Ransomware criminals doing their homework on a target do not stop at the balance sheet. Incident response teams have watched them work out where a company's executives live and where their children go to school.
"They know where their children go to school and it becomes a very scary situation in that reality, whether there's any truth to it or not, where we have had clients that have had to relocate as a result of that, at least on a temporary basis," said Lindsey Maher (pictured left), head of global cyber development at specialist global insurer CFC in London.
CFC has written cover for that fallout into additions offered in its cyber policies through brokers globally. Trauma counselling and therapy services alongside temporary relocation costs and personal theft of funds can be covered for a firm's executives.
"It speaks directly to the buyer and their own personal liability," Maher said.
The person deciding whether to buy a cyber policy is usually the same person whose reputation, career and family arrangements are exposed when the business is attacked. Cyber has conventionally been sold as a balance-sheet product to a buyer whose own exposure is personal and the wording has rarely acknowledged it.
Read next: Why captive insurance for cyber and trade credit is growing
The insurer believes it is first to market globally with counselling offered in these C-suite policies. It is not the first to put counselling in a cyber policy. Berkley Cyber Risk Solutions has offered crisis counselling coverage since May 1 2024. Berkley writes cyber internationally, including through its Asia operation, though the counselling endorsement was announced in the US and the company has not published whether it is available in other markets.
However, CFC's move underlines increasing recognition among insurers of the human as well as the material costs of a cyber attack.
Both insurers described the same origin, which is claims and response staff noticing what clients were going through.
Rich Sheridan (pictured right), chief claims officer at Berkley Cyber Risk Solutions, cited the tremendous emotional impact that insureds experience when dealing with a breach event. He acknowledged that policyholders needed resources to cope with the stress rather than only to remediate the incident. Berkley extended the approach in June 2025 with an endorsement reimbursing cancelled holidays, child and elder care and corporate safety costs for the staff managing a breach, as Insurance Business reported when the endorsement covering incident responder costs was launched.
"It's one of the most under-talked outcomes of cyber events, the mental health impact of it," Maher said.
Read next: AI tops AXA’s risk ranking, and clients want to know if their cyber policy covers it
The research is some way ahead of the wordings. A 2024 study published in the Journal of Cybersecurity, drawn from the Royal United Services Institute's work on the ransomware victim experience, catalogued harms among victim organisations including shame, guilt, isolation, loss of self-confidence and post-traumatic stress, and recorded outcomes at the severe end among small business owners in particular. The researchers found the impact is often greater at smaller firms, because the owner's personal and working lives sit so close together.
"It should support the people responsible for leading the business through that crisis," Maher said of cyber insurance.
Cover for an executive's personal exposure is the kind of thing that can read like a directors' and officers' (D&O) question. Maher is clear that CFC does not see it that way. The executive protection language sits as primary within the cyber policy rather than overlapping with D&O and the point of writing it in explicitly is to settle the argument in advance.
"There's no avoidance of doubt that we do intend to pick it up, and don't want to be in a situation in the event of a claim where we're finger-pointing across different policies," she said.
Three of the best-known cyber writers, Beazley, Chubb and Coalition, lead on incident response, breach counsel, forensics and round-the-clock hotlines, with no counselling benefit in their public cyber material.
CFC's move to offer counselling in its global cyber offerings reflects what its own response staff keep encountering rather than a gap in the market someone spotted. Maher said the decision came down to recognising that cyber insurance should not stop at the systems and the accounts.
"It's trauma counselling services for clients, and really dealing with the victim impact and the human element of what transpires during most cyber events for clients that go through them," she said.
The research points the same way. The Royal United Services Institute's work found that psychological harm after a ransomware event is not confined to the people who handled the response, and that it can surface months later among staff who were nowhere near the incident. Maher said the hope is that putting the cover in writing does something beyond paying for sessions, by making the mental health consequences of an attack easier to raise at all. On her account it is among the least discussed outcomes of a cyber event, which is a strange thing to be true of a loss type where the frequency is now higher than property damage for many businesses.
What that leaves on the table is a question about the rest of the market. Counselling has been in one US cyber wording since 2024 and now appears in CFC's globally for cover pitched to executives, while some of the largest cyber writers publish nothing comparable. Either the human cost of an attack is a real and insurable loss, in which case two insurers acknowledging it is an odd place for the market to have stopped, or it is a service that belongs outside the policy altogether. Cyber wordings offered globally currently say both.
