Our company paid cyberattack costs and then received insurance. Which costs and recoveries need separate records?
Cyberattack Costs, Ransom and Insurance Payments. A specific owner scenario, the facts that change the answer, and the records needed for a tax review.
By AE Tax Advisors Team · Updated October 28, 2026
Keep restoration services, lost income, stolen funds, legal costs and insurance recoveries separate. A cyberattack invoice is not one automatic deduction category, and paying a cost does not settle its tax treatment.
A specific business-owner situation
A company incurs forensic, system-rebuilding and customer-response costs after an attack. An insurer later reimburses some items but excludes others. The advisor needs the work performed and recoveries by category, not one line called cyber loss.
Illustrative example, not a client result.
What to establish before filing
- Separate restoration, improvements and lost-income components.
- Track stolen funds and recovery rights independently.
- Match insurance reimbursements to the supported costs.
Which fact changes the answer?
Replacing a damaged system with expanded capabilities can raise different capitalization questions from routine recovery work. Describe what vendors delivered rather than relying only on their invoice headings.
A mistake to avoid
Deducting the full loss estimate and then all repair invoices can duplicate amounts or mix lost profit with actual spending.
Records that support the decision
- Vendor scopes.
- Incident and claim records.
- Payment evidence.
- Rebuilt-system asset details.
The decision to document
Build an incident-cost and recovery matrix for the preparer. Legal or sanctions questions about any payment belong with qualified counsel; the tax workpaper should follow the documented actual transaction.
Business-owner tax planning and coordination · Discuss your business and advisory needs
Related questions
- We won a business lawsuit for lost profits plus interest. Is the whole award treated the same?
- The insurer paid me personally for equipment my company owned. Who reports the claim?
Sources and editorial context
General educational information prepared with AI assistance. No individual professional review is claimed. Apply the relevant tax-year rules to the actual records. Editorial policy · AI disclosure.