What Cryptojacking Does to a Business
The basic trick is simple. An attacker gets access to a device or system and installs cryptocurrency mining software. That software quietly uses computing power in the background while the business carries on as normal.
And that’s what makes cryptojacking annoying. You may not notice it immediately because nothing dramatic happens on screen. There may be no locked files or ransom note. Just a server that suddenly works much harder than it should.
The financial damage can still be real. Extra cloud usage creates unexpected bills. Systems can slow down. Security teams need time to investigate and remove the malicious code.
The Policy Wording Matters
Don’t assume that every cost connected to cryptojacking gets paid. Insurers look at the cause of the loss. They also look at what coverage you actually bought.
• Unauthorized system access is often the key detail, because cryptojacking usually starts with an attacker getting somewhere they shouldn’t.
• Cloud costs can become complicated. A policy may respond to certain incident-related expenses without automatically paying every oversized hosting bill.
• Business interruption coverage is another question entirely, especially if cryptojacking slows operations without actually stopping them.
• Some policies have exclusions for particular types of loss, so the definition of a covered cyber event deserves a close read.
What a Cryptojacking Claim Could Look Like
Raj noticed that his company’s cloud servers were running harder than usual. At first, he blamed a software update. Then he found mining malware using the company’s computing resources. His IT team spent two days removing it and checking the affected systems.
That’s an important distinction when you’re dealing with insurance. The insurer isn’t necessarily looking at cryptojacking as some special crypto problem. They’re looking at the incident and the losses that followed.
What You Should Check Before a Claim
If you discover cryptojacking, preserve evidence before wiping everything clean. Your insurer may need records showing when the activity started and how the attacker gained access.
• Incident reports matter, even when the attack feels minor.
• Cloud invoices can show the extra computing costs, although you’ll want to separate normal usage from the spike caused by the attack.
You should also notify the insurer quickly and follow the policy’s reporting requirements. Waiting because “it’s only mining malware” is a bad move. Small incidents sometimes uncover a much bigger security problem.
So, Is Cryptojacking Covered?
In many cases, cyber insurance can cover losses caused by cryptojacking when the underlying attack falls within the policy’s coverage. But there isn’t a universal yes.
The strongest position is to check the policy before an incident happens. Look closely at coverage for unauthorized access and malware. Check the rules around business interruption too.
Cryptojacking feels almost harmless compared with ransomware. That’s exactly why businesses can ignore it. And a hidden miner quietly running for months could end up being far more expensive than it first appears.
Would you really notice if someone was mining crypto on your systems tonight?