What Cyber Insurance Requirements Apply in Illinois?

Illinois’s general business rule requires a data collector that owns or licenses personal information concerning an Illinois resident to notify that resident at no charge after a breach, as soon as possible without unreasonable delay. A private data collector required to notify more than 500 residents of one breach must also report it to the Attorney General by consumer notice unless the §50 HIPAA route applies; that route requires a qualifying covered entity or business associate to copy a required HHS breach notice to the Attorney General within five business days. The separate 45-day report for more than 250 residents in §12(e) applies only to State agencies.

What Is Cyber Insurance?

Cyber insurance can help pay covered response costs and claims against your business after a cyber incident. If your business relies on data, software or outside providers, compare response limits, vendor outages and approval rules. Read the national Cyber liability guide.

What Should You Watch for With Cyber Insurance in Illinois?

Illinois Sets No Fixed Day Count in Its Guidance
Section 10(a) requires a data collector that owns or licenses personal information concerning an Illinois resident to notify the resident at no charge after discovery or notice of breach. Timing is the most expedient possible without unreasonable delay, consistent with determining scope and restoring system integrity; the section gives no general private-business day count. Record the investigation and notice timeline. ³
HIPAA Reporting Adds a Five-Business-Day State Notice
A HIPAA covered entity or business associate that is subject to and complies with HIPAA/HITECH privacy and security standards is deemed compliant with PIPA if it sends the Illinois Attorney General any breach notice it must send to HHS within five business days after notifying HHS. Section 10(e) excludes such entities from its more-than-500-resident AG filing when they comply with § 50; keep the two routes and the State-agency rule in § 12(e) separate. ^5,³
More Than 500 Resident Notices Add an AG Filing
For a single breach requiring notice to more than 500 Illinois residents, a data collector must notify the Attorney General as soon as possible and no later than its consumer notice; this subsection excludes covered entities and business associates compliant with § 50. The AG asks for affected-person counts, incident dates, compromised information, consumer notice templates, and any credit-monitoring or fraud-detection offer, and the public can search reported breaches by name or timeframe. Track the resident count and confirm which statutory route applies. ^3,^5,^1,²
The AG Describes PIPA as Broadly Covering Business Data Handling
The Attorney General says PIPA applies to entities conducting business in Illinois that handle, collect, disseminate, or otherwise deal with nonpublic personal information concerning Illinois residents. Identify which entity owns or maintains the data and keep the incident-response contact available for an AG filing or follow-up. ¹
The 45-Day Rule in Section 12(e) Is for State Agencies
Section 12(e) requires a State agency with a single breach affecting more than 250 Illinois residents to notify the Attorney General within 45 days of discovery or when it notifies residents, whichever is sooner, subject to stated delay grounds. That subsection does not set the general private-business reporting rule; data collectors use §10(e), while §50 contains the separate HIPAA route. ^4,^3,⁵

Which Cyber Insurance Providers Have Illinois License Records?

These providers publish a national listing for Cyber liability; the license records below name the licensed entities and roles. Some records rely on company-reported information rather than independent regulator verification. A national listing does not confirm the product is available in Illinois. Check the regulator’s license lookup and confirm state availability for your business when requesting a quote.

At-Bay
Insurance producer, Surplus-lines broker · checked 2026-09-28
At-Bay Insurance Services LLC
At-Bay’s license page lists P&C producer and surplus-lines broker license numbers for all 50 states and the District of Columbia. These are company disclosures and do not establish product availability in each jurisdiction. ¹⁵
At-Bay offers primary and excess cyber insurance for businesses with revenue up to $5 billion.
Coalition
Insurance producer, Surplus-lines broker · checked 2026-09-28
Coalition Insurance Solutions, Inc.
Coalition’s license page lists producer and surplus-lines licenses for Coalition Insurance Solutions, Inc. in all 50 states and the District of Columbia. The page separately lists insurers; this record covers the brokerage entity only. ¹⁶
Coalition offers cyber insurance.
Corgi
Insurance producer · checked 2026-09-28
Corgi Insurance Services, Inc.
Corgi’s company producer-license table lists 50 jurisdictions: 49 states and the District of Columbia, including DC license 3003091619. New Mexico does not appear in the table and is not included here; the omission does not establish that Corgi is unlicensed there. The company-reported table has no stated as-of date and does not establish product availability. ¹⁷
Corgi lists cyber insurance among its business insurance offerings.
Hiscox
Insurer · checked 2026-09-28
Hiscox Insurance Company Inc.
Hiscox’s U.S. company information states that Hiscox Insurance Company Inc. is licensed in all 50 states and the District of Columbia. This is company-reported insurer authority for this entity and does not establish which company issues every Hiscox-branded product. ¹⁸
Hiscox offers cyber insurance for small businesses.
Risklytics
Insurance producer · checked 2026-09-28
Risklytics, Inc.
Risklytics’ licensing page lists its Massachusetts resident agency license plus state license records in Arizona, Colorado, Illinois, Indiana, New Jersey, Ohio, Texas and Washington; it identifies the NPN record date as September 10, 2026. This list is company-published and not a product availability map. ²⁰
Risklytics arranges cyber insurance for robotics, hardware and AI businesses.
TechInsurance
Insurance producer · checked 2026-09-28
Specialty Program Group LLC
TechInsurance’s current licensing page names Specialty Program Group LLC / SPG Insurance Solutions and lists state license numbers, but labels Rhode Island “Individual licenses” rather than identifying a license for the named agency. RI is omitted because this disclosure does not establish agency authority there; this is a search limitation, not an assertion that the company is unlicensed. The remaining state entries are company-reported and are not an insurance product availability map. ²¹
TechInsurance arranges cyber insurance for small businesses.
Vouch
Insurance producer, Surplus-lines broker · checked 2026-09-28
Vouch Specialty Insurance Services, LLC
Vouch’s licenses page, effective January 16, 2025, lists producer licenses in all 50 states and DC. Its separate surplus-lines table includes Idaho number 870820, while a footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses. Because those statements conflict for Idaho, this record keeps Idaho producer-only and does not treat the table number as established agency surplus-lines authority. The page is company-reported and does not establish product availability. ²²
Vouch lists cyber liability in its technology-company programs.

Who Regulates Insurance in Illinois?

Illinois Department of Insurance

The Department licenses and oversees insurers and insurance producers doing business in Illinois, reviews regulated insurance activity, and investigates complaints about coverage, claims, premiums, and sales. ^6,^8,⁷

Website: Regulator website
License lookup: Search licensed producers
Complaints: File a complaint
Phone: (866) 445-5364

Surplus-Lines Tax and Stamping Office in Illinois

Reported tax rate. 3.5% of taxable premium plus a 0.04% stamping fee; separate 1% fire marshal tax on taxable fire premium ^10,^9,^13,^14,¹¹

When Illinois is the insured’s home state, the broker reports and remits a 3.5% tax on gross taxable surplus-line premium less returned taxable premium. The separate SLAI stamping fee is 0.04% for policies effective on or after January 1, 2023; a 1% fire marshal tax also applies to taxable fire premium.

Surplus Line Association of Illinois

Illinois guaranty fund limits: For covered claims against a member insurer, the Illinois Insurance Guaranty Fund generally caps its obligation at $500,000 per claim; workers’ compensation claims are excepted from that dollar cap. This fund does not protect policies issued by nonadmitted surplus-lines insurers. The net-worth exclusions apply to covered claims against member insurers. ¹¹
Illinois FAIR Plan: If you cannot obtain basic property coverage in the voluntary market, the Illinois FAIR Plan offers a residual-market option for eligible property. Check its current eligibility and coverage limits before relying on it for a commercial location. ¹²

What Should You Ask Before Buying Cyber Insurance in Illinois?

How does the response team document its Illinois investigation and resident-notice timing under the most-expedient-time standard?
If we must report a HIPAA breach to HHS, who also submits the Illinois Attorney General notice within five business days?
Who gathers Illinois resident counts, the notice template, and any identity-protection offer for the Attorney General filing?
Does the incident plan identify which affiliate or service provider handles nonpublic Illinois resident information and owns the notice decision?
Does §10(e), the State-agency-only §12(e), or the qualifying HIPAA route in §50 govern our entity and this incident?

Cyber Insurance in Illinois: Frequently Asked Questions

How long does Illinois give a business to notify residents after a data breach?

Illinois requires notice in the most expedient time possible and without unreasonable delay, consistent with investigation and system-restoration measures; the Attorney General’s business guidance states no fixed number of days. ¹

When must a HIPAA entity notify the Illinois Attorney General about a breach?

A HIPAA covered entity or business associate subject to and compliant with HIPAA/HITECH standards that must notify HHS about a breach must also notify the Illinois Attorney General within five business days after notifying HHS. ^5,¹

Can the public search Illinois data-breach reports?

Yes. The Illinois Attorney General says the public can search its database of reported breaches affecting Illinois residents by name or timeframe without an account. ²

When must an Illinois business report a breach to the Attorney General?

A data collector required to notify more than 500 Illinois residents because of one breach must report it to the Attorney General as soon as possible and no later than consumer notice. Section 10(e) excludes covered entities and business associates compliant with § 50. ^3,⁵

Sources for Cyber Insurance in Illinois

1
Data Breach Reporting for Businesses and State Government Agencies. Illinois Attorney General; AG business guidance: private-business applicability and timing; §12(e) State-agency-only report; §50 HIPAA route; requested filing fields. Accessed 2026-09-28.
2
Identity Theft: Data Breaches. Illinois Attorney General; Data Breaches section: public breach-notice search by entity or timeframe. Accessed 2026-09-28.
3
815 ILCS 530/10 - Notice of Breach; Notice to Attorney General. Illinois General Assembly, Public File Repository; Current ILCS FTP text § 10(a), (b), (b-5), and (e): resident-notice scope/timing, data-collector handoff, law-enforcement delay, business AG threshold (>500), and § 50 exception; source note: P.A. 100-201 and 101-343, effective 2017 and 2020. Accessed 2026-09-28.
4
815 ILCS 530/12 - Notice of Breach; State Agency. Illinois General Assembly, Public File Repository; Current ILCS FTP text § 12(e): State-agency-only AG report for a single breach affecting more than 250 Illinois residents; 45 days after discovery or resident notice, whichever is sooner, subject to stated delay grounds; source note: P.A. 99-503 and 100-412, effective 2017. Accessed 2026-09-28.
5
815 ILCS 530/50 - Entities Subject to HIPAA. Illinois General Assembly, Public File Repository; Current ILCS FTP text § 50: qualifying HIPAA covered entity/business associate deemed compliant with Act if any required HITECH report to HHS is copied to AG within five business days; source note: P.A. 99-503, effective 2017. Accessed 2026-09-28.
6
Illinois Department of Insurance. Illinois Department of Insurance; Official agency homepage and agency information. Accessed 2026-09-28.
7
File a Complaint. Illinois Department of Insurance; Official insurance complaint intake and consumer phone. Accessed 2026-09-28.
8
Agent Lookup. Illinois Department of Insurance; Department page explains use of Illinois SBS Lookup for agents, brokers, and business entities; Department home provides company license lookup. Accessed 2026-09-28.
9
Calculating & Remitting Taxes: Surplus Line Tax. Surplus Line Association of Illinois; Current surplus-line tax applicability and rate. Accessed 2026-09-28.
10
215 ILCS 5/445: Surplus line. Illinois General Assembly; Subsections (3)(a), (12): tax and code applicability. Accessed 2026-09-28.
11
215 ILCS 5: Illinois Insurance Guaranty Fund. Illinois General Assembly; Article XXXIV: cap, net-worth exclusions, exceptions, and non-admitted insurer exclusion. Accessed 2026-09-28.
12
Illinois FAIR Plan Association. Illinois FAIR Plan Association; Plan overview and current eligibility information. Accessed 2026-09-28.
13
Stamping Fees: Fee Calculation. Surplus Line Association of Illinois; Current stamping fee 0.04% of premium for policies effective January 1, 2023 or later; may be passed to insured. Accessed 2026-09-28.
14
50 Ill. Adm. Code § 2701.130: Taxes. Illinois Joint Committee on Administrative Rules; Surplus line producer pays 1% fire marshal tax on gross premiums less returned premiums for insurance subject to the Fire Investigation Act. Accessed 2026-09-28.
15
Licenses. At-Bay; Current producer introduction and state table; At-Bay Insurance Services LLC; P&C and surplus-lines identifiers. Accessed 2026-09-21.
16
Licenses and Carriers. Coalition; Licenses and Carriers, re-read 22 September 2026: Insurance Licenses table for Coalition Insurance Solutions, Inc., national producer number 18419475, with producer and surplus-lines numbers for all 50 states and DC including California 0L76155, Georgia 196479, Texas 2199630 and 2205589, Pennsylvania 815731 and 817452, Colorado 539028 and Wisconsin 3000108852. Insurance Carriers table naming, with NAIC numbers, Allianz Underwriters Insurance Company 36420, Arch Specialty Insurance Company 21199, Ascot Specialty Insurance Company 45055, Ascot Insurance Company 23752, Aspen Specialty Insurance Company 10717, Chaucer Insurance Company DAC, Coalition Insurance Company 29530, Fireman's Fund Indemnity Corporation 11380, Fortegra Specialty Insurance Company 16823, Lloyd's of London, MSIG Specialty Insurance USA Inc. 34886, MS Transverse Specialty Insurance Company 41807, Steadfast Insurance Company 26387, Vantage Risk Specialty Insurance Company 16275 and Zurich American Insurance Company 16535. Accessed 2026-09-22.
17
Insurance Producer Licenses. Corgi Insurance; Current complete Insurance Producer Licenses table for Corgi Insurance Services, Inc.; 50 rows covering 49 states and DC (DC 3003091619); no New Mexico row; no NPN or as-of date shown. Accessed 2026-09-28.
18
About Hiscox US Insurance. Hiscox; Hiscox Insurance Company Inc. NAIC 10200 as Chicago, IL domiciled insurer admitted or licensed in all 50 states and D.C.; Hiscox Inc. as general agent and Lloyd’s coverholder for Syndicates 33 and 3624; surplus-lines placements through licensed surplus-lines brokers; A.M. Best rating statement. Accessed 2026-09-16.
19
Licenses. ERGO NEXT Insurance; Current entity-by-state license table reopened 28 September 2026: 50 rows under Next First Insurance Agency, Inc., including Washington, DC; New York rows instead list Next Insurance Services PC-1423070 and AP Intego BR-1198885. Accessed 2026-09-28.
20
About Risklytics. Risklytics; What we do; Who we insure; Licensing; Agency licenses table dated 2026-09-10. Accessed 2026-09-16.
21
Insurance Licenses by State. TechInsurance; Current state table; identifies TechInsurance as a division of Specialty Program Group LLC d/b/a SPG Insurance Solutions; lists DC 3000041536 and labels Rhode Island “Individual licenses,” without an agency license number. Accessed 2026-09-28.
22
Licenses. Vouch; Effective 16 January 2025: Vouch Specialty Insurance Services, LLC, NPN 19926463; P&C table (50 states and DC); surplus-lines table includes Idaho 870820; footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses; Idaho retained as producer-only due to conflict. Accessed 2026-09-15.

What Cyber Insurance Requirements Apply in Illinois?

What Is Cyber Insurance?

What Should You Watch for With Cyber Insurance in Illinois?

Illinois Sets No Fixed Day Count in Its Guidance

HIPAA Reporting Adds a Five-Business-Day State Notice

More Than 500 Resident Notices Add an AG Filing

The AG Describes PIPA as Broadly Covering Business Data Handling

The 45-Day Rule in Section 12(e) Is for State Agencies

Which Cyber Insurance Providers Have Illinois License Records?

At-Bay

Coalition

Corgi

Hiscox

Risklytics

TechInsurance

Vouch