Cyber insurance may pay cryptojacking charges through applicable service-fraud coverage. Do not assume breach-response or business-interruption coverage pays that bill. Before expanding SaaS or AI compute workloads, locate the relevant wording and confirm which services, security events and charges it covers, plus its limit and retention. Coalition’s public overview lists service fraud including cryptojacking separately from those other coverages; that is one product example, not an industry-wide promise.
Separate the provider’s bill from response costs and downtime
Coalition’s overview distinguishes service fraud, breach-response costs and business interruption. Use those categories to organize a coverage discussion rather than treating every expense following an attack as interchangeable.
An invoice for extra computing is different from an investigation invoice or a lost-income calculation. One event can raise several coverage questions, but evidence supporting one loss category does not automatically establish another.
- Unauthorized usage: Ask whether the cloud charges fit the applicable service-fraud wording.
- Incident response: Review the terms governing investigation and response expenses separately.
- Downtime: If operations were disrupted, examine the relevant interruption coverage rather than assuming it reimburses unauthorized consumption.
Read the actual service-fraud terms before scaling
A public coverage description is a starting point, not the insurance contract. Locate the coverage grant, declarations and endorsements for the policy being considered. Build a short worksheet around these questions:
- Included coverage: Is service fraud or cryptojacking included in the base form or through an endorsement?
- Services and accounts: Does the wording encompass third-party cloud compute, the affected account and the entity responsible for its charges?
- Covered event: How does the policy define the required security event and fraudulent usage? What evidence would establish those requirements?
- Loss measurement: Does the clause address amounts paid, amounts owed or another measure? How are provider credits and refunds treated?
- Limits: What limit and deductible or retention apply, and how do they interact with the overall cyber limit?
- Timing and notice: Which event or discovery dates matter, how must the incident be reported, and what documentation is required?
Sources: Broad Cyber Coverage Designed for Digital Risk · Coalition Coverage: Is your business covered for the latest digital risks — service fraud and bricking?
A large compute bill is not proof of insured service fraud
A useful boundary follows from Coalition’s stated coverage trigger: fraudulent service use resulting from a security failure. An authorized training run, ordinary traffic growth or an inefficient deployment is not, by itself, that event. This is an inference from that product description, not a determination about another policy.
Likewise, check whether the applicable clause requires data loss; do not infer that requirement from the word cyber. If service-fraud coverage is absent or limited, ask which alternative clause would actually respond. A broad coverage label does not resolve a mismatch involving the event, affected service, loss definition or available limit.
Prepare a billing-and-incident evidence plan
Before increasing capacity, finance and engineering can document expected workload usage and decide who investigates abnormal consumption. Map cloud services to billing entities, then identify who retains billing exports, workload records and access logs. These are proposed preparation steps, not a statement of mandatory insurer controls.
If suspicious charges appear, preserve a timeline separating authorized work from suspected misuse. Track disputed charges and provider credits separately so the review does not treat the gross invoice as the unquestioned loss amount. Follow the policy’s incident-reporting instructions while the billing investigation continues; do not assume the billing process determines the insurance notice deadline.
Sources: Compute Hijacking (T1496.001) · Coalition Coverage: Is your business covered for the latest digital risks — service fraud and bricking?
Resolve the question in the quote or renewal discussion
For a cyber quote discussion with Atlas Risk Partners, prepare a non-sensitive description of your cloud use, planned workload expansion and the terms you want checked. Keep credentials, customer records and confidential incident details out of that initial summary.
Confirm availability for the relevant carrier, state and risk. Coalition’s U.S. non-admitted cyber disclaimer, for example, says its products may not be offered in every state and that coverage approval is decided by the issuing insurer under its current criteria.
This is general education, not an individualized recommendation or a promise of payment. It does not bind or establish coverage; the issued policy and endorsements control.
Sources: Coalition Coverage: Is your business covered for the latest digital risks — service fraud and bricking? · Disclaimer | Coalition
Your preparation checklist
- Identify the cloud services, accounts and billing entities involved.
- Locate any service-fraud or cryptojacking coverage and endorsements.
- Record the covered-event, services and loss definitions.
- Note the applicable limit and deductible or retention.
- Confirm relevant policy dates, notice requirements and reporting procedures.
- Assign internal responsibility for billing, workload and access-record retention.
- Ask how disputed charges, provider credits and refunds affect the loss calculation.
Sources and editorial approach
Atlas publishes practical insurance education using public regulatory and insurer materials. Insurer examples describe their own products and do not establish Atlas market access. Your policy and endorsements determine actual coverage. This article is general information; it does not bind coverage or replace advice about your particular business.
- Broad Cyber Coverage Designed for Digital Risk
Coalition’s coverage overview describes service fraud including cryptojacking as direct financial loss from fraudulent business-service usage resulting from a security failure. It separately describes breach response and interruption. Product example only, not policy wording or evidence of Atlas carrier access.
- Coalition Coverage: Is your business covered for the latest digital risks — service fraud and bricking?
Coalition’s November 11, 2021 article explains stolen computing power and resulting IT-provider charges. Its endorsement discussion concerns Coalition’s offering at that time and is not used as an industry-wide exclusion or current eligibility rule.
- Compute Hijacking (T1496.001)
CISA’s technique reference describes malicious consumption of computing resources, including cloud and container environments. It supports the threat explanation, not insurance coverage or mandatory control requirements.
- Disclaimer | Coalition
The opened U.S. non-admitted cyber disclaimer states that Coalition’s products may not be available in all states and that coverage approval rests with the underwriting insurer under its current criteria. It also explains that informational summaries do not amend policy terms. Supports the Coalition-specific closing example, not Atlas licensing or carrier access.
Have a correction or a question? Contact Atlas.
