In this paper, we develop stochastic models to determine the impact of a massive cyber attack on an insurance portfolio. The model is based on the classical SIR framework (Susceptible - Infected - Recovered) of epidemiological models. For a given type of attack, we provide a general framework to quantify the impact on the portfolio of such an event, and calibrate response policies for the insurance company (such as prevention and reaction time to the attack). We also consider the possibility of a « collapse » of the response system. Such a collapse could happen if too many policyholders are affected simultaneously. In which case, the insurance company is unable to bring assistance to its policyholder. We provide sharp bounds for the probability that such an event occur.