Cyber Liability
Insurance.

Cyber liability insurance is designed to respond to the financial consequences of a cyber incident, including data breaches, ransomware attacks and other malicious or accidental events involving digital systems or data. It generally has two components: first-party cover for the insured's own losses such as data restoration, business interruption and breach response costs, and third-party cover for claims made by customers, suppliers or other parties whose data or systems were affected by the incident.

Cyber liability insurance does not typically cover losses arising from prior known incidents or vulnerabilities, fraudulent transfers resulting from social engineering where the insured was not directly deceived, physical property damage caused by a cyber event or losses that fall outside the specific coverage triggers in the policy. War and state-sponsored cyber attacks may be excluded under some policies, though market practice on this is evolving. Regulatory fines and penalties are only insurable to the extent permitted by Australian law. Each policy has its own exclusions and definitions and these should be reviewed carefully.

The Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 requires organisations covered by the Act to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when a data breach is likely to result in serious harm. Organisations covered by the Privacy Act include those with an annual turnover of $3 million or more, health service providers and certain other entities regardless of turnover. A failure to comply with the notification obligation can result in regulatory investigation and civil penalties. Cyber liability insurance typically covers the cost of breach response and notification as a first-party expense. This information is general in nature and does not constitute legal advice. If you are unsure whether your business has obligations under the Privacy Act or the NDB scheme, speak with a qualified legal professional.

Any business that holds personal information about customers, employees or other individuals, relies on digital systems to operate or processes electronic payments may have a cyber liability exposure. The Notifiable Data Breaches scheme creates specific legal obligations for businesses covered by the Privacy Act. Whether cyber liability cover is right for your business depends on the volume and sensitivity of data you hold, how much your operations depend on connected systems and your ability to absorb the financial impact of an incident. This information is general in nature and does not constitute legal advice. If you are unsure about your specific obligations under the Privacy Act, speak with a qualified legal professional.

Cyber liability insurance is not a statutory requirement for most Australian businesses. However, some government contracts, enterprise customer agreements and industry regulations may require you to hold a minimum level of cyber liability cover. The Australian Cyber Security Centre (ACSC) and several regulatory bodies have increasingly referenced cyber insurance in guidance materials as part of a broader cyber resilience posture. Whether cover is mandatory for your business depends on your contracts and regulatory obligations. This information is general in nature and does not constitute legal advice. If you are unsure whether any contract or regulation requires your business to hold cyber liability cover, speak with a qualified legal professional.

Ransomware is a type of malicious software that encrypts a victim's files or systems and demands payment in exchange for the decryption key. It is one of the most common causes of cyber insurance claims globally and in Australia. A cyber liability policy typically covers ransom payment costs, negotiation costs, the cost of restoring or recovering data and business interruption losses sustained while systems are offline. Whether to pay a ransom is a decision that involves legal, ethical and practical considerations beyond the scope of insurance. Get in touch and we can walk you through what a specific policy covers and how a claim would work.

A first-party cyber insurance claim relates to the insured's own losses from a cyber incident, rather than claims made against the insured by third parties. First-party cyber cover typically responds to costs such as forensic investigation to identify the source and scope of the breach, notifying affected individuals and regulators, public relations and crisis management, restoring or replacing data and systems and the business interruption losses incurred while systems are offline. The specific first-party covers available vary by policy and should be reviewed against the business's actual exposure.

A third-party cyber insurance claim arises when a customer, supplier, business partner or other party makes a claim against the insured for loss or damage caused by a cyber incident. For example, a customer whose payment details were compromised in a data breach at a business may claim compensation for financial losses. A supplier whose systems were infected via the insured's network may claim for the cost of remediation. Third-party cyber liability cover addresses the cost of defending those claims and any damages or settlements that result.

Cyber liability premiums are primarily rated on the number of personal information (PII) records a business holds and the industry it operates in, alongside annual revenue, the security controls in place and the limit of cover required. Businesses holding a small number of records with strong security controls such as multi-factor authentication, endpoint protection and staff training can see premiums starting from as low as around $600 per year, while businesses holding larger volumes of sensitive data or operating in higher-risk industries such as healthcare or financial services generally pay more. Every business is different. The only way to get an accurate figure is to talk through your specific situation with us.

Cyber incident costs vary enormously depending on the size and nature of the business, the data affected and the type of incident. A small business data breach requiring individual notifications and some system remediation may involve tens of thousands of dollars. A ransomware event at a larger organisation that prevents trading for days or weeks while also triggering regulatory investigation and customer claims can run into millions of dollars. The Notifiable Data Breaches Annual Report consistently records incidents at Australian businesses across all industry sectors.

Professional indemnity insurance responds to claims arising from professional errors, omissions or negligent acts in the delivery of professional services or advice. Cyber liability insurance responds to the financial consequences of a cyber incident involving data or digital systems. A professional services firm that suffers a data breach affecting client data may have both a cyber liability exposure (the cost of the breach response and potential claims from affected clients) and a professional indemnity exposure (if the breach was related to the handling of client information in the course of providing services). Whether one or both covers apply to a specific incident depends on the policy wordings.

Insurers generally look for a range of baseline controls before offering cyber liability cover. Multi-factor authentication (MFA) on email and remote access systems is now considered a minimum requirement by most cyber insurers. Regular backups stored separately from the main network, up-to-date endpoint protection, patching and vulnerability management and staff awareness training are also commonly assessed. Some insurers conduct pre-binding security scans. If your business does not have basic controls in place, you may find it difficult to obtain cover or face significantly higher premiums.

Insurers typically require information about the nature of the business, the annual revenue, the types and volumes of data held, the security controls in place (including whether MFA is deployed), prior cyber incidents, any known vulnerabilities and the limit of cover required. When you get in touch, we will guide you through the proposal and make sure your risk is presented accurately to our insurer panel.

Notify us as soon as you become aware of a cyber incident. Most cyber policies have a panel of incident response specialists such as forensic investigators, legal advisers and public relations firms that can be engaged immediately. Do not attempt to remediate or restore systems without first consulting us, as doing so could compromise forensic evidence. If the incident involves personal information, consider your obligations under the Notifiable Data Breaches scheme. We will be actively involved throughout the response.

A prior cyber incident does not automatically prevent your business from obtaining cover, but it is likely to affect the terms and premium offered. Insurers will want to understand what happened, what remediation was undertaken and what controls are now in place. We have access to a wider range of insurers beyond the standard market. Get in touch and we will present your situation to our insurer panel in a way that gives them the context they need to make a fair assessment.