Does Cyber Insurance Cover Supply-Chain Attacks?
Sometimes—cyber insurance may cover a vendor-linked attack if the policy includes that dependency and the resulting breach or interruption meets its terms.
The intrusion may then produce a security breach, interruption, or loss affecting multiple organizations. FTC guidance recommends assessing cybersecurity risks from suppliers and checking vendor-held data coverage. Chubb separately describes specific terms for widespread cyber events, illustrating that aggregated events can have special limits or conditions in some products.
Check whether the form requires a direct attack on your network or also covers a provider’s compromised software or connection. Review dependent-system definitions, systemic-event endorsements, aggregation language, and any sublimit or coinsurance. Identify whether response expenses, your interruption, and claims by others each have a coverage grant. Keep an inventory of software and providers that can access business systems, then ask the insurer about named critical dependencies.
