Cyber insurance is a special insurance policy that covers your business’ losses and liability for intrusions into your business’s computers, computer networks, software, payment processing, and other information technology (cyber events). Cyber events that may be covered by cyber insurance include data breaches, malware, ransomware, viruses, spyware, wire transfer fraud, phishing, denial-of-service (DoS) attacks, Trojans, adware, botnets, man-in-the-middle attacks, credit card web skimming, and others.

In addition to breaching a business’s own valuable information and processes, a data breach may target a business’s sensitive customer information, such as credit card numbers, account numbers, telephone numbers, mailing addresses, passwords, driver’s license numbers, Social Security numbers, health records, and other personally identifiable information (PII).

In Hawaii, cyber insurance is not governed by a specific set of state statutes but is regulated under the broader umbrella of insurance law. The Hawaii Department of Commerce and Consumer Affairs (DCCA) Insurance Division oversees the regulation of all insurance products, including cyber insurance policies. These policies are designed to protect businesses from financial losses due to various cyber events such as data breaches, malware, ransomware, and other IT security incidents. Coverage typically includes both first-party losses (directly impacting the insured business) and third-party liabilities (arising from claims by affected customers or partners). Businesses that handle sensitive customer information, including PII, are increasingly recognizing the importance of cyber insurance to mitigate the risk of potential legal and financial consequences following a cyber event. It is advisable for businesses to consult with an attorney to understand the specific coverage options and limitations of cyber insurance policies, and to ensure compliance with applicable federal laws such as the Health Insurance Portability and Accountability Act (HIPAA) for health records, and state laws concerning data breach notifications and consumer protection.