What Cyber Insurance Requirements Apply in Massachusetts?

When you know or have reason to know of a breach involving a Massachusetts resident’s personal information, you must notify both the Attorney General and the Office of Consumer Affairs and Business Regulation, as well as affected residents, as soon as practicable and without unreasonable delay. If a resident’s Social Security number was disclosed or is reasonably believed disclosed, offer free third-party credit monitoring for at least 18 months.

What Is Cyber Insurance?

Cyber insurance can help pay covered response costs and claims against your business after a cyber incident. If your business relies on data, software or outside providers, compare response limits, vendor outages and approval rules. Read the national Cyber liability guide.

What Should You Watch for With Cyber Insurance in Massachusetts?

Massachusetts Requires Two Agency Filings
The owner or licensee must notify both the Attorney General and the Office of Consumer Affairs and Business Regulation, along with affected residents. The agency report includes affected counts, compromised data types, response steps, and whether the written information security program is being updated; confirm your incident vendor prepares both filings. ^1,³
An Exposed SSN Triggers 18 Months of Monitoring
If a Massachusetts resident’s Social Security number was disclosed or reasonably believed disclosed, the person must contract with a third party for at least 18 months of free credit monitoring. The notice must include enrollment information and credit-freeze instructions; ask your response service who will procure and administer the offer. ^2,³
The Law Sets No Fixed Number of Days
Massachusetts requires notice as soon as practicable and without unreasonable delay; an agency may delay it only after a law-enforcement determination that notice would impede a criminal investigation. Ask how your response plan tracks that decision and resumes notices when the delay ends. ¹

Which Cyber Insurance Providers Have Massachusetts License Records?

These providers publish a national listing for Cyber liability; the license records below name the licensed entities and roles. Some records rely on company-reported information rather than independent regulator verification. A national listing does not confirm the product is available in Massachusetts. Check the regulator’s license lookup and confirm state availability for your business when requesting a quote.

At-Bay
Insurance producer, Surplus-lines broker · checked 2026-09-28
At-Bay Insurance Services LLC
At-Bay’s license page lists P&C producer and surplus-lines broker license numbers for all 50 states and the District of Columbia. These are company disclosures and do not establish product availability in each jurisdiction. ¹²
At-Bay offers primary and excess cyber insurance for businesses with revenue up to $5 billion.
Coalition
Insurance producer, Surplus-lines broker · checked 2026-09-28
Coalition Insurance Solutions, Inc.
Coalition’s license page lists producer and surplus-lines licenses for Coalition Insurance Solutions, Inc. in all 50 states and the District of Columbia. The page separately lists insurers; this record covers the brokerage entity only. ¹³
Coalition offers cyber insurance.
Corgi
Insurance producer · checked 2026-09-28
Corgi Insurance Services, Inc.
Corgi’s company producer-license table lists 50 jurisdictions: 49 states and the District of Columbia, including DC license 3003091619. New Mexico does not appear in the table and is not included here; the omission does not establish that Corgi is unlicensed there. The company-reported table has no stated as-of date and does not establish product availability. ¹⁴
Corgi lists cyber insurance among its business insurance offerings.
Hiscox
Insurer · checked 2026-09-28
Hiscox Insurance Company Inc.
Hiscox’s U.S. company information states that Hiscox Insurance Company Inc. is licensed in all 50 states and the District of Columbia. This is company-reported insurer authority for this entity and does not establish which company issues every Hiscox-branded product. ¹⁵
Hiscox offers cyber insurance for small businesses.
Risklytics
Insurance producer · checked 2026-09-28
Risklytics, Inc.
Risklytics’ licensing page lists its Massachusetts resident agency license plus state license records in Arizona, Colorado, Illinois, Indiana, New Jersey, Ohio, Texas and Washington; it identifies the NPN record date as September 10, 2026. This list is company-published and not a product availability map. ¹⁷
Risklytics arranges cyber insurance for robotics, hardware and AI businesses.
TechInsurance
Insurance producer · checked 2026-09-28
Specialty Program Group LLC
TechInsurance’s current licensing page names Specialty Program Group LLC / SPG Insurance Solutions and lists state license numbers, but labels Rhode Island “Individual licenses” rather than identifying a license for the named agency. RI is omitted because this disclosure does not establish agency authority there; this is a search limitation, not an assertion that the company is unlicensed. The remaining state entries are company-reported and are not an insurance product availability map. ¹⁸
TechInsurance arranges cyber insurance for small businesses.
Vouch
Insurance producer, Surplus-lines broker · checked 2026-09-28
Vouch Specialty Insurance Services, LLC
Vouch’s licenses page, effective January 16, 2025, lists producer licenses in all 50 states and DC. Its separate surplus-lines table includes Idaho number 870820, while a footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses. Because those statements conflict for Idaho, this record keeps Idaho producer-only and does not treat the table number as established agency surplus-lines authority. The page is company-reported and does not establish product availability. ¹⁹
Vouch lists cyber liability in its technology-company programs.

Who Regulates Insurance in Massachusetts?

Massachusetts Division of Insurance

The Massachusetts Division of Insurance licenses insurers and producers, reviews rates and forms, and handles insurance complaints. Use the State Based Systems lookup for producers, agencies, and surplus-lines brokers. For insurer status, use the DOI’s separate licensed or approved company lists, including the eligible surplus-lines company list. Before filing a complaint, contact the insurer or producer; if the response is unsatisfactory, submit the online form with supporting papers. The DOI says not to use the form for ongoing litigation. ^4,^5,^6,⁷

Website: Regulator website
License lookup: Search licensed producers
Complaints: File a complaint
Phone: 617-521-7794

Surplus-Lines Tax and Stamping Office in Massachusetts

Reported tax rate. 4% of gross premiums less gross return premiums on risks or exposures in Massachusetts or another state when Massachusetts is the insured’s home state. ^8,^9,^10,¹¹

A diligent effort to place coverage with admitted insurers is generally required before surplus-lines placement through a specially licensed Massachusetts broker. The narrow §224 large-commercial exception is described in the note below.

Multi-state surplus-lines tax dates and exceptions: For this rule, home state means the state of the insured’s principal place of business or, for an individual, principal residence; if 100% of the risk is outside that state, home state is where the greatest percentage of taxable premium for that insurance contract is allocated. For multi-state policies effective on or after August 10, 2018, the Division of Insurance says the 4% tax applies to gross premium regardless of whether risks are inside or outside Massachusetts when Massachusetts is the insured’s home state. For earlier effective dates, Massachusetts risk portions are taxed at 4%, while out-of-state portions are taxed at the rates for their allocated premium. The Division lists exceptions for policies issued to the Massachusetts Bay Transportation Authority, federal credit unions when they are the purchaser, and tribal lands on reservations. Brokers still make required filings for exempt policies. Tax-exempt status alone is not specifically excluded. ^8,⁹
Narrow large-commercial placement exception: Section 168(b)(iv) exempts the diligent-effort affidavit and excess-placement condition in §168(b)(iii) only for a §224 qualifying commercial risk or policyholder. The policyholder must acknowledge in writing that the insurer is not admitted and that the Massachusetts Insurers Insolvency Fund will not pay an insolvency loss. Section 224 eligibility is limited to a corporation, partnership, trust, sole proprietorship, or other business or public entity with at least $30,000 in aggregate property-and-casualty premiums, excluding workers’ compensation. The holder must certify its election and understanding of limited regulatory oversight and certify at least two criteria: net worth of $10 million; net revenue or sales of $5 million; more than 25 employees per individual company OR more than 50 employees per holding company aggregate; a nonprofit or public entity with annual budget or assets of $25 million or more; a municipality with population of 20,000 or more; or retention of a risk manager who is either a full-time employee or retained by the policyholder; that person must be licensed and hold one of these qualifications: certified insurance counselor, chartered property and casualty underwriter, associate in risk management, certified risk manager, or licensed insurance advisor in property and casualty. ^10,¹¹

What Should You Ask Before Buying Cyber Insurance in Massachusetts?

Does the response plan notify both Massachusetts agencies and residents in the same incident workflow?
If Social Security numbers are involved, who contracts for 18 months of free monitoring and provides enrollment and credit-freeze instructions?
How will we record the law-enforcement basis and release date if notice is delayed in Massachusetts?

Cyber Insurance in Massachusetts: Frequently Asked Questions

Who must a Massachusetts business notify after a breach?

The Attorney General, the Office of Consumer Affairs and Business Regulation, and affected residents, as soon as practicable and without unreasonable delay. ^1,³

Does Massachusetts require credit monitoring after a breach?

Yes, for at least 18 months at no cost when a resident’s Social Security number was disclosed or is reasonably believed disclosed; consumer reporting agencies must offer 42 months. ²

How many days does Massachusetts give a business to notify residents?

The statute sets no fixed day count; notice must be provided as soon as practicable and without unreasonable delay, subject to a law-enforcement delay. ¹

Sources for Cyber Insurance in Massachusetts

1
Massachusetts General Laws Chapter 93H, §3 - Duty to Report. Massachusetts General Court; M.G.L. c.93H §3(b), (d); accessed 2026-09-28. Accessed 2026-09-28.
2
Massachusetts General Laws Chapter 93H, §3A - Credit Monitoring. Massachusetts General Court; M.G.L. c.93H §3A(a)-(b); accessed 2026-09-28. Accessed 2026-09-28.
3
Requirements for Data Breach Notifications. Massachusetts Office of Consumer Affairs and Business Regulation; Filing recipients, report details and credit-monitoring FAQ; accessed 2026-09-28. Accessed 2026-09-28.
4
Division of Insurance. Massachusetts Division of Insurance; Official DOI overview: insurer/producer licensing, rates/forms review, complaints and solvency oversight; Contact Us / phone. Page text retrieved in search rendering; direct fetch returned 403. Accessed 2026-09-29.
5
Find Insurance Agents, Agencies and Other Licensees. Massachusetts Division of Insurance; SBS online-verification description and enumerated classes: producers, agencies, public adjusters, appraisers, advisers, reinsurance intermediaries, surplus-lines brokers, life-settlement brokers; insurers are not listed. Page text retrieved in search rendering; direct fetch returned 403. Accessed 2026-09-29.
6
Massachusetts Licensed Insurance Companies. Massachusetts Division of Insurance; Directory headings distinguish Massachusetts Licensed or Approved Companies and Massachusetts Eligible Surplus Lines Companies. Page text retrieved in search rendering; direct fetch returned 403; no company row checked. Accessed 2026-09-29.
7
DOI Online Insurance Complaint Form. Massachusetts Division of Insurance; Introductory instructions: contact insurer/producer first; if unsatisfied complete form and attach papers; not for ongoing litigation. Page text retrieved in search rendering; direct fetch returned 403; interactive form not opened/submitted. Accessed 2026-09-29.
8
M.G.L. c.175, §168. Massachusetts General Court; Current statute directly opened: §168(a) home-state definition and greatest-taxable-premium fallback if 100% risk outside principal-business state; §168(d)(2) 4% on gross premiums less gross returns for risks/exposures in MA or elsewhere if MA is home state. Accessed 2026-09-29.
9
Surplus Lines Insurance. Massachusetts Division of Insurance; Official FAQ: “What is the premium tax rate on surplus lines insurance written in Massachusetts?” (complete answer: post-Aug. 10, 2018 flat 4% gross-premium rule and pre-date state allocation); “Are any surplus lines premiums exempt from the 4% surplus lines tax?” (complete answer: MBTA, federal credit unions when purchaser, tribal lands on reservations); “If an insured is granted tax-exempt status…” (complete answer: §168 does not specifically exclude tax-exempt organizations). Complete relevant FAQ answers appeared in official page body returned by search rendering; direct URL open returned 403. Accessed 2026-09-29.
10
M.G.L. c.175, §168. Massachusetts General Court; Official statute directly opened: §168(b)(iii)–(iv), lines 62–66. Complete scope: affidavit of diligent admitted-market effort and placement only of the amount unavailable from admitted companies; clause (iii) does not apply to a §224 qualifying commercial risk/policyholder with written understanding of nonadmitted status and no Massachusetts Insurers Insolvency Fund payment for insolvency. Accessed 2026-09-29.
11
M.G.L. c.175, §224. Massachusetts General Court; Official statute directly opened: §224(a), lines 49–62. Complete large-commercial definition and all six criteria reviewed, including criterion (3): more than 25 employees per individual company OR more than 50 employees per holding company aggregate. Accessed 2026-09-29.
12
Licenses. At-Bay; Current producer introduction and state table; At-Bay Insurance Services LLC; P&C and surplus-lines identifiers. Accessed 2026-09-21.
13
Licenses and Carriers. Coalition; Licenses and Carriers, re-read 22 September 2026: Insurance Licenses table for Coalition Insurance Solutions, Inc., national producer number 18419475, with producer and surplus-lines numbers for all 50 states and DC including California 0L76155, Georgia 196479, Texas 2199630 and 2205589, Pennsylvania 815731 and 817452, Colorado 539028 and Wisconsin 3000108852. Insurance Carriers table naming, with NAIC numbers, Allianz Underwriters Insurance Company 36420, Arch Specialty Insurance Company 21199, Ascot Specialty Insurance Company 45055, Ascot Insurance Company 23752, Aspen Specialty Insurance Company 10717, Chaucer Insurance Company DAC, Coalition Insurance Company 29530, Fireman's Fund Indemnity Corporation 11380, Fortegra Specialty Insurance Company 16823, Lloyd's of London, MSIG Specialty Insurance USA Inc. 34886, MS Transverse Specialty Insurance Company 41807, Steadfast Insurance Company 26387, Vantage Risk Specialty Insurance Company 16275 and Zurich American Insurance Company 16535. Accessed 2026-09-22.
14
Insurance Producer Licenses. Corgi Insurance; Current complete Insurance Producer Licenses table for Corgi Insurance Services, Inc.; 50 rows covering 49 states and DC (DC 3003091619); no New Mexico row; no NPN or as-of date shown. Accessed 2026-09-28.
15
About Hiscox US Insurance. Hiscox; Hiscox Insurance Company Inc. NAIC 10200 as Chicago, IL domiciled insurer admitted or licensed in all 50 states and D.C.; Hiscox Inc. as general agent and Lloyd’s coverholder for Syndicates 33 and 3624; surplus-lines placements through licensed surplus-lines brokers; A.M. Best rating statement. Accessed 2026-09-16.
16
Licenses. ERGO NEXT Insurance; Current entity-by-state license table reopened 28 September 2026: 50 rows under Next First Insurance Agency, Inc., including Washington, DC; New York rows instead list Next Insurance Services PC-1423070 and AP Intego BR-1198885. Accessed 2026-09-28.
17
About Risklytics. Risklytics; What we do; Who we insure; Licensing; Agency licenses table dated 2026-09-10. Accessed 2026-09-16.
18
Insurance Licenses by State. TechInsurance; Current state table; identifies TechInsurance as a division of Specialty Program Group LLC d/b/a SPG Insurance Solutions; lists DC 3000041536 and labels Rhode Island “Individual licenses,” without an agency license number. Accessed 2026-09-28.
19
Licenses. Vouch; Effective 16 January 2025: Vouch Specialty Insurance Services, LLC, NPN 19926463; P&C table (50 states and DC); surplus-lines table includes Idaho 870820; footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses; Idaho retained as producer-only due to conflict. Accessed 2026-09-15.

What Cyber Insurance Requirements Apply in Massachusetts?

What Is Cyber Insurance?

What Should You Watch for With Cyber Insurance in Massachusetts?

Massachusetts Requires Two Agency Filings

An Exposed SSN Triggers 18 Months of Monitoring

The Law Sets No Fixed Number of Days

Which Cyber Insurance Providers Have Massachusetts License Records?

At-Bay

Coalition

Corgi

Hiscox

Risklytics

TechInsurance

Vouch