Does Cyber Insurance Cover a Hacked Email Account?

A hacked mailbox may trigger cyber coverage if the incident meets the policy definition, but resulting data, liability, and money losses can be treated differently.

An intruder in a business email account may read or expose information, impersonate an employee, or alter a payment conversation. The FBI identifies email account compromise as a form of BEC, while FTC guidance treats network breaches and data incidents as issues to address when evaluating cyber coverage. Those sources explain the incident; only the policy determines whether the access and its consequences fit a covered event.

Look for definitions of unauthorized access, privacy event, and computer system, and ask whether email hosted by an outside provider qualifies. Then examine notification and forensic costs, third-party claims, business interruption, and funds-transfer provisions separately. A stolen-money claim may be subject to a crime endorsement or a different limit than the mailbox investigation. Follow prompt notice and approved-vendor rules in the actual contract.

Providers That List This Coverage

Sources

  1. Cyber Insurance. Federal Trade Commission; What Should Your Cyber Insurance Policy Cover; First-Party Coverage; Third-Party Coverage. Accessed 2026-09-25.
  2. CyberEdge specimen policy. AIG; General Terms §§4–6, PDF pp.3–6; Security and Privacy §§1–3, PDF pp.11, 14–18; Event Management §§1–2, PDF pp.19–20. Accessed 2026-09-25.
  3. Business Email Compromise. Federal Bureau of Investigation; How BEC scams work; Report BEC. Accessed 2026-09-25.

Updated . Answers describe typical policies, not your coverage; your policy wording decides what is covered. See the editorial policy or contact Spot with a correction and supporting source.

Let Spot Handle the Insurance Legwork.

Get help buying coverage and managing renewals, with less paperwork for your team. Start with a free consultation.

Talk to Spot