What Insurance Covers Cyber Attacks?

Cyber insurance can address both the company’s own costs and claims brought by others after a covered cyber event. The FTC describes first-party coverage for investigation, notification, data recovery, interruption, cyber extortion, and related response costs. Third-party coverage may address claims, settlements, litigation, and regulatory inquiries. A buyer should compare those sections separately because having one does not establish that the other is included.

The phrase “cyber attack” can include unauthorized access, malicious code, denial of service, data theft, or extortion, and a policy may use narrower defined terms. An AIG specimen, for example, defines a security failure to include unauthorized access or use, denial-of-service attacks, and malicious code. It also has exclusions and separate limits. Treat it as an illustration of wording rather than a market-wide standard.

Check the covered-event definitions, first-party and third-party limits, vendor and cloud-provider treatment, waiting periods, retroactive date or reporting trigger, consent requirements, and exclusions for bodily injury, property damage, prior events, or money transfers. The declarations and endorsements show which protections were actually purchased.