Ransomware, Data Breaches Expose Gaps in Cyber Insurance Market

As U.S. companies grapple with cyber crime costs, indiscriminate ransomware attacks, and hundreds of millions of dollars in data breach fines, many seek protection in a normally predictable bet—insurance.

But some companies have discovered the hard way that policies can be filled with gaps and exclusions. Some don’t cover all regulatory fines and penalties. Others may cover ransom payments made to end certain attacks, but not all the long-term damage to systems caused by the attack.

And in two ongoing court cases, insurers are contending that “war’’ exclusions allow them to not cover cyber attacks linked to Russian state actors. ...