What Cyber Insurance Requirements Apply in Delaware?

A Delaware person doing business in the state that owns or licenses computerized data containing covered personal information generally must notify residents within 60 days after determination, unless an appropriate investigation finds harm unlikely or another statutory route applies. Section 12B-103 deems notice procedures compliant when a person follows qualifying internal or state or federal regulator procedures; the chapter separately sets an Attorney General threshold above 500 residents and an SSN monitoring offer.

What Is Cyber Insurance?

Cyber insurance can help pay covered response costs and claims against your business after a cyber incident. If your business relies on data, software or outside providers, compare response limits, vendor outages and approval rules. Read the national Cyber liability guide.

What Should You Watch for With Cyber Insurance in Delaware?

The Sixty Days Start at Determination
Delaware defines determination as the point when an owner, licensee, or maintainer has sufficient evidence that a breach occurred. Notice is due without unreasonable delay and within 60 days, subject to a shorter federal period, a requested law-enforcement delay, and a late-identified-resident rule. Ask the incident team to record both the determination and any later identification dates. ¹
More Than 500 Residents Adds an AG Filing
If more than 500 Delaware residents require notice, § 12B-102(d) requires Attorney General notice no later than resident notice. Section 12B-103 also deems certain internal or regulator-based resident-notice procedures compliant with this chapter when its conditions are met; the statute does not state in § 12B-103 whether that route removes the separate AG filing step. Ask counsel to assess both provisions before a filing decision. ¹
Social Security Number Breaches Add a Year of Monitoring
When a breach includes a Social Security number, the person must offer affected Delaware residents one year of free credit monitoring and give enrollment and credit-freeze information, unless an appropriate investigation reasonably finds harm unlikely. Check that the plan budgets for the required offer when SSNs are involved. ¹
Do Not Send Credential Notice to the Breached Email
If only online credentials were exposed for an email account the business furnished, Delaware bars sending the breach notice to that compromised address. Use another permitted method or a clear notice when the resident connects to the account; ask who owns account-specific reset instructions. ¹
Regulator Procedures May Supply the Notice Route
A person with its own notice procedures in an information-security policy may be deemed compliant if the procedures meet the chapter’s timing rules and it notifies residents under that policy. A person regulated by state or federal law may also qualify by maintaining and following its primary or functional regulator’s breach procedures. Ask which procedures govern your organization and how they interact with the separate Attorney General threshold. ¹

Which Cyber Insurance Providers Have Delaware License Records?

These providers publish a national listing for Cyber liability; the license records below name the licensed entities and roles. Some records rely on company-reported information rather than independent regulator verification. A national listing does not confirm the product is available in Delaware. Check the regulator’s license lookup and confirm state availability for your business when requesting a quote.

At-Bay
Insurance producer, Surplus-lines broker · checked 2026-09-28
At-Bay Insurance Services LLC
At-Bay’s license page lists P&C producer and surplus-lines broker license numbers for all 50 states and the District of Columbia. These are company disclosures and do not establish product availability in each jurisdiction. ⁸
At-Bay offers primary and excess cyber insurance for businesses with revenue up to $5 billion.
Coalition
Insurance producer, Surplus-lines broker · checked 2026-09-28
Coalition Insurance Solutions, Inc.
Coalition’s license page lists producer and surplus-lines licenses for Coalition Insurance Solutions, Inc. in all 50 states and the District of Columbia. The page separately lists insurers; this record covers the brokerage entity only. ⁹
Coalition offers cyber insurance.
Corgi
Insurance producer · checked 2026-09-28
Corgi Insurance Services, Inc.
Corgi’s company producer-license table lists 50 jurisdictions: 49 states and the District of Columbia, including DC license 3003091619. New Mexico does not appear in the table and is not included here; the omission does not establish that Corgi is unlicensed there. The company-reported table has no stated as-of date and does not establish product availability. ¹⁰
Corgi lists cyber insurance among its business insurance offerings.
Hiscox
Insurer · checked 2026-09-28
Hiscox Insurance Company Inc.
Hiscox’s U.S. company information states that Hiscox Insurance Company Inc. is licensed in all 50 states and the District of Columbia. This is company-reported insurer authority for this entity and does not establish which company issues every Hiscox-branded product. ¹¹
Hiscox offers cyber insurance for small businesses.
RiskCube
Insurance producer · checked 2026-09-28
RiskCube Insurance Services, LLC
RiskCube’s license page, effective February 11, 2026, lists property-and-casualty producer/broker licenses in California and Delaware and names NPN 21694336. The company says it is expanding its licensing footprint; no other states are listed. ¹³
RiskCube arranges cyber insurance for startups.
TechInsurance
Insurance producer · checked 2026-09-28
Specialty Program Group LLC
TechInsurance’s current licensing page names Specialty Program Group LLC / SPG Insurance Solutions and lists state license numbers, but labels Rhode Island “Individual licenses” rather than identifying a license for the named agency. RI is omitted because this disclosure does not establish agency authority there; this is a search limitation, not an assertion that the company is unlicensed. The remaining state entries are company-reported and are not an insurance product availability map. ¹⁴
TechInsurance arranges cyber insurance for small businesses.
Vouch
Insurance producer, Surplus-lines broker · checked 2026-09-28
Vouch Specialty Insurance Services, LLC
Vouch’s licenses page, effective January 16, 2025, lists producer licenses in all 50 states and DC. Its separate surplus-lines table includes Idaho number 870820, while a footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses. Because those statements conflict for Idaho, this record keeps Idaho producer-only and does not treat the table number as established agency surplus-lines authority. The page is company-reported and does not establish product availability. ¹⁵
Vouch lists cyber liability in its technology-company programs.

Who Regulates Insurance in Delaware?

Delaware Department of Insurance

The Delaware Department of Insurance licenses and regulates insurers and insurance producers, reviews regulated insurance activity, and handles complaints. Its consumer division can help you raise an insurance concern and its services page links to official license searches. ^3,^4,⁵

Website: Regulator website
License lookup: Search licensed producers
Complaints: File a complaint
Phone: (800) 282-8611

Surplus-Lines Tax and Stamping Office in Delaware

Reported tax rate. 3% of gross premium, less return premium, when Delaware is the home state ^6,⁷

When Delaware is the insured’s home state, its 3% surplus-lines premium tax applies to the entire premium of a multistate policy, less returned premiums and excluding federal and state taxes and examination fees. Ask the surplus-lines broker to confirm the home-state determination and tax calculation, and separately explain how exposures are allocated in the required reports; those allocations do not reduce the premium subject to Delaware’s tax.

What Should You Ask Before Buying Cyber Insurance in Delaware?

How will you timestamp Delaware’s 60-day clock at the statutory determination point and track residents identified later?
If more than 500 Delaware residents need notice, does the service provide the state filing with Delaware-only counts and incident details by the consumer-notice date?
Does our response arrangement include one year of credit monitoring when Social Security numbers are involved, unless the statutory no-harm finding applies?
Who sends account-specific notices when the compromised credentials belong to an email account we provide?
Do our written breach procedures qualify under 6 Del. C. § 12B-103, and what separate Attorney General filing does § 12B-102(d) require for this incident?

Cyber Insurance in Delaware: Frequently Asked Questions

What is Delaware’s breach-notification deadline?

Without unreasonable delay and no later than 60 days after the point when there is sufficient evidence to conclude a breach occurred, subject to statutory law-enforcement and late-identified-resident provisions. ¹

When must Delaware’s Attorney General be notified of a breach?

Generally, when more than 500 Delaware residents require notice, by the time residents are notified. Section 12B-103 separately deems qualifying internal or regulator-based procedures compliant with the chapter’s notice requirements; assess its application before concluding which notices are due. ¹

Does Delaware require free credit monitoring after a data breach?

Yes, for one year when the breach includes a Social Security number, unless an appropriate investigation reasonably determines the breach is unlikely to cause harm. ¹

Can a regulated Delaware business follow its federal regulator’s breach-notice procedures?

Potentially. Section 12B-103 deems a regulated person compliant with the chapter’s notice requirements if it maintains breach procedures set by its primary or functional regulator and notifies affected Delaware residents under those procedures. ¹

Sources for Cyber Insurance in Delaware

1
Delaware Code, Chapter 12B: Computer Security Breaches. Delaware General Assembly; 6 Del. C. §§ 12B-101(2), (5), (7); 12B-102(a)–(f); 12B-103(a)–(b), including alternative procedures route. Accessed 2026-09-28.
2
Model Data Security Breach Notification Form. Delaware Department of Justice, Consumer Protection Unit; Model form fields, reporting scope, separate consumer notice vs. AG notice. Accessed 2026-09-28.
3
Delaware Department of Insurance. Delaware Department of Insurance; Official Department homepage and regulatory resources. Accessed 2026-09-28.
4
Services. Delaware Department of Insurance; Department service directory links to the state insurance licensee search. Accessed 2026-09-28.
5
Consumer Services. Delaware Department of Insurance; Complaint filing and consumer assistance; publishes Consumer Services phone. Accessed 2026-09-28.
6
Surplus Lines Bulletin 22. Delaware Department of Insurance; Surplus Lines Bulletin 22 (October 2025; printed day is blank), reproducing 18 Del. C. § 1925: home-state tax treatment, all premium on multistate policy if Delaware is home state, 3% rate, and exclusion of federal/state taxes and examination fees from gross premium. Accessed 2026-09-28.
7
Delaware Code, Title 18, §§1923–1925. Delaware General Assembly; §1923(a)(1),(12) home-state verification and allocation records; §1924(b)(3)–(6) separate premium reporting; §1925(b)–(c) 3% tax, deductions/exclusions and full multistate premium when Delaware is home state. Accessed 2026-09-28.
8
Licenses. At-Bay; Current producer introduction and state table; At-Bay Insurance Services LLC; P&C and surplus-lines identifiers. Accessed 2026-09-21.
9
Licenses and Carriers. Coalition; Licenses and Carriers, re-read 22 September 2026: Insurance Licenses table for Coalition Insurance Solutions, Inc., national producer number 18419475, with producer and surplus-lines numbers for all 50 states and DC including California 0L76155, Georgia 196479, Texas 2199630 and 2205589, Pennsylvania 815731 and 817452, Colorado 539028 and Wisconsin 3000108852. Insurance Carriers table naming, with NAIC numbers, Allianz Underwriters Insurance Company 36420, Arch Specialty Insurance Company 21199, Ascot Specialty Insurance Company 45055, Ascot Insurance Company 23752, Aspen Specialty Insurance Company 10717, Chaucer Insurance Company DAC, Coalition Insurance Company 29530, Fireman's Fund Indemnity Corporation 11380, Fortegra Specialty Insurance Company 16823, Lloyd's of London, MSIG Specialty Insurance USA Inc. 34886, MS Transverse Specialty Insurance Company 41807, Steadfast Insurance Company 26387, Vantage Risk Specialty Insurance Company 16275 and Zurich American Insurance Company 16535. Accessed 2026-09-22.
10
Insurance Producer Licenses. Corgi Insurance; Current complete Insurance Producer Licenses table for Corgi Insurance Services, Inc.; 50 rows covering 49 states and DC (DC 3003091619); no New Mexico row; no NPN or as-of date shown. Accessed 2026-09-28.
11
About Hiscox US Insurance. Hiscox; Hiscox Insurance Company Inc. NAIC 10200 as Chicago, IL domiciled insurer admitted or licensed in all 50 states and D.C.; Hiscox Inc. as general agent and Lloyd’s coverholder for Syndicates 33 and 3624; surplus-lines placements through licensed surplus-lines brokers; A.M. Best rating statement. Accessed 2026-09-16.
12
Licenses. ERGO NEXT Insurance; Current entity-by-state license table reopened 28 September 2026: 50 rows under Next First Insurance Agency, Inc., including Washington, DC; New York rows instead list Next Insurance Services PC-1423070 and AP Intego BR-1198885. Accessed 2026-09-28.
13
Licenses & Disclosures. RiskCube; Property & Casualty Producer/Broker Licenses; February 11, 2026 version. Accessed 2026-09-16.
14
Insurance Licenses by State. TechInsurance; Current state table; identifies TechInsurance as a division of Specialty Program Group LLC d/b/a SPG Insurance Solutions; lists DC 3000041536 and labels Rhode Island “Individual licenses,” without an agency license number. Accessed 2026-09-28.
15
Licenses. Vouch; Effective 16 January 2025: Vouch Specialty Insurance Services, LLC, NPN 19926463; P&C table (50 states and DC); surplus-lines table includes Idaho 870820; footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses; Idaho retained as producer-only due to conflict. Accessed 2026-09-15.

What Cyber Insurance Requirements Apply in Delaware?

What Is Cyber Insurance?

What Should You Watch for With Cyber Insurance in Delaware?

The Sixty Days Start at Determination

More Than 500 Residents Adds an AG Filing

Social Security Number Breaches Add a Year of Monitoring

Do Not Send Credential Notice to the Breached Email

Regulator Procedures May Supply the Notice Route

Which Cyber Insurance Providers Have Delaware License Records?

At-Bay

Coalition

Corgi

Hiscox

RiskCube

TechInsurance

Vouch