Cyber insurance is a special insurance policy that covers your business’ losses and liability for intrusions into your business’s computers, computer networks, software, payment processing, and other information technology (cyber events). Cyber events that may be covered by cyber insurance include data breaches, malware, ransomware, viruses, spyware, wire transfer fraud, phishing, denial-of-service (DoS) attacks, Trojans, adware, botnets, man-in-the-middle attacks, credit card web skimming, and others.

In addition to breaching a business’s own valuable information and processes, a data breach may target a business’s sensitive customer information, such as credit card numbers, account numbers, telephone numbers, mailing addresses, passwords, driver’s license numbers, Social Security numbers, health records, and other personally identifiable information (PII).

In Massachusetts, businesses can obtain cyber insurance to protect against losses and liabilities resulting from cyber events such as data breaches, malware, ransomware, and other forms of cyberattacks. Cyber insurance policies typically cover expenses related to the immediate response to a cyber incident, including investigation, data recovery, legal fees, and notification costs. Additionally, these policies may cover regulatory fines, litigation expenses associated with lawsuits brought by affected individuals or entities, and losses from business interruption. Massachusetts has specific data security laws, such as the Massachusetts Data Security Regulation (201 CMR 17.00), which requires businesses that own or license personal information about a resident of Massachusetts to implement a comprehensive written information security program (WISP). Failure to comply with these regulations can result in penalties, making cyber insurance an important consideration for businesses to mitigate potential financial risks. It's important for businesses to work with an attorney to understand the specific coverages and exclusions of a cyber insurance policy and to ensure compliance with state and federal regulations regarding data protection.