. Imana assists with notification, documentation, communication and follow-up, while the insurer decides whether the policy responds.

Build the claims process before the incident

The worst time to search for the cyber policy is after the network has gone dark.

Before an incident, every insured organisation should know:

Where the policy is stored
Who can notify the insurer
The emergency hotline
The policy excess
The interruption waiting period
Which providers must be used
Who handles regulatory notifications
Where clean backups are kept
Who can communicate publicly
Who can approve emergency expenditure

Conduct a response exercise at least periodically. Test the process without waiting for a real attack.

Explore Imana’s cyber insurance knowledge cluster

Read:

Compare cyber insurance quotations in Kenya

The strength of a cyber claim begins with the cover purchased before the incident.

Compare:

Incident-response services
Ransomware protection
Data restoration
Business interruption
Dependent business interruption
Privacy liability
Cybercrime
Social engineering
Regulatory investigation costs
Limits and sublimits
Policy excesses
Security conditions
Retroactive dates
Territorial scope

Submit a Corporate Insurance Quotation or request guided comparison through ImanaInsurance.com.

Visit Imana.co.ke for Kenyan insurance authority resources and MyKava.co.ke for travel, medical and digital insurance comparison.

Contact Imana Insurance Agency Kenya Ltd

Imana Insurance Agency Kenya Ltd
4th Floor, Krishna Centre
Woodvale Grove, Westlands, Nairobi
Call/WhatsApp: +254 796 209 402

Websites:

www.imanainsurance.com — quotation comparison and customer enquiries
www.imana.co.ke — insurance authority and product information
www.mykava.co.ke — travel, medical and insurance comparison

Imana Insurance Agency Kenya Ltd is a Westlands-based insurance intermediary helping individuals, families and businesses compare insurance quotations from licensed Kenyan insurers across Motor, Medical, WIBA, PSV, Travel, Motorcycle, Cyber, SME/Corporate and other insurance classes.

Author: Raymond Momanyi
Founder & CEO, Imana Insurance Agency Kenya Ltd

Disclaimer: This guide provides general information and is not a substitute for the cyber policy, professional incident-response advice or legal guidance. Cyber claims, breach-reporting duties, limits and exclusions depend on the incident, policy and applicable law.

Blogs Details