Does General Liability Insurance Cover Data Breaches? What NJ Business Owners Should Know
The short answer is generally no. Commercial general liability insurance is designed primarily to protect businesses against certain third-party bodily injury, property damage, and personal or advertising injury claims. It typically does not cover the costs associated with a cyberattack, ransomware incident, or data breach.
That's where cyber liability insurance comes in.
But there's another important consideration: Even if your business has some cyber coverage included in its Business Owners Policy (BOP), that doesn't necessarily mean you're adequately protected.
Understanding the difference could help you avoid an expensive surprise.
Not Sure What Your Business Insurance Covers?At The Overmyer Insurance Agency, we help business owners review their existing coverage and identify potential gaps, including cyber liability exposures.
What Does General Liability Insurance Actually Cover?
Commercial general liability (CGL) insurance is one of the foundational coverages for most businesses.
It typically provides protection against certain claims involving:
Bodily injury: A customer slips and falls at your business.
Property damage: Your employee accidentally damages a customer's property.
Personal and advertising injury: Certain claims involving defamation, copyright infringement in advertising, or other covered offenses.
For example, if a customer trips over a loose rug in your office and suffers an injury, your general liability insurance may help cover medical expenses, legal defense costs, and damages, subject to the policy terms.
But what happens if someone gains unauthorized access to your business email account and steals sensitive customer information?
That's a very different exposure.
General liability policies generally aren't designed to address the financial consequences of cyber incidents. Many contain exclusions or restrictions involving electronic data and unauthorized access to confidential information.
Although certain claims may raise complicated coverage questions under specific policy language, business owners shouldn't assume their general liability insurance will respond to a data breach.
General Liability vs. Cyber Liability Insurance: What's the Difference?
The easiest way to understand the distinction is to look at the types of losses each policy is designed to address.
Claim scenario | General liability | Cyber liability |
Customer slips and falls at your office | Typically covered | Generally not covered |
Employee accidentally damages a client's physical property | May be covered | Generally not covered |
Hacker steals customer information | Generally not covered | May cover response costs and liability |
Ransomware locks your business systems | Generally not covered | May cover recovery expenses and lost income |
Customer sues following a covered data breach | Generally not covered | May cover defense costs and damages |
Employee is tricked into sending money to a fraudulent account | Generally not covered | May be covered with appropriate crime or social engineering protection |
Actual coverage depends on policy wording, exclusions, limits, deductibles, and the circumstances of the claim.
One of the biggest differences is that cyber insurance can provide both first-party and third-party protection.
First-party coverage addresses certain expenses your business incurs directly following a covered cyber incident.
Third-party coverage addresses certain claims brought against your business by customers, vendors, or other affected parties.
The Federal Trade Commission's cyber insurance guidance explains why both types of protection are important.
Why Business Owners Often Misunderstand Their Cyber Coverage
In my experience working with business owners, misconceptions about cyber insurance generally fall into a few categories.
Some assume their general liability or Business Owners Policy already provides adequate protection.
Others believe their business is too small to be targeted by cybercriminals.
And some question whether cyber insurance is worth the additional premium, particularly when they've never experienced a cyber incident.
These are understandable concerns. Most business owners are focused on running their businesses, not analyzing insurance policy language.
However, another misconception I frequently encounter involves the extent of cyber coverage included as an endorsement to a Business Owners Policy.
A business owner may see that cyber coverage is listed on their policy and reasonably assume they're protected.
The more important question isn't simply whether you have cyber coverage. It's what that coverage actually includes.
Does a Business Owners Policy Include Cyber Insurance?
A Business Owners Policy typically combines general liability and commercial property coverage into one package.
Depending on the insurance company, additional protections may be available through endorsements, including limited cyber or data breach coverage.
These endorsements can be valuable, especially for smaller businesses with relatively straightforward exposures.
However, they aren't all created equal.
1. Cyber Coverage Limits May Be Lower Than Expected
Some BOP endorsements provide relatively modest coverage limits.
A business owner might have $1 million in general liability coverage but only $25,000 or $50,000 in certain cyber-related protections.
Those figures are illustrative, not standard limits across insurers.
Depending on the circumstances, a serious cyber incident could involve forensic investigations, legal expenses, system restoration, customer notification, and lost revenue.
It's important to determine whether the available limits would realistically address your business's exposure.
2. Data Breach Coverage Isn't Always Comprehensive Cyber Coverage
Some endorsements focus primarily on expenses associated with notifying affected customers after sensitive information is compromised.
But what about ransomware?
What if your business systems are unavailable for several days?
What if a customer files a lawsuit alleging that your business failed to protect their confidential information?
Those losses may require additional coverage that isn't included in a basic data breach endorsement.
3. Business Interruption May Be Limited or Excluded
A cyberattack doesn't necessarily have to involve stolen information to cause significant financial damage.
Imagine a business that cannot access its accounting software, customer records, or scheduling system for several days.
Even without a traditional data breach, the interruption could affect revenue and operations.
Some cyber policies provide business interruption coverage following qualifying network security incidents or system failures.
Others have restrictions, waiting periods, sublimits, or exclusions that could substantially affect the amount recoverable.
4. Social Engineering and Funds Transfer Fraud Require Special Attention
Consider a business that receives an email appearing to come from a trusted vendor requesting payment to a new bank account.
An employee processes the payment, only to discover that the email was fraudulent.
Would cyber insurance cover the stolen money?
Possibly, but not necessarily.
Social engineering, fraudulent instruction, and funds transfer fraud are distinct exposures. Coverage may be available under certain cyber or commercial crime policies, sometimes through specific endorsements.
The distinction matters because a policy that covers ransomware or data breaches may not automatically cover voluntarily transferred funds resulting from deception.
5. Access to Cyber Incident Response Services Can Vary
One overlooked benefit of cyber insurance is access to professionals who can help businesses respond to a covered incident.
Depending on the policy, these services may include:
Cybersecurity forensic investigators
Privacy and breach response attorneys
Ransomware response specialists
Customer notification services
Public relations and crisis management assistance
Not every policy provides the same level of access or reimbursement.
The bottom line: A BOP cyber endorsement may be sufficient for certain businesses, but it should be evaluated against the actual risks, limits, and coverage needs of the business.
The National Association of Insurance Commissioners' 2026 Cybersecurity Insurance Market Report also notes that cyber endorsements often provide narrower protection or lower limits than standalone cyber policies.
Already Have Cyber Coverage on Your BOP? Having a cyber endorsement is a good starting point, but understanding its limitations is just as important. At The Overmyer Insurance Agency, we can review your current coverage, discuss potential gaps, and help determine whether additional protection makes sense.
What Does Standalone Cyber Liability Insurance Cover?
Standalone cyber liability policies are specifically designed to address cyber-related exposures.
Depending on the insurance company and policy selected, coverage may include several important protections.
Data Breach Response Expenses
If sensitive customer or employee information is compromised, coverage may help pay for forensic investigations, legal guidance, notification expenses, and other qualifying response costs.
Ransomware and Cyber Extortion
Certain policies may cover expenses associated with responding to ransomware attacks, including negotiations, forensic services, data restoration, and qualifying extortion payments where legally permissible.
Cyber Business Interruption
If a covered cyber incident interrupts your operations, business interruption coverage may help replace qualifying lost income and pay certain additional expenses.
Waiting periods, restoration periods, and coverage triggers are particularly important.
Privacy and Network Security Liability
If customers or other parties bring claims alleging that your business failed to protect confidential information or maintain adequate network security, cyber liability coverage may help pay qualifying legal defense expenses, settlements, or judgments.
Regulatory Investigations
Certain policies may provide coverage for legal defense costs associated with regulatory investigations following a privacy or cybersecurity incident.
Coverage for fines and penalties depends on policy language and whether those amounts are legally insurable.
Standalone policies may offer broader coverage options, but they still contain exclusions, conditions, and limitations. They should never be viewed as protection against every possible cyber-related loss.
Three Cyber Claim Scenarios Every Business Owner Should Understand
The following are hypothetical examples illustrating how different insurance coverages might respond.
Scenario 1: A Law Firm Experiences a Data Breach
A small law firm discovers that an unauthorized individual accessed confidential client information through a compromised email account.
The firm needs legal guidance, a forensic investigation, and potentially client notifications.
Its general liability policy is unlikely to provide the protection needed for these expenses.
A properly structured cyber policy may help cover qualifying breach response costs and related liability claims.
Scenario 2: A Retail Business Suffers a Ransomware Attack
A retailer's computer systems become inaccessible following a ransomware incident.
The business cannot process certain transactions or access essential records for several days.
A limited BOP data breach endorsement may not address all the resulting expenses.
A standalone cyber policy with appropriate cyber business interruption and data restoration coverage may provide more meaningful protection.
Scenario 3: An Accounting Firm Sends Money to a Fraudulent Account
An accounting firm receives an email that appears to come from a legitimate business contact requesting a change in payment instructions.
The firm sends the funds before discovering the request was fraudulent.
Even if the business has cyber liability insurance, the financial loss may not be covered unless the policy includes applicable social engineering, fraudulent instruction, or funds transfer fraud protection.
This is why reviewing specific coverage provisions is so important.
Which New Jersey Businesses Should Consider Cyber Liability Insurance?
Cyber insurance isn't just for technology companies or large corporations.
Many smaller businesses rely on digital systems, electronic payments, and sensitive information to operate.
Businesses that should evaluate their cyber exposure include:
Accounting and CPA firms: Financial records, tax information, and payment instructions.
Law firms: Confidential client information, legal documents, and trust account transactions.
Medical practices: Patient information, billing systems, and electronic medical records.
Real estate businesses: Financial transactions, client records, and payment instructions.
Retailers and e-commerce businesses: Online transactions, customer information, and operational systems.
Professional service firms: Client records, cloud applications, and vendor relationships.
Even businesses that don't maintain large customer databases can experience losses involving compromised email accounts, ransomware, or fraudulent payment requests.
For additional perspective, read our article on why cyber insurance is increasingly important for New Jersey businesses.
How Can You Tell Whether Your Business Has Enough Cyber Insurance?
Rather than focusing only on the premium or whether cyber coverage appears on your declarations page, consider asking these questions:
Do I have a standalone cyber policy or an endorsement to my BOP?
What are the actual cyber coverage limits and sublimits?
Does my coverage include both first-party expenses and third-party liability?
Are ransomware and cyber business interruption included?
Does the policy address social engineering and funds transfer fraud?
Are incidents involving outside vendors or cloud service providers covered?
What deductibles, waiting periods, and security requirements apply?
The answers can help determine whether your current insurance program reflects how your business actually operates.
Cyber insurance is only one component of a comprehensive business insurance program. Our article on common business insurance coverage gaps discusses other areas business owners should review.
Frequently Asked Questions About General Liability and Cyber Insurance
Does general liability insurance cover a data breach?
Generally, no. Standard commercial general liability insurance is not designed to cover most data breach response expenses, cyber extortion losses, or network restoration costs. Cyber-related claims may also be subject to specific exclusions. Actual coverage depends on the policy wording and circumstances.
Do I need cyber insurance if I already have a BOP?
Possibly. A BOP may include limited cyber or data breach protection, but the available limits and covered expenses may not adequately address your business's exposures. Reviewing the actual endorsement is the best starting point.
Is a BOP cyber endorsement the same as standalone cyber insurance?
Not necessarily. BOP endorsements may provide narrower protection or lower limits than standalone cyber policies. However, the appropriate choice depends on your business operations and the specific coverage offered.
Does cyber insurance cover phishing attacks?
Cyber insurance may cover certain losses arising from phishing, such as a resulting data breach or network compromise. However, losses involving fraudulent payments or social engineering may require specific coverage.
Is cyber insurance worth it for a small business?
That depends on the business's exposure, financial resources, and reliance on technology. Small businesses can experience significant losses from ransomware, data breaches, and fraudulent payment schemes. Comparing available coverage and premiums can help determine whether the protection makes sense.
Protect Your Business Beyond General Liability
General liability insurance remains an important part of protecting your business, but it isn't designed to address every exposure.
And while adding cyber coverage to a Business Owners Policy can provide valuable protection, the details matter.
At The Overmyer Insurance Agency, we help business owners understand what their existing insurance covers, identify potential gaps, and compare options from multiple insurance companies.
Whether you operate a professional services firm, retail business, medical practice, or another type of small business, we help you make informed decisions about your coverage.
The Overmyer Insurance Agency is an independent insurance agency based in Cranford, New Jersey, serving businesses throughout New Jersey, New York, and Pennsylvania.
Coverage descriptions are general and for educational purposes. Actual insurance coverage is determined by the specific policy forms, endorsements, exclusions, conditions, and applicable law.
Comments