Three Hawaiʻi Businesses, Three Cyber Attacks: Why Cyber Insurance Isn't Optional Anymore

This year, three of my clients called me about a cyber attack. None of them were large companies. None of them thought it would happen to them. And none of them had cyber insurance when it did.

Two had their email hacked and fake invoices sent to their customers. The third was hit with ransomware and couldn't get into its own files for months. Here's what happened, what their regular insurance did and didn't cover, and what you can do so it doesn't happen to you.

(Details have been changed to protect my clients' privacy.)

The fake invoice: $85,000 gone in one wire

One client, a local sales company, called me after a criminal got into their email account. From there, the criminal emailed the company's customers and asked them to send their payments to a "new" bank account.

The scheme was elaborate. The fraudsters opened accounts at banks on the mainland under a name nearly identical to my client's business, using forged corporate documents. They targeted three customers. One noticed something was off and called my client, which is how the scheme came to light. A second was reached in time. The third had already wired $85,000 to the fraudster's account.

Technically, the criminals didn't steal my client's money. They stole the customer's money. But from the customer's point of view, it happened because my client's email was hacked, and the relationship and the unpaid invoice landed on my client.

Another client went through a similar email hack with false invoices this year. This kind of attack, often called business email compromise, is becoming more common every year, and small businesses are frequent targets.

Ransomware: locked out for months

A third client, a local manufacturer and supplier, was hit with ransomware. Their computer systems were encrypted and they lost access to their own files, and it took months to fully recover.

They had no cyber policy. In the middle of the crisis, the owner asked me a fair question: did any of their other insurance cover business interruption or the cost of cleaning up? When I reviewed their policies, anything related to a cyber attack was excluded.

So the business paid for the recovery itself. Their own IT person was joined by a team of outside specialists, all working to restore systems while the staff tried to keep the doors open. It was weeks of chaos and months before things were back to normal.

Why your regular policies usually won't help

Most business owners assume their general liability or property policy will step in. Usually, it won't:

• General liability is built for injuries and physical property damage. Many policies now exclude data breaches and cyber events outright.
• Property and business interruption coverage typically depends on physical damage, like a fire or a storm. Encrypted files and a locked network generally don't qualify, and many property policies exclude cyber events as well.

What a cyber policy can cover

Cyber policies vary a lot from carrier to carrier, but a good one can include:

• Incident response: a hotline and a team of IT forensics, legal and recovery experts, so you're not figuring it out alone.
• Data restoration and system repair after ransomware or another attack.
• Business interruption: lost income while your systems are down.
• Cyber extortion: help negotiating and handling ransom demands.
• Liability: if customers' or employees' information is exposed.

The fake invoice scenario is trickier. Many basic cyber policies don't cover it automatically. It often takes specific add-ons, such as:

• Funds transfer fraud or social engineering coverage, for when you are tricked into sending money to a criminal.
• Invoice manipulation coverage, for when a hacker uses your systems to trick your customer into paying the wrong account and you can't collect what you're owed.

If you take one thing from this post: ask specifically whether your cyber policy covers fraudulent invoices and payment redirection. Don't assume it does.

Lower your risk, then insure what's left

Insurance pays for the damage, but a few habits can stop many attacks before they start:

1. Turn on multi-factor authentication for email and banking. It's the single biggest step against hacked email.
2. Verify any change in payment instructions by phone, using a number you already have, not one in the email. Ask your customers and vendors to do the same with you.
3. Tell your customers you will never change your bank details by email. A line on your invoices does the job.
4. Back up your files regularly, and keep at least one backup disconnected from your network.
5. Train your team to spot suspicious emails and links.

One more benefit many people don't know about: depending on the carrier, a cyber policy can come with a risk review or threat assessment of your business, plus a checklist of practical steps to close the gaps.

The hardest part of these calls is always the same: cyber coverage can't be bought after the fact. One of these clients told me he had always meant to call me about it and never got around to it. If you've been meaning to, now is the time. Book a call or take our Coverage Check, and I'll get you quotes from several carriers, including the add-ons that cover fake invoices.