Everyone knows how serious a cyber security breach can be. At the higher end of the scale, incidents like Optus’ data breach in September 2022 and Medibank’s a month later highlight the intense scrutiny, reputational damage and legal action that can come of a cyber-attack.
Of course, if you’re running a small business, it’s highly unlikely that such a story will be blown up in the way these were, but that doesn’t mean you won’t have your reputation take a hit and potential legal action taken against you if private data leaks online. That’s where cyber liability insurance can offer the protection you’re after.
What is cyber liability insurance?
Cyber liability insurance is a type of business insurance policy designed to protect you in the event of a cyber security breach. This can range from costs to be paid out to customers who’ve had their information stolen or released to expenses related to repairing your reputation.
You can purchase cyber liability insurance as a standalone policy or as part of a small business insurance package alongside other forms of cover. Choosing the latter option will likely save you money compared to purchasing your policies separately.
What does cyber liability insurance cover?
Some of the events and expenses covered by cyber liability insurance include:
- Data and network security breaches, such as those resulting in the loss or theft of client information
- Costs associated with the forensic investigation into the cause/s of the breach
- Legal costs associated with defending your business against third party claims or fines in court
- Costs related to recovering lost data
- Loss of income related to your business’ trading being interrupted
- Costs related to crisis management, such as mitigating and preventing damage to your business’ reputation
The exact inclusions on your policy will depend on which insurer you choose to go with, so it’s important to check the PDS before you purchase your insurance.
What isn’t covered by cyber liability insurance?
Some of the key exclusions of cyber liability insurance are:
- Damage to computer hardware
- Improving or upgrading your business’ digital systems
- Intentional or fraudulent activity
- Damage to property or bodily injury
- Prior known facts or circumstances
You can’t rely on your cyber insurance policy to cover everything unconditionally. All covered items are subject to the terms and conditions of your policy, so you must follow the law and any regulations applicable to your business. Not all the marketing you do will be covered by your policy, either.
Which businesses need cyber liability insurance?
There’s a wide range of businesses that may benefit from having a cyber insurance policy in place. If yours ticks one or more of the following boxes, cyber cover could be useful:
- Your business is built on digital operations, which are required for your employees to do their jobs and generate revenue for your company
- Your business gathers and stores customer data, especially sensitive details like addresses, payment information and medical records
- Conduct your business primarily via a website
- Make use of EFTPOS machines to sell goods and services
For that reason, online retailers, healthcare services and financial services are all significant targets for cyber criminals. Outside of the Australian Government and state and local governments, financial and insurance services and healthcare and social assistance were the highest-reporting industries for cyber attacks in Australia in 2024-25, according to the Annual Cyber Threat Report 2024-2025.
How much is cyber insurance?
The cost of your cyber insurance policy varies based on a range of factors. Perhaps the most important is your industry. Here are some of the average monthly premiums for different occupations from BizCover:
| Profession | Average monthly premium |
|---|---|
| IT services | $154 |
| General practice (GP) | $135 |
| Allied health professional | $130 |
| Financial planning service | $128 |
| Accounting service | $114 |
| Savings bank | $110 |
| Clothing retailing | $102 |
| Marketing consultancy | $95 |
| Plumbing | $89 |
Who’s responsible for customers’ payment data?
The fault for a cyber security breach will lie with the organisation whose systems were targeted. For example, if your business uses Stripe to process its transactions and there’s a breach on their end that results in your customers’ information being stolen, they may be held responsible.
However, any leaks that come from your business’ systems or software are likely to land at your feet. Forensic investigations into the source of a breach should determine whether it came from you or another service provider if you’re unsure.
