They hand it off to other companies that specialize in auditing and overseeing the hack resolvement. If their partner company decide, that it’s worth paying. Then they pay.

If the partner company decides to try and negotiate, they can I guess… Hard to say, never saw how insurance plays out when a true hack occurs.