Cyber Liability — Frequently Asked Questions

Law firms routinely handle data that triggers notification obligations if breached, including Social Security numbers, financial account information, medical records, trade secrets, and privileged communications. Even basic client contact information combined with case details can constitute personally identifiable information under state breach notification laws. Firms handling corporate transactions, immigration matters, or estate planning hold particularly sensitive data that makes cyber coverage essential for regulatory compliance and client trust.

Yes. Most modern cyber liability policies include coverage for ransomware events, paying for the ransom itself (subject to legal compliance), forensic investigation to identify the attack vector, data restoration from backups, business interruption losses during downtime, and notification costs if client data was compromised. Some policies impose sublimits on ransomware payments that are lower than the overall policy limit, so firms should review these sublimits carefully during the buying process.

First-party coverage pays for your firm's own losses from a cyber event, including forensic investigation, data restoration, business interruption, notification expenses, and credit monitoring for affected individuals. Third-party coverage defends against lawsuits and regulatory actions brought by clients, employees, or government agencies alleging that your firm failed to adequately protect their data. A comprehensive cyber policy includes both components to address the full spectrum of financial exposure from a data breach.

Absolutely. Small firms are disproportionately targeted by cybercriminals because they often lack dedicated IT security staff and sophisticated defenses. A single phishing attack compromising a firm email account can expose client trust account information, privileged communications, and personal data. The cost of breach response alone, including forensics, legal counsel, and client notification, can exceed $100,000 even for a small incident. Cyber insurance makes these costs manageable for firms of any size.

Small firms with fewer than ten attorneys typically carry $500,000 to $1,000,000 in cyber coverage. Mid-size firms handling sensitive corporate, healthcare, or financial data often maintain $2,000,000 to $5,000,000 in limits. Carriers evaluate your firm's data volume, security controls, and practice areas when setting pricing. Retentions range from $1,000 to $25,000 depending on firm size and the strength of your cybersecurity practices, such as multi-factor authentication and employee training programs.