A Client's Ad Account Gets Compromised. Is That Cyber Liability or Professional Indemnity?

A digital agency’s access into a client’s ad account or analytics platform carries two different exposures, not one. The incident itself, a breach, unauthorised spend, exposed data, is generally a cyber liability question. Whether the agency’s own account security practices were negligent is a different question entirely. It’s the one professional indemnity is built to respond to.

Does cyber liability actually cover a compromised client ad account?

Generally yes. A digital agency’s access into a client’s ad platform, analytics dashboard or other marketing account is exactly the kind of exposure cyber liability is designed to respond to. It covers the notification, recovery and unauthorised spend costs that follow a compromise. That’s true regardless of exactly how the access was breached, whether it traces back to a phishing email, a leaked credential or a vulnerability somewhere else entirely.

Could the same incident also become a professional indemnity claim?

Potentially, yes. This is where it gets more specific. If a client alleges the agency’s own account security practices were negligent, no multi-factor authentication despite a contractual expectation of it, credentials shared insecurely, access left active for a former staff member, that’s an allegation about the agency’s professional conduct, not just the fact that a breach occurred. The incident and the allegation of negligence are two different things, even when they arise from the same event.

What’s the practical difference between the two kinds of claim?

Cyber liability responds to the incident happening. It’s generally triggered by the breach itself, not by proving the agency did something wrong. Professional indemnity responds to something narrower and harder to establish: an allegation that the agency’s own conduct, specifically how it managed and secured the access it was trusted with, fell below what a client was reasonably entitled to expect. A client needs to make that second, more specific case for a professional indemnity claim to actually apply.

Why do digital agencies often need both covers rather than just one?

Because holding client platform access carries both kinds of exposure simultaneously. The incident itself sits with cyber liability. Whether the agency’s own handling of that access was negligent sits with professional indemnity. A single compromise can raise both questions from the same client at the same time. Carrying only one leaves the other kind of claim with nothing to respond to it.

Do cyber insurers ever cover the errors and omissions side themselves?

Some do. A number of cyber insurers write errors and omissions cover as part of the same policy or as a closely bundled extension, rather than leaving that ground entirely to a separate professional indemnity policy. The distinction drawn throughout this article is the general shape of the two exposures, not a strict rule every insurer applies identically. What a specific cyber policy actually already includes is worth checking properly, rather than assuming professional indemnity is automatically covering entirely separate territory.

Key Takeaways

The information in this article is general in nature and does not constitute legal, financial or insurance advice. Please speak with a qualified adviser about your specific circumstances.