A data breach can be financially devastating to a company, particularly a small business. Depending on the severity, the average price tag for a cyber breach for a small business ranges from $120,000 to $1.24 million, according to the Verizon 2024 Data Breach Investigations Report. Fortunately, your cyber insurance policy can cover many of the costs associated with a data breach. Below are steps to take to ensure your business gets full coverage for your cyber-related losses.
Understand Your Cyber Insurance Coverage
Every cyber insurance policy is different, and it is important to understand the coverage you have. Also called cybersecurity insurance, cyber insurance can include both first-party coverage and third-party liability coverage. First-party insurance covers losses that your company incurs directly, while third-party liability coverage safeguards you against lawsuits brought by customers, clients, and other third parties in connection with your cyber incident.
Cyber policies often cover expenses associated with investigating the nature and scope of the breach or attack, assessing the damage and areas of the business impacted, containing the attack, restoring affected systems, and developing a comprehensive recovery plan. Cyber policies also typically cover the cost of consulting legal counsel on steps to take in the wake of a breach. The policy may also cover the cost of identifying and notifying individuals whose personal data was impacted, and in some cases the cost of providing these individuals with credit monitoring.
As cyber breaches can lead to days or weeks of downtime, many policies provide business interruption coverage. Your policy may also cover the cost of hiring a public relations firm to help offset reputational harm caused by the breach.
Some policies safeguard your business against ransomware attacks, in which criminals encrypt your data with malware and then demand a ransom in exchange for accessing your own files or preventing public exposure of your data. Your policy may include the cost of the extortion payment.
If you have third-party liability coverage, it can help cover your legal fees, settlements, and judgments, as well as potentially covering regulatory fines and penalties.
It is important to understand your policy’s exclusions, as well as deductibles, policy limits, and whether there are sub-limits for specific types of losses.
Notify Your Insurance Company Immediately
As soon as you learn about a cyber incident, put your insurance company on notice. As a condition of coverage, insurance companies require timely and proper notice of a claim, which allows the insurer to promptly investigate the claim, correct dangerous conditions that could lead to more liability, and establish adequate reserves against potential liability. Failure to provide proper and timely notice of a claim can lead to the insurer being excused from all liability for your claim.
Incident Response Plan
In the wake of a cyber incident, clear communication should be established between your cyber insurer and your company leadership and IT teams. You should have an incident response plan in place that aligns with your cyber insurance coverage. Your cyber insurance company may have in-house experts that can help guide you through the proper response steps. It is important to comply with all of the policy’s terms and conditions, including meeting all insurer requirements and deadlines for submitting claims, proof of losses, and other documentation.
In order to prevent additional data loss or theft, your incident response plan should begin with containing the breach. Your system may need to be temporarily shut down, so that IT teams can properly investigate and contain the problem. Once the cause of the breach has been eliminated, your incident response plan should provide a roadmap for restoring and returning the system to normal operations. Depending on the type of data compromised and the nature of your business, you may need to notify impacted third parties that their information was leaked or stolen. Many incident response plans include consultation with an attorney to ensure all legally required steps are taken, and a public relations firm to execute an effective communication strategy to limit the reputational harm that can result from a cyber incident.
If you are involved in a dispute with your cyber insurance provider or other business insurance company, contact Schwartz, Conroy and Hack, PC for assistance. We have the expertise and tenacity to make insurance companies keep the promises they make to you and your business.