The common claim is not a hacker in a database. It is a fake invoice, a wire transfer and money that does not come back.
Commercial · Updated September 2026
Ask four questions. Does your business store customer information? Does it accept card payments? Does it bank online? Does it use email?
That is nearly every business in operation, including dental offices, accounting firms, property managers, retailers, restaurants and contractors. Attackers do not target industries; they target whoever is reachable, and small businesses are reachable because they have money and thin defenses.
The cinematic version is a hacker breaching a database. The common version is duller and more expensive.
Someone in accounting receives an email that appears to come from a vendor or from the owner, with updated wire instructions. The money goes out. By the time anyone notices, it is gone, and banks recover funds like this far less often than people expect. This is social engineering fraud, and it is one of the most frequent losses small businesses suffer.
The other common one is ransomware: systems encrypted, operations halted, a demand attached. The cost is rarely just the ransom — it is the days of downtime, the forensic work, the restoration, and the customers who noticed.
First-party costs, meaning your own: forensic investigation to determine what happened, legal advice on notification obligations, notifying affected individuals, credit monitoring, public relations, data restoration, business interruption while systems are down, and in some policies ransom payments and negotiation support.
Third-party liability: defense and damages when customers or partners sue over a breach, plus regulatory proceedings and fines where insurable.
Social engineering and funds transfer fraud, which is frequently a separate sub-limit rather than part of the main limit, and is often set far too low. Ask specifically about this one.
The response team matters as much as the money. Most owners have no idea who to call at 6am when systems are locked; a cyber policy comes with a breach response hotline that does.
General liability covers bodily injury and property damage. Data is neither. Modern GL forms exclude data-related liability explicitly, so a breach claim lands outside the policy. This is not a grey area.
Multi-factor authentication on email and remote access. Verified callbacks on any change to payment instructions, using a phone number you already had, not one in the email. Offline or immutable backups, tested by actually restoring something. Staff training on invoice and wire fraud. Prompt patching.
Carriers increasingly require several of these before offering coverage, and they are the same controls that prevent the loss in the first place.
If you store customer or employee information, accept card payments, bank online or use email, you have the exposure. That covers nearly every business.
No. GL covers bodily injury and property damage, and modern forms exclude data-related liability explicitly.
Coverage for money sent because someone was deceived — a fake vendor invoice or fraudulent wire instructions. It is often a separate, lower sub-limit within a cyber policy, and it is the most common small business cyber loss.
Their contract usually limits their liability to fees paid, and your obligation to your customers does not transfer. You remain responsible for your data.
Increasingly, multi-factor authentication, tested backups and basic security practices. Those are the same controls that prevent most losses.
Questions about your own situation? Call 417.623.8300 or send us your current policy. We are licensed in Missouri, Kansas and Oklahoma.
Questions about your own policy? Send it over and we will go through it with you.