The Expert Podcast

For business owners, this is an extremely important detail to understand about your standard commercial lines policy. Most business owners have a policy called a BOP, or Business Owner's Policy. Sometimes there's a CPP (Commercial Package Policy). In any event, your commercial insurance policy has several exclusions from coverage that are important to know about.

On standard coverage, one exclusion is if the policy does not cover things that are not physical damage. And when the risk profile for the current year and future years is looked at, one of the largest risks that a business has is cyber risk—ransomware, hacking, and other types of cyber attacks. In a standard business owner's policy, these risks are not covered. You have to have a separate cyber liability policy or an endorsement to your BOP.

This has been proven out in court. There was a case in Ohio where a company suffered a loss from a cyberattack. They put a claim on their Business Owner's Policy, and the court said that it's very clear in the language of that policy that a Business Owner's Policy does not cover ransomware because there was no physical damage, according to the Ohio Supreme Court.

The story is that this company had a ransomware attack, and the hackers asked for $35,000 to release their computers. They paid the ransom, the hackers opened their computers back up, and they had full access to everything. There was no damage or permanent risk to their company. So they put in a claim for that $35,000, and it was rejected by the insurer.

This is where it's very important to understand that cyber risks, and even some business interruption risks that come from ransomware, may not be covered under a standard business owner's policy or even a commercial liability policy. So, check your policy. Again, we're not attorneys, we're not giving you legal advice, and we're not your insurance agent. But check with your broker or your agent to find out what coverages might be important to get if you have a standard business policy or you don't know what you have and you're concerned about having cyber covered for your business risk.