Does General Liability Cover Cyber Attacks?
Generally not the core costs of a cyber incident. Standard CGL wording may exclude loss or damage to electronic data; cyber insurance addresses separate first-party and liability exposures.
A cyberattack can create data restoration, interruption, extortion, notification, and privacy-liability costs that should not be assumed to fit CGL. The ISO specimen excludes damages arising from loss of, loss of use of, damage to, corruption of, or inability to access electronic data. That exclusion concerns electronic data as defined in the form. A claim alleging bodily injury or physical property damage in connection with an attack would need separate analysis under the policy.
Cyber policies vary in their incident-response services, business-interruption triggers, waiting periods, security conditions, sublimits, and exclusions. Ask the broker to map forensic response, restoration, extortion, third-party privacy claims, and interruption to the actual cyber policy. Compare both forms rather than assuming a CGL Coverage B privacy offense automatically includes incident costs.
Related Coverage
Sources
- Commercial general liability insurance. Insurance Information Institute; What commercial general liability insurance covers; Coverage A, B and C; Additional liability coverages to consider. Accessed 2026-09-25.
- Commercial General Liability Coverage Form, CG 00 01 12 07. ISO; specimen hosted by Hiscox; Coverage A I.A pp.1–5; Coverage B I.B pp.6–7; Who Is An Insured II pp.9–10; Limits III p.10; Conditions IV pp.10–12; Definitions V pp.12–16. Accessed 2026-09-25.
