Cyber insurance is a special insurance policy that covers your business’ losses and liability for intrusions into your business’s computers, computer networks, software, payment processing, and other information technology (cyber events). Cyber events that may be covered by cyber insurance include data breaches, malware, ransomware, viruses, spyware, wire transfer fraud, phishing, denial-of-service (DoS) attacks, Trojans, adware, botnets, man-in-the-middle attacks, credit card web skimming, and others.

In addition to breaching a business’s own valuable information and processes, a data breach may target a business’s sensitive customer information, such as credit card numbers, account numbers, telephone numbers, mailing addresses, passwords, driver’s license numbers, Social Security numbers, health records, and other personally identifiable information (PII).

In New York, cyber insurance is designed to mitigate the risks associated with electronic business operations by providing coverage for various cyber events. These events can range from data breaches and malware attacks to more sophisticated cyber threats like ransomware and phishing schemes. The New York Department of Financial Services (NYDFS) has been proactive in regulating the cybersecurity practices of financial services companies with its Cybersecurity Regulation (23 NYCRR 500), which also impacts the cyber insurance market. While this regulation directly applies to financial services, it has set a precedent that influences how cyber insurance is approached across different industries in the state. Cyber insurance policies in New York typically cover expenses related to the immediate response to a cyber event, legal costs, regulatory fines, and losses from business interruption. They may also cover the costs associated with notifying customers affected by a data breach and providing credit monitoring services. It's important for businesses to carefully assess their cyber insurance needs and ensure that their policies are tailored to cover the specific risks associated with their operations and the types of sensitive customer information they handle.