Nearly every business today collects some form of sensitive data, whether it’s customer names, email addresses, credit/debit card numbers, employee records, or health information.
As described below, without the right data breach insurance, if your business data is stolen, altered, or exposed in a data breach, the resulting first and third party related costs to your company can be staggering.
Data breach insurance provides first party and third party coverage for the unauthorized access or disclosure of personal or confidential data… Unfortunately, if you assume your CGL has you covered, you may be surprised at how at risk your business may be to a potential cyber attack or data breach.
What Is Data Breach Insurance?
Data breach insurance, ideally addressed as part of a broader cyber liability strategy, is coverage specifically designed to respond when a business experiences unauthorized access to, or loss of, its personal or confidential electronic data.
Data breach insurance, also called cyber liability insurance, addresses two broad categories of loss, first party costs and third party costs related to a data breach or hack.1
First-party costs:
Expenses the business itself incurs as a direct result of the breach. This includes, but may not be limited to:
- Forensic investigation to determine how the breach happened and what was accessed
- Notification costs to alert affected individuals (often legally required)
- Credit monitoring or identity theft protection for affected customers
- Public relations and crisis management
- Business interruption from a network outage
- Costs to restore or recreate lost data
- Ransomware payments and negotiation costs, in many policies
Third-party costs:
The liability your business faces because a third party was harmed.
- Legal defense costs to defend against lawsuits from customers, employees, or business partners whose data was compromised
- Settlement costs
- Regulatory investigations and fines (e.g., those fines that may occur under state data breach notification laws, HIPAA, or similar frameworks)2
- Payment Card Industry (PCI) assessments and fines from card brands when cardholder data is involved
As described in more detail below, because electronic data is intangible, this is a fundamentally different risk profile than what commercial general liability (CGL) insurance was designed to handle.
Your CGL Policy Usually Won't Cover A Data Breach
A standard CGL policy is built around two main coverage parts:
- Coverage A: Bodily injury and property damage
- Coverage B: Personal and advertising injury (things like false advertising, libel, slander, and invasion of privacy)
First, the problem for data breach claims shows up almost immediately in Coverage A… This is because most CGL forms define “property damage” as physical injury to tangible property. Also, many policies contain an explicit electronic data exclusion, because data is not considered tangible property.
As such, if your customer database gets disclosed or is stolen and held for ransom, most CGL policies may decline coverage, or decline to defend your claim situation, or both.
This is because the CGL was not designed with the idea of intangible property loss under Coverage A… And the policy forms have evolved to more firmly close the door on covering claims related to a data breach.
Second, coverage B typically applies to personal injuries like the “oral or written publication… of material that violates a person’s right of privacy.”
However, because a data breach may not be interpreted by every court as the “publication” of data in the traditional sense, a judge may decide to read Coverage B language in the CGL far more narrowly or more broadly, making a CGL policy difficult to rely on for data breach coverage.
Below is an example of a case where the CGL policy was found to have defense coverage under coverage B. However, there are just as many, if not more cases where this proved not to be the case.
The Landry’s Case
One example of this is the case of the Fifth Circuit’s 2021 decision in Landry’s, Inc. v. Insurance Company of the State of Pennsylvania.
Landry’s is a restaurant chain that suffered a data breach over a period from about 2014-2015. Hackers installed malware on the company’s payment processing devices resulting in the personal information of millions of customers being exposed, unauthorized credit card charges being made and millions of dollars in costs associated with the cleanup.
Landry’s was sued by its payment processor (Paymentech) for breaching its payment processing agreement after Visa and Mastercard levied millions of dollars in fines on the payment processor.
When Landry’s filed a claim under its CGL policy, their CGL carrier (Insurance Company of the State of Pennsylvania) disagreed regarding their obligation to defend the company. ICSOP argued the costs related to the data breach were the result of a contract dispute, not the data breach, and denied their claim.
While the district court initially agreed with ICSOP, the Fifth Circuit court reversed this ruling reasoning that there was a broader dictionary definition of the word “publication” that applied to the case, meaning that ICSOP was required to defend Landry’s in court, and pay its legal fees.
However, this ruling in favor of Landry’s was a relatively narrow win because it only covered the duty to defend requirement. It wasn’t a clear coverage indemnification.
Indeed, other data breach insurance-related cases, such as this one between Home Depot and its insurer, resulted in a ruling against Home Depot, citing that the electronic data exclusion clearly meant the CGL insurer had no duty to defend and/or indemnify in the event of a data breach.
Why A Dedicated Cyber Liability Policy Makes More Sense
If your business handles any personal customer data — payment card numbers, health information, Social Security numbers, even just names and email addresses tied to accounts — a standalone cyber liability policy is worth far more than the possibility of squeezing a claim through an ambiguous CGL provision.
A few reasons why:
- It’s built for this risk. Cyber policies are written with breach response specifically in mind, and typically include access to a panel of forensic investigators, breach counsel, and notification vendors who can respond immediately, rather than requiring you to litigate coverage first.
- First-party coverage. CGL policies generally don’t cover your own costs to investigate, notify, and remediate a breach whereas cyber policies do.
- Regulatory and PCI exposure is addressed directly. Many cyber policies specifically contemplate PCI fines and assessments, regulatory defense, and fines/penalties (where insurable) tied to data breach laws.
- Business interruption and cyber extortion are typically included. Ransomware, network outages, and system restoration costs are core cyber policy features, not incidental ones.
- No dependence on favorable case law. You’re not relying on a court somewhere adopting a broad reading of “publication” in your favor.
Data breach insurance addresses two broad categories of loss, first party costs and third party costs related to a data breach or hack.
First-party costs:
Expenses the business itself incurs as a direct result of the breach. This includes, but may not be limited to:
- Forensic investigation to determine how the breach happened and what was accessed
- Notification costs to alert affected individuals (often legally required)
- Credit monitoring or identity theft protection for affected customers
- Public relations and crisis management
- Business interruption from a network outage
- Costs to restore or recreate lost data
- Ransomware payments and negotiation costs, in many policies
Third-party costs:
The liability your business faces because a third party was harmed.
- Legal defense costs to defend against lawsuits from customers, employees, or business partners whose data was compromised
- Settlement costs
- Regulatory investigations and fines (e.g., those fines that may occur under state data breach notification laws, HIPAA, or similar frameworks)
- Payment Card Industry (PCI) assessments and fines from card brands when cardholder data is involved
CGL insurance was designed for slip-and-falls, property damage, and traditional advertising injury claims — not for the unique, data-centric exposures that come with running a modern business.
Cases like Landry’s prove that a sympathetic court can occasionally stretch old policy language to cover new risks, but that’s a fallback, not a plan. Insurers have also been actively closing that gap with tighter exclusions since the decision came down.
Summary
If your business stores or processes personal data of any kind, a dedicated cyber liability policy, with both first-party breach response coverage and third-party liability protection, is the appropriate tool for the job.
To learn more about data breach insurance coverage options that are available to your company, schedule an appointment with me below…
Don’t assume your general liability policy has your back if (or when) a cyber breach occurs.
Footnotes
- Note that a data breach can happen as the result of a hack. And a hack can be considered a data breach.
- For instance, the New York State SHIELD Act imposes strict reporting rules and fines if companies do not comply with timely notification of affected parties in a data breach.
