Cyber Liability Insurance for Businesses

04Illustrative scenarios

Example claim scenarios

A few situations that show how this coverage can respond when something goes wrong. These are examples only — not actual claims, and not a guarantee of any outcome.

• Example scenario

  Ransomware event shuts down business systems

  A business's internal systems are encrypted by a ransomware actor who gains access through a phishing email opened by an employee. The business is unable to access its accounting software, scheduling system, and customer database for several days while the incident is investigated and systems are restored. Cyber liability can respond to several costs, subject to the policy's terms and exclusions. Those are the forensic investigation to determine the scope of the intrusion, the cost of data restoration, and business income lost during the period of system outage. If the attack involved the exfiltration of customer or employee data, notification obligations and credit monitoring costs may also be covered under the same policy. The scenario illustrates why response costs — not just data theft — are a primary driver of cyber losses. It shows why system-outage coverage is a meaningful component of a well-structured cyber form.

• Example scenario

  Customer data breach triggering notification obligations

  A business discovers that a third-party software platform it uses to manage customer orders was compromised in a data breach affecting multiple clients of the platform. Customer names, shipping addresses, and partial payment information were exposed. Under applicable state data breach notification laws, the business is required to notify affected customers and provide access to credit monitoring services. Cyber liability can respond to several costs, subject to the policy's terms and exclusions. Those are the notification costs, the credit monitoring expense, and the forensic review required to determine which records were affected. Third-party liability claims from affected customers may also be covered under the policy's liability component. Those claims allege that the business failed to adequately protect their information. The scenario is a reminder that a business's breach obligation can be triggered by a vendor's failure, not just an internal one. Reviewing how a cyber policy addresses third-party vendor breaches is an important part of evaluating the form.

• Example scenario

  Social engineering fraud resulting in a fraudulent transfer

  An accounts payable employee receives an email that appears to come from the company's regular vendor. It requests that payment for an upcoming invoice be sent to a new bank account. The email's sender address is a close variation of the vendor's actual domain. The employee authorizes the transfer before the fraud is identified. Social engineering fraud coverage can respond to the financial loss from the fraudulent transfer, subject to the policy's terms, sublimits, and conditions. This coverage may be available as a specific endorsement or sublimit under a cyber or crime policy. Standard crime policies and standard cyber policies approach social engineering coverage differently, and the coverage available for this type of loss varies significantly across forms. Reviewing whether a policy specifically addresses fraudulent transfer instructions and what conditions apply is important for businesses with payment authorization exposure.

The claim scenarios above are illustrative examples only. They do not represent actual clients, actual claims, or guaranteed coverage outcomes. Coverage for any specific situation depends on the policy terms, conditions, exclusions, and the facts of the claim.