Customer compensation and recovery costs after a cyber incident: records for liability allocation and recourse

The following is a fictional scenario. Shipments at Company A (a manufacturer with 300 employees, preparing for a stock exchange listing) stopped because of unauthorized access to its order and inventory system. It has commissioned an urgent investigation from Company D, an investigation provider, and arranged an alternative operating environment. Company C, a corporate customer, is seeking compensation for delivery delays. The environment of Company B, the vendor to which operation and maintenance are outsourced, may also be involved.

Company A, Company B, and the other elements of the scenario in this article are fictional and used for explanatory purposes. They do not describe actual matters handled by our firm.

Situations requiring decisions on expenditure for compensation and recovery costs

Incident response involves a succession of spending decisions: commissioning an urgent investigation, deciding whether to proceed with an additional detailed investigation, arranging an alternative system, outsourcing inquiry handling, and considering compensation to business partners. All of these decisions have to be made within a short time.

In these circumstances, the preparation of supporting materials tends to be postponed because of the urgency of restoration. The expenditure itself is recorded, but it becomes difficult to reconstruct later "why the expenditure was necessary" and "why that amount was chosen".

→ Designating approvers and alternates within the company

Checking cost categories, causes, contracts, and insurance terms

Identifying costs by category

First, expenditures are categorized by their nature.

• Investigation costs
• Containment and recovery costs
• Costs of alternative operations
• Costs of notifications and inquiry handling
• Compensation to business partners
• Lawyers' fees
• Investment in measures to prevent recurrence

For each cost category, the party to claim against and the basis for the claim, the causal relationship with the incident, and contractual limitations are checked. Expenditure that was necessary to respond to the incident differs in nature from investment in improvements made on this occasion. The scope of insurance coverage is checked separately under the applicable policy terms and endorsements.

Checking contractual limitations of liability

An outsourcing agreement may contain clauses setting a liability cap, providing for grounds for exemption from liability, or limiting the scope of loss or damage. Before considering a claim, first check what the company's contract provides.

Checking insurance terms

If the company has cyber insurance, the following are the four points to check.

1. The deadline and method for notifying the insurer of the incident
2. The scope of covered costs (the distinction between coverage for costs and coverage for profits, the definition of personnel costs, and whether costs ordinarily incurred are excluded)
3. Whether prior approval is required for placing orders or entering into settlements
4. Subrogation by the insurer (Article 25 of the Insurance Act; a mechanism under which an insurer that has paid insurance proceeds acquires claims that the insured holds against third parties)

All of these are matters to be checked under the policy terms and endorsements applicable to the company. Conditions vary by insurance product, so do not mistake general explanations for the terms of the company's contract. Obtaining the insurer's approval is not the same as having those costs paid in full.

→ Considering additional investigation needed to substantiate costs

Distinguishing damages from voluntary compensation, and restoration from enhancements to functionality

Distinguishing a legal obligation to pay damages from voluntary expenditure to maintain business relationships

Payments to business partners include those based on a legal obligation to pay damages and voluntary expenditure to maintain business relationships.

Whether voluntary compensation can be claimed from a vendor is examined in light of factors such as the vendor's liability, the connection with the incident, the necessity of the expenditure and the reasonableness of the amount, and contractual limitations. Keep the materials relevant to that assessment when making the expenditure. Why that amount was chosen, whether other options were considered, and what the counterparty had requested provide the starting point for later examination.

Distinguishing a return to the pre-incident state from additions and enhancements to functionality

Restoration work tends to combine work to return the system to its pre-incident state with work to add functionality or improve performance on this occasion. Manage these two parts separately.

There is a court decision in which this distinction was at issue. It concerns unauthorized access to the City of Maebashi's educational information network.

Following the Maebashi District Court judgment of February 17, 2023 (Case No. 2020 (Wa) 145), an appeal was filed on March 2, 2023, and an incidental appeal on September 8, 2023. Subsequently, the Tokyo High Court presented a settlement proposal on May 9, 2025, and the Maebashi City Council approved a settlement motion on June 19, 2025. This article presents it as the court of first instance's determination in that particular case.

A description of "system restoration as a package" alone does not show the breakdown, so estimates, work reports, and similar documents are used to distinguish the portion for a return to the pre-incident state from the portion for additions and enhancements.

Treatment of lost profits and reduced sales

Reduced sales resulting from a business interruption are a category of loss that is difficult to prove.

In the Tokyo District Court judgment of January 23, 2014 (Case No. 2011 (Wa) 32060; Hanrei Jiho, No. 2221, p. 71), which concerned a leak of credit card information, the costs associated with apologies to customers, the costs of inquiry handling, and investigation costs were all recognized as losses. By contrast, for lost sales, the court applied Article 248 of the Code of Civil Procedure and recognized loss having an adequate causal relationship with the incident only to the extent of JPY 4 million out of approximately JPY 60 million claimed. In that case, the amount of loss found by the court was reduced by 30%, taking account of negligence on the part of the commissioning party.

Note: The categorization above is based on the amounts of loss found before the 30% reduction for comparative negligence. Please consult the law reports for the detailed amounts.

Secure the materials on which calculations are based, such as records of orders and shipments before and after the incident and communications from business partners, starting immediately after the incident. It may not be possible to obtain them all if they are sought later.

Allocating responsibility for checking and approving expenditure and compensation terms

Expenditure is approved by the authorized approver for the budget, while an agreement on compensation with a customer is approved by the authorized approver for that agreement. Approval of expenditure and whether a claim can be made against the counterparty are considered separately.

Notification to the insurer and checks on matters requiring prior approval are carried out in parallel with spending decisions. Check the insurance terms before entering into a settlement.

If approval for urgent expenditure is obtained after the fact, the procedure and the reasons why prior approval could not be obtained are recorded.

Substantiating necessity, causation, and amounts by cost category

The following items are recorded for each cost category.

• Purpose of expenditure
• Connection with the incident
• Alternatives considered
• Reasons for choosing that option
• Estimates and work breakdowns
• Payment records
• Approver
• Potential parties to claim against

The date and time of the spending decision and the date and time the record was created are recorded separately. When additions or corrections are made later, the original record is retained, and the date and time of the change, the person who made it, and the reason for it are recorded.

These points are organized as follows.

Cost category	Purpose of expenditure	Alternative	Approval	Supporting documents	Potential sources of recovery
Urgent investigation	Identification of the scope of impact	Investigation by the company	CISO	Purchase order; report; work breakdown	Vendor / insurance
Additional detailed investigation	Decisions on liability and reporting	Not proceeding	Management	Statement of reasons for the additional order	Vendor / insurance
Alternative system	Business continuity	Suspension of operations	Management	Contract; operating records	Vendor
Restoration work	Return to the pre-incident state	—	Head of Information Systems	Work breakdown (separate entries for a return to the pre-incident state and for enhancements)	Vendor
Inquiry handling	Responses to business partners	Handling by the company	Head of Administration	Outsourcing agreement; records of the number of inquiries handled	Insurance
Compensation to business partners	Maintaining business relationships	Continued negotiations	Management	Written agreement; basis for calculation	Vendor (recourse)

Note: These are illustrative entries for a fictional scenario. The authority, responsibilities, and timing are specific to this scenario and are not requirements under laws or regulations. Whether claims can be made and insurance proceeds paid, and the scope of each, are examined individually. Record additional personnel costs in the breakdown for the relevant row, and avoid counting the same expenditure more than once.

Internal personnel costs are recorded in three categories that differ in nature.

Overtime pay, temporary staffing costs, and similar costs that actually increased as a result of the incident response are separated from regular salaries, and the reasons for the expenditure, the amounts, and the work performed are recorded. Staff time spent during regular working hours is recorded as material for internal management, for purposes such as assessing costs and making management decisions. If regular work is delayed or canceled, whether personnel are assigned exclusively to incident response or combine it with their regular duties, plans and actual results, the periods and personnel involved, and the specific effects and supporting documents are also organized separately. A salary amount prorated by time is not automatically recoverable as damages. Whether damages can be claimed and to what extent, and whether insurance coverage applies, are examined separately.

When disruption to regular work is documented, records are kept for each task linking the following items, whether personnel are assigned exclusively to incident response or combine it with their regular duties.

• The original work, personnel responsible, and scheduled deadlines, together with the periods and hours reassigned to incident response
• Actual delays or cancellations, alternative measures taken, and completion dates
• Outcomes such as changes to delivery dates or lost orders, together with supporting documents such as work schedules, order records, and communications with customers

Separate the effects of the system outage itself from those of reallocating personnel, to the extent that they can be distinguished. These materials are used to examine specific adverse effects and are not records based on the premise that amounts equivalent to salaries can be recovered.

An example in which this point was disputed is the Fukuoka High Court judgment of December 21, 2023 (Case No. 2022 (Ne) 663), which concerned business losses caused by a water supply interruption, although it was not a cyber incident case. While the court found that the plaintiff's employees had engaged in incident response, it did not recognize a loss equivalent to personnel costs on the ground that there was no evidence sufficient to establish that additional personnel costs had been incurred for the response beyond what had previously been planned. Although this was a finding in that particular case, it shows that recording staff time alone is insufficient.

The costs paid cannot necessarily be claimed in full from the vendor. The scope of the claim depends on contractual limitations of liability, the allocation of fault, and the assessment of the necessity and reasonableness of the costs.

→ Requesting from the vendor the information needed to decide on claims

When considering negotiations over cost allocation, claims for damages, and recourse

In situations such as the following, we recommend considering the matter together with an analysis of the legal issues.

• When considering claims against a vendor or its subcontractor
• When the implications of subrogation by the insurer need to be examined after insurance proceeds have been received
• When allocating costs among multiple parties
• When the breakdown between restoration and enhancements cannot be determined from the materials, when the basis for calculating compensation is insufficient, or when the necessity or amount of the costs is disputed

If a written agreement contains a clause intended to consolidate prior agreements into that document, the company checks which prior commitments are to remain part of the agreement. The commitments to be retained are set out in the body of the agreement or an appendix expressly incorporated into it. Whether prior exchanges form part of the agreement is examined separately from their significance as materials showing the facts or the interpretation of the agreement. As to the scope of waivers of claims or settlement of rights and obligations, also check the clauses that provide for them.

There are aspects with which lawyers can assist at the stage of matching the following to materials organized by cost category for assessing claims: the work breakdowns of investigation and restoration providers and the accounting records.

→ When liability under development or maintenance contracts is at issue

→ Recovering fraudulently transferred funds and responding to renewed demands for payment (where the incident involves a funds transfer loss)

→ Checking reporting and notification obligations and the overall response

Contact

Making an inquiry

Please let us know, as far as you are able, an outline of costs and compensation already incurred or planned; exchanges with the counterparty about cost allocation; and the status of contact and checks with the insurer.

Contact Form

In your first message, please tell us the name of your company, the names of the parties involved and an outline of the matter. We will let you know whether we can advise after checking for conflicts of interest and similar matters. This form is not an emergency contact point, and we may not be able to review or reply to your message immediately after it is sent.

Related information

Related explainers and practice areas

Commissioning a cyber incident investigation: deciding on scope, deliverables, and additional costs

Outlines the scope of commissioned work and deliverables to check at the stage when investigation costs are incurred, and the conditions for further investigation.

A cyber incident at a vendor: requesting information to assess the impact on the company

Outlines questions to ask and methods for obtaining information when asking the vendor for the information needed to consider liability and cost allocation.

System Development Disputes

Outlines contractual obligations, limitations of liability, and damages that are relevant when considering claims against the vendor.

This article is provided for general informational purposes only and does not constitute legal advice on any specific matter. Please consult us regarding your specific situation. The content is based on the laws and regulations in effect as of the date of the last update.