Does Cyber Insurance Cover Stolen Passwords?
Sometimes—cyber insurance may cover losses after stolen credentials enable unauthorized access, but the password theft alone does not establish an insured loss.
FTC cybersecurity guidance discusses phishing that tricks staff into revealing passwords and recommends access protections such as multi-factor authentication. Insurance coverage depends on what happened after credential theft and whether the resulting event satisfies the policy’s terms.
Check definitions of unauthorized access and security event, whether compromised credentials are included, and whether the policy excludes losses tied to missing controls or known vulnerabilities. Separate the costs of investigating a compromised account, restoring systems, notifying affected people, and recovering a fraudulent transfer; each may fall under a different coverage section or sublimit. Review any MFA representation in the application and the incident-notice condition.
