AXA Became the First Major Insurer to Stop Reimbursing Ransomware Payments, in France Only

AXA said on May 6, 2021, that it would stop writing cyber insurance policies in France that reimburse extortion payments to ransomware criminals. The Associated Press described the move as an apparent industry first. The decision followed a roundtable in the French Senate in April at which justice and cybersecurity officials had argued that insurance reimbursement was sustaining the ransomware economy. Paris cybercrime prosecutor Johanna Brousse was quoted saying that regarding ransomware, “we don’t pay and we won’t pay.”

The change applied to France only, did not affect existing policies and left in place coverage for incident response and recovery. Emsisoft estimated French ransomware losses at more than $5.5 billion in 2020, second only to the United States.

The case against ransom reimbursement had been made by governments for years. An insurer making it was new. The economics are direct: a criminal who knows the victim is insured knows the money exists and who will authorise it. The REvil operator interviewed by Recorded Future in March 2021 had said that hacking insurers first, to read their customer lists, was among the most attractive targets available. AXA’s decision removed one line item from that calculation for one market.

The policy still paid for forensics, restoration, legal costs and business interruption. Those are the larger costs in most incidents and the ones an insurer can price. The excluded item was the one the criminal sets. Whether that changed any attacker’s behaviour was never established, and the attack on AXA’s own Asian operations nine days later, filed at 21-0516, was read by many as a reply, without any evidence that it was one.

No other major carrier adopted the same position. The industry’s response instead ran through underwriting: multifactor authentication requirements, backup attestations and the rescission case filed at 22-0826b, where a misstatement about controls voided the policy. Ransom reimbursement remained standard cover outside France. The corpus recorded at 26-0603 that payments eventually fell anyway, for reasons that had more to do with victims than with insurers.