Does Cyber Insurance Cover Vendor Breaches?

A breach at a service provider may expose customer or employee information for which your business has response duties. FTC cyber guidance tells buyers to check that attacks on vendor-held data are included; it also describes potential first-party response costs and third-party claims. The vendor’s breach does not automatically make every resulting cost yours to insure, and a policy may distinguish data exposure from interruption of the vendor’s service.

Review the protected-information definition, whether data in a vendor’s custody is included, and the event trigger for notification, forensics, and legal expenses. Check whether third-party claims require allegations against your business and whether the vendor must be a named dependent system for interruption. Compare notice deadlines in the policy and vendor agreement. Keep a record of the data shared and the vendor’s incident report.