A Data Breach Can Cost More Than You Think
What employers should know about cyber insurance, regulatory fines and payment card assessments
When a business experiences a data breach, the immediate priorities are getting systems back online, understanding what happened and notifying affected individuals. But the financial impact can extend beyond those first steps.
Regulatory investigations, fines and payment card assessments may create additional expenses—and cyber insurance does not automatically cover all of them.
At Eureka People Solutions, we encourage employers to understand these exposures before an incident puts their coverage to the test.
Regulatory Investigations and Fines Are Different Expenses
Government agencies may investigate whether a business properly protected personal information. Depending on the circumstances and applicable law, that investigation could lead to civil fines or penalties.
A cyber insurance policy may help pay the legal costs of responding to an investigation. However, coverage for those costs does not necessarily mean the policy will also pay a resulting fine.
Some policies cover both, while others provide defense coverage only. A policy may also place a separate, lower limit on regulatory coverage.
The question to ask is: Does our policy cover the investigation, the penalty or both?
Accepting Credit Cards Creates Another Exposure
Businesses that accept payment cards agree to follow the Payment Card Industry Data Security Standard, commonly called PCI DSS.
Following a breach involving card information, a payment card brand may assess charges against the business’s acquiring bank. Depending on the merchant agreement, the bank or payment processor may pass those charges along to the business.
These amounts generally arise from contractual obligations rather than government enforcement. They may include noncompliance fines, assessments related to card issuer losses and expenses associated with replacing cards or investigating the incident.
Some cyber policies address these costs through specific PCI coverage. Others require an endorsement or exclude certain amounts.
Why the Policy Wording Matters
Even when a policy includes fines and penalties, coverage may apply only when those amounts are legally insurable. Applicable law can affect whether an insurer is permitted to pay a particular fine.
For PCI assessments, the wording must also match the type of charge the business faces. Coverage for “fines” may differ from coverage for broader “assessments.”
The policy’s overall limit is only part of the picture. Separate coverage limits, exclusions and reporting requirements can affect how much protection is available.
Questions to Ask Before a Breach
Review these items with your insurance professional:
- Does regulatory coverage pay defense costs, fines and penalties—or only certain expenses?
- Are regulatory and PCI claims subject to separate, lower limits?
- Does PCI coverage include card replacement and required forensic investigation costs?
- Does coverage address charges your merchant agreement allows a bank or processor to pass through?
- What reporting deadlines apply, and do legal expenses reduce the available coverage?
Make Cyber Coverage Part of Business Planning
Understanding your coverage before an incident gives your business time to identify gaps and make informed decisions.
Eureka People Solutions helps employers navigate the people and operational challenges of running a business. For questions about cyber insurance, connect with our colleagues at Eureka Insurance Solutions to review your coverage and discuss your business’s exposures.
This article provides general information. Coverage depends on the policy’s terms, conditions, exclusions and applicable law.