If victims don't report ransomware attacks to the FBI, insurers might be the next best source of information.

These figures come as insurers continue to assess whether to pay the extortion fees that hackers impose on their clients.

AIG had cited multiple clauses in its policy to argue against paying, though the court ruled the tactic did not count as "bad faith."

The ruling adds some clarity to the otherwise murky world of cyber-related insurance claims.

The dispute comes amid a period of ongoing scrutiny over what kinds of breach-related costs are insured.

Payments are likely to continue as costs add up, the Norwegian company said in an earnings report.