Cyber Insurance

Ransomware and data extortion, business email compromise, hacking and unauthorised access, malware, denial-of-service attacks, fraudulent payment instructions, insider error such as a misdirected email or a misconfigured cloud folder, and — on broader wordings — non-malicious system failure. The trigger is the financial consequence, not the technique, so a policy that lists coverage by outcome tends to age better than one that lists it by attack type.

Any business that holds personal information, depends on systems to earn revenue, or moves money on emailed instructions — which is very nearly all of them. In practice the exposure is highest where large payments are made on schedule (contractors and developers), where downtime cannot be recovered later (manufacturers and processors), where payment card data is handled (hospitality and retail), and where you hold clients’ data under contract (technology and professional firms).

Usually yes, alongside negotiation, threat intelligence and forensic support — but with conditions. Paying a ransom is not in itself unlawful in Canada, provided the payment does not breach sanctions, terrorist-financing or proceeds-of-crime law. Before any payment the insurer will require compliance screening of the attacker and the cryptocurrency wallet involved. Note also that a policy placed on international paper is bound by several sanctions regimes at once, so a payment lawful under Canadian law alone can still be uninsurable. Many wordings reimburse rather than pay directly, so the business funds it first.

Yes — income lost while your systems are unavailable, plus the extra expense of working around the outage. Better wordings extend to dependent business interruption, covering income lost when a cloud platform, managed service provider or IT supplier goes down instead. Two things determine whether the cover is worth much: the waiting period, and the length of the indemnity period. A seasonal business should check both carefully.

A deductible is a dollar amount. A waiting period is a number of hours of downtime that must pass before business interruption cover attaches at all — commonly around twelve. Many outages resolve inside it, which surprises people. It is also worth asking how the waiting period operates: on some wordings cover then runs from the first minute of the outage, and on others the insurer applies the greater of the waiting-period loss or the retention. On a long outage that difference is worth real money.

Regulatory defence and investigation costs are broadly available and are among the most useful parts of the policy. Fines and penalties are a different question: they are covered only where insurable by law, and insurability varies by jurisdiction. Quebec’s administrative monetary penalties under its modernised privacy regime are substantial and their insurability is not settled. Treat regulatory defence as the reliable cover and any fines cover as conditional.

Generally yes, but by sublimit rather than at the full policy limit, and often subject to conditions such as out-of-band callback verification on any change of banking details. This is the most common cyber loss in Canada and the most common place a policy disappoints. Two points to press: make sure the sublimit is sized against the payments you actually make, and ask specifically about invoice manipulation — where your customers are deceived into paying a fraudster, so you are simply never paid. That cover is frequently withheld unless requested by name.

Bodily injury and property damage, upgrades and betterment, incidents or circumstances already known before inception, failures of the power grid or of core internet infrastructure, patent infringement, and — on current wordings — state-backed cyber attacks meeting the policy’s threshold. Fines are covered only where insurable. And where a wording makes specified security controls a condition, failing to maintain them can reduce or defeat a claim.

In practice, yes — on email and remote access at a minimum, and ideally on privileged accounts too. It is the closest thing to a hard gate in Canadian cyber underwriting. Without it, expect either a declination or terms with the cybercrime sublimit cut to a token figure. Answer the question accurately: insurers re-examine applications after a loss, and an overstated answer about multi-factor authentication is the single most common reason a cyber insurance claim gets challenged.

There is no formula, and the average claim is the wrong benchmark — the average is survivable at almost any limit. Model the bad outcome instead: several days of stopped operations, forensics and legal costs, notifying everyone whose information you held, and the claims that follow. Then check the sublimits separately, because a $5 million policy with a $100,000 cybercrime sublimit will not answer the loss you are most likely to have.

Revenue and industry set the starting point. From there underwriters weigh the volume and sensitivity of the personal information you hold, how quickly revenue stops when systems stop, your claims and incident history, which cloud and IT providers you depend on, where your customers are located, and the limit, retention and waiting period you select. The largest discretionary factor is your security controls — and in the current market they buy lower retentions and broader terms rather than just a lower price.

Rarely. Endorsements added to a commercial package are typically stripped-down: lower limits, fewer coverage sections, narrower definitions, and often no meaningful incident response service behind them. Given how competitively standalone cyber is currently priced in Canada, the saving seldom justifies the gap. If you do carry an endorsement, read what it actually grants before you assume you are covered.

Under federal privacy law you must assess whether the breach creates a real risk of significant harm; if it does, report it to the Privacy Commissioner and notify the affected individuals as soon as feasible, and notify any other organization that could reduce the harm. Separately — and this is the obligation most often missed — you must keep a record of every breach, whether reportable or not, for at least two years. Alberta and Quebec have their own regimes, and Quebec’s applies to any business holding information about Quebec residents regardless of where you operate. Your insurer’s breach counsel will guide the assessment; call them before you notify anyone.

Call the insurer’s 24/7 cyber incident line first — before your own IT provider, and before you talk to anyone outside the business. Most wordings only allow costs to be incurred without prior consent for a short window, and only with approved panel providers, so engaging your own consultants first is the most common way businesses spend money the policy will not reimburse. Keep that number, and your policy number, somewhere reachable if your systems and email are down. Then call your Stanhope Simpson broker.