Cyber & Data Risk Insurance

What is Cyber & Data Risk Insurance?

Nearly all businesses will hold client data or operate digitally in one form or another. Cyber criminals have taken full advantage of this, with small and large businesses falling victim to hacks or data breaches every day.

If you use email, have a website, take online transactions or rely on computers, then you should consider Cyber Insurance. This policy doesn’t just apply to digital risks, it also applies to the loss of client data held in paper form… yes, some businesses still have paper files!

In a nutshell, Cyber Insurance will cover the costs your business suffers following a hack or data breach. It won’t stop a cyber-attack, but it will offer you practical and financial support if you’re the victim of one.

Why do I need Cyber Insurance?

Most people assume that because they have an IT department, they don’t need cyber liability insurance. Yes, your IT department will certainly assist following an incident, but it won’t cover the costs of repairing and restoring your systems/networks, websites, defence and indemnity for regulatory investigations, telling your clients and paying for their credit searches, any ransom/extortion fees, legal fees and compensation claims if you’re sued for loss of personal data, handling the PR management for your firm’s reputation or loss of income if you couldn’t trade. A cyber policy can cover you for all of this, and in today’s world, it seems silly not to have this protection for a business you’ve worked so hard for.

A cyber policy also covers physical data, not just electronic data. Think about an employee leaving a laptop full of client information on a train or dropping some paper files or paper documents stolen from an office break-in.

Cyber Insurance is about protecting your company when it comes to the failure of client data protection. I.E., a loss of the data, a cyber security breach, or if your company is hacked.

What can Cyber Insurance cover?

There are lots of different cyber insurance policies available, each offering different levels of cover.

These are some of the main elements you could expect to find:

• Data breaches

• Human errors

• Financial crime

• Loss or theft of physical data, i.e. paper files or laptop.

• Costs of telling your clients, an example of how much this could be: posting a first-class letter, £1.70 and providing 3 months free credit checks at a cost of £60. If you have 1,000 clients’ data stolen, that could be up to £61,700!

• Restoring/repairing networks, systems and websites.

• Credit monitoring costs for clients to ensure your client’s data is not used to take out loans or store credit, causing them adverse credit

• Specialist assistance and management of the incident itself

• Specialist assistance and management of reputable damage

• Extortion (Ransomware) payments

• SQL Injection attack

• Failure of computer security

• Forensic investigation costs (usually starting from £15,000)

• Loss of income due to business interruption if you cannot trade or network during downtime

• Theft of money or digital assets through theft of equipment or electronic theft

• Legal costs if your business is sued due to data loss

• Client compensation for loss of data

What else do I need?

• Offices and Surgeries Insurance: If you work from an office or surgery environment

• Professional Indemnity Insurance: If your business gives any advice or provides/offers a professional service

• Directors Insurance: Covers the individual and their personal assets from claims made for actual or alleged wrongful acts

• Corporate/Company Legal Liability: Covers the business from claims made for actual or alleged wrongful acts

• Employment Practice Liability: Covers the business against employment disputes

What type of cyber or data risks could my business face?

Businesses face cyber risks every day: an employee losing a work laptop containing client data, an employee clicking a link on a phishing email, hackers intercepting emails and changing bank details on your invoices, paperwork being stolen from an office containing client information, or an email being sent to the wrong person containing sensitive data.

If you lose data, you could be held accountable under the General Data Protection Regulations (GDPR), which could mean a fine and the cost of informing clients of their data loss. A cyber insurance policy covers these costs.

Types of cyber risks include:

• Computer malware

• Hacking

• Cyber theft

• Extortion

• Denial of service attack

• Human error and/or dishonesty

• Infringement of intellectual property rights

• Libel, slander and/or defamation

What is a phishing attack?

A phishing attack is a criminal attempt to obtain private information from an email user that could be used for fraud. Phishing can range from a simple spam email to something more sophisticated. It can now involve emails using accurate copies of branding and design, posing as a legitimate business, bank or email provider.

Phishing is becoming increasingly widespread and is targeting individuals as well as businesses.

What is Ransomware?

Ransomware (also known as malware) is a type of malicious software designed to infect computer systems and encrypt files so that the hacker can lock out the owner and hold them to ransom. They can also extort money by threatening to release sensitive client or business data or shut your system down.

What is an SQL injection attack?

This is one of the most common web hacking techniques, which mainly involves embedding malicious code into an unprotected application or web page. The code can then gain access to the backing database to view, alter or delete private information. Hackers can then commit identity theft and gain access to bank accounts and blackmail businesses. The consequences for a business include loss of money, customer trust and a fine for breach of GDPR.

Types of businesses we can cover

A Cyber and Data Insurance policy can cover any business that uses emails, takes card payments, has a website, or holds client data in either electronic or paper form.

Below are some examples of the businesses and industries we provide cover for:

• Actuary

• Advertising (Creative Agency only)

• Architects

• Construction Companies

• Contractors

• Charities

• Creative Advertising / Marketing (no direct mailing)

• Electrician / Plumber / Engineer / Tradesman

• Farmer / Gardener

• Hairdresser (single outlets only; refer chains)

• Hospitality

• Leisure Management Consultants

• Manufacturing

• Mechanic

• Optician

• Physiotherapist

• Restaurants

• Retail / shops

• Surveyor

• Tailor

• Vet

• Wholesaler

What kinds of cyber incidents are covered by insurance?

Malware

An independent retailer identified malicious code on the payment page of its website. A single call to the insurer’s claims line meant the cyber lawyers had engaged a cyber forensic team within a matter of hours. The team identified the type of malware, the amount of personal card details and other data that had been breached and managed to stop and contain the breach. A notification to the Information Commissioner’s Office was crafted, and the team helped the insured comply with its payment card industry obligations. The claim was settled at £65,000.

Employee Error

An HR employee for a healthcare organisation mistakenly attached the wrong file to an email which was sent to four job applicants. The file included HR demographic data for 43,000 former employees, as well as their names, addresses, and national identity card numbers. The organisation contacted their insurer, who provided an Incident Response Manager and legal support to manage the regulatory implications of the breach.

Ransom Attack

An employee of a car component manufacturing company unintentionally clicked a link in an email, which downloaded malware onto the company server. It encrypted access to the system, and a message appeared on the employee’s computer demanding £10,000 be paid by Bitcoin in the next 48 hours in exchange for the decryption key. The company’s insurer brought in forensic IT investigators to assess the cyber threat and decide whether it was real.

What isn’t covered by cyber insurance?

Cyber Insurance is a life-saving tool for any business that uses computers, messaging systems, and other software to operate, which, let’s face it, is most businesses. But it doesn’t cover everything.

Cyber Insurance doesn’t usually cover:

• Physical damage to hardware (e.g. fried servers from a power surge)

• Cyber crime acts from within the company

• Pre-existing or unresolved cyber incidents

• Upgrades to computer systems

• Fines and penalties for non-compliance (unless specifically included)

• Reputational damage (unless specifically included)

Read your policy documents thoroughly and get additional protection where possible to ensure your business is fully protected against cyber crime, data breaches, and other business risks.

Why choose Glowsure?

As independent cyber insurers, we’ll search the market for you, and if you have to make a claim, we’ll do so on your behalf. We just need to understand your business, its size, IT systems, and any existing network security you may have, and we’ll search the market for the best cover and price.

Protect your business from cyber crime. Contact Glowsure today for a free cyber insurance quote!

Frequently asked questions about cyber and data risk insurance

Take a look at some of our common Cyber Insurance FAQs below to learn more about cyber cover for your business.

Can’t find what you’re looking for? Head to our blog for more cyber insurance articles, or call Glowsure today on 01730 239387 to discuss your unique situation. Let us help you find the right business insurance that makes sure you are covered!