--- title: "In last 3 years, any cyber event, claim, loss, security breach, or extortion demand?" url: https://insuranceposture.com/questions/incident-response/last-3-years-cyber-event-claim-loss-security-breach category: "Incident response and claims history" canonical_key: q_ir_004 evidence_state: attested updated: 2026-08-24 --- # In last 3 years, any cyber event, claim, loss, security breach, or extortion demand? URL: https://insuranceposture.com/questions/incident-response/last-3-years-cyber-event-claim-loss-security-breach Section: Incident response and claims history Evidence state: Attested, not tenant-verifiable Of every question on the form, this is the one where an inaccurate answer does the most damage. Prior incidents are discoverable; a non-disclosure is not survivable. ## What the carrier is actually asking The carrier is asking about any cyber event, claim, loss, security breach, or extortion demand in the stated period. The wording is deliberately broad. It captures events that produced no claim, no notification, and no material loss, including an extortion demand you ignored and a compromise you contained yourself. ## Why it is underwritten Loss history is the strongest single predictor of future loss, so this answer carries real weight in pricing. It carries more weight legally: an inaccurate answer to a claims history question is the clearest case a carrier can make for rescission, because materiality is difficult to dispute. Every carrier in this market has rescinded a policy on this ground. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is a disclosure question answered from records rather than from configuration. The work is establishing what actually happened, which usually requires asking beyond the IT team. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Incident records | Ticketing, security tooling, and incident logs for the period | A search rather than a recollection, since events three years old are rarely remembered accurately | | Insurance records | Prior claims, notifications, and circumstance notifications | Anything reported to any carrier, including notifications that produced no claim | | Legal records | Regulatory notifications, correspondence, and demand letters | Any regulator contact or third-party demand relating to data or systems | | Finance records | Payments made in response to fraud, including recovered funds | Invoice fraud and payment diversion, which are often handled by finance and never reach IT | | Communication | Extortion demands, including those not acted on | Demands received and ignored still count, and they are frequently omitted because nothing happened | **Ask finance, not only IT** The most commonly omitted event is a payment diverted by invoice fraud, resolved by the bank or absorbed as a loss, that the security team never heard about. It is squarely within the question, and the record exists in the finance system. Ask the question there before you answer. ## What a defensible yes requires - The answer is based on a documented search across IT, legal, finance, and insurance records. - Contained incidents are included, not only those that produced a claim or a notification. - Extortion demands are disclosed even where nothing was paid and nothing happened. - Disclosed events include what happened, what was done, and what changed as a result. - The search covers the full period and any acquired entities. ## How this answer goes wrong The answer is no because nothing was reported to an insurer, while the organisation contained a mailbox compromise eighteen months ago and finance recovered a diverted payment the year before. Both are within the question. The carrier will discover them during the investigation of any subsequent claim, and the discovery will be characterised as non-disclosure. ## If this answer turns out to be wrong The claims and circumstances questions connect directly to the notice conditions in the policy, which have to be satisfied before the insurer owes anything at all. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what a condition precedent has to satisfy first](https://insuranceposture.com/glossary/condition-precedent). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Does a contained incident count? Read the wording. Most forms ask about events, not claims, which captures anything you would internally call a security incident regardless of outcome. ### Will disclosing hurt us? Less than you expect, and far less than non-disclosure. A disclosed event with a clear remediation story is routine. Carriers are more concerned by an insured who does not know what happened to them. ### What about incidents at an acquired company? They generally count once acquired. Include them and note the acquisition date, because the alternative is a gap discovered later. ### What if we are not sure? Disclose and describe. Carriers accept qualified disclosure; they do not accept an unqualified no that turns out to be wrong. ## Related questions - [Awareness of any fact / circumstance reasonably giving rise to a future claim?](https://insuranceposture.com/questions/incident-response/awareness-fact-circumstance-reasonably-giving-rise-future-claim) - [Has the Applicant experienced any partial or total network interruption lasting more than 8 hours?](https://insuranceposture.com/questions/incident-response/applicant-experienced-partial-total-network-interruption-lasting-more-than) - [Does the Applicant attest that all statements in the application are true, complete, and accurate and form the basis of the policy (misrepresentation voids coverage)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-attest-statements-application-true-complete-accurate-form-basis) - [Does the Applicant have a written Incident Response plan?](https://insuranceposture.com/questions/incident-response/applicant-written-incident-response-plan) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.