First-party vs third-party coverage
First-party and third-party coverage address different risks. First-party pays for your own costs — the $200K forensic bill, the $50K notification mailing, the $300K in business interruption losses. Third-party pays for the claims and lawsuits that come from the people whose data you lost. A retailer with 50,000 customers on a stolen laptop needs both: first-party for the response work, third-party for the 50,000 potential lawsuits.
Most 2026 policies sell first-party and third-party together. The exception is the smallest micro-policies, which may sell first-party only. If you are shopping for a micro-policy and you handle any third-party data (customer email, payment card, health information), add third-party coverage. The premium difference is usually 20% to 40%.
Ransomware sublimits and the OFAC question
Most 2026 cyber policies include a ransomware sublimit, but the coverage is narrower than the headline policy limit. A $1M cyber policy might carry a $250K to $500K ransomware sublimit with a separate, higher retention ($25K to $100K vs $10K to $25K for non-ransomware claims). Ransomware payments are also subject to OFAC review, and carriers will not pay a ransom to a sanctioned group.
The OFAC question matters because the US Treasury's Office of Foreign Assets Control publishes a list of sanctioned ransomware groups. If the attacker is on the list, the carrier will not pay. The carrier is also unlikely to pay if the payment would violate US sanctions on a specific country. Read the policy's OFAC exclusion carefully, and ask the carrier how they handle payments when the attacker cannot be definitively attributed.
Five questions to ask before you buy
- What is the retroactive date? A 6-month or longer retroactive date protects you from claims arising from breaches that started before the policy incepted. The longer the retroactive date, the more protection you have.
- What is the ransomware sublimit? The headline policy limit is not the ransomware sublimit. Ask for the ransomware sublimit and the separate retention, and compare across carriers.
- What controls does the carrier require? Most carriers will not bind without MFA, EDR, working backups, and a tested incident response plan. Ask for the control list before you apply, so you can remediate any gaps in advance.
- Does the policy cover regulatory fines and penalties? The answer is yes for most carriers, but the sublimit is often lower than the headline limit. HIPAA, GDPR, and state AG penalties are usually covered; SEC and OFAC penalties are usually excluded.
- Does the policy include breach response vendors? Most carriers have a panel of pre-approved breach response vendors: forensic firms, legal counsel, credit monitoring providers, public relations firms. Using a panel vendor speeds up the response and removes a payment-approval step. If you have an existing incident response firm, ask whether the carrier will accept them.
How to file a claim
The carrier's claims hotline is typically 24/7. Call as soon as you discover the breach. Most policies have a notification window of 30 to 90 days; missing the window can void coverage. The carrier assigns a claim handler, who walks you through the documentation: timeline of the breach, scope of the data exposed, response work completed, and projected cost.
You do not need to wait for the breach to be fully contained before calling. The carrier's first priority is to engage the breach response vendors and stop further damage. The forensic investigation and the claims documentation can happen in parallel. The retention applies to the total claim, not per-vendor, so the retention is the number to negotiate if you are trying to minimize out-of-pocket costs.
Common mistakes when buying data breach insurance
The mistakes that show up most often in denied claims in 2026:
- Buying first-party only when you need third-party. The cheapest policy often excludes the third-party lawsuits that are the most expensive part of a breach.
- Not reading the retroactive date. A 0-month retroactive date means no coverage for any breach that started before the policy incepted.
- Material misrepresentation on the application. If you claim MFA is enabled and the carrier discovers a single unprotected account, the carrier can deny the claim. Tell the truth on the application.
- Missing the notification window. Most policies require notification within 30 to 90 days. Missing the window can void coverage.
- Using a non-panel vendor without approval. If the carrier has a panel and you use a non-panel vendor without written approval, the carrier may not pay the bill.
Source: Coalition 2026 Cyber Claims Report; At-Bay 2026 Mid-Year Update; CISA Cybersecurity Insurance Resources; FTC Data Breach Response Guide for Business; NAIC Cybersecurity Insurance Resource Center; 2026 carrier policy forms from Coalition, At-Bay, Corvus, Cowbell, Tokio Marine HCC, Beazley, Hiscox, Chubb, and AIG.
Data breach insurance 2026 buyer FAQ
How much data breach insurance do I need in 2026? A common rule of thumb is enough coverage to cover your total customer PII exposure. A retailer with 100,000 customers should consider at least $2M in coverage. A hospital with 500,000 patient records should consider $5M or more. Most small businesses can start with $1M and reassess annually.
Does data breach insurance cover notification costs? Yes, in nearly every 2026 policy. Notification costs are a first-party expense and are covered up to a sublimit that ranges from $250K to $2M depending on the headline policy limit and the number of affected individuals.
Does data breach insurance cover credit monitoring? Yes, first-party credit monitoring is a standard coverage. Most policies cover 12 to 24 months of credit monitoring for affected individuals, with a sublimit that scales with the headline limit. Some policies offer longer terms or identity restoration services at higher sublimits.
What is the difference between data breach insurance and cyber liability insurance? They are the same product. Cyber liability is the broader category, and data breach insurance is the most common component of a cyber liability policy. A 2026 cyber policy typically includes data breach coverage, ransomware coverage, business interruption, and third-party liability.
Is data breach insurance tax-deductible? In most cases, yes. Cyber insurance premiums are generally deductible as a business expense. Confirm with your tax advisor for the specific treatment in your jurisdiction.
What happens if I have a breach before I buy insurance? If the breach occurred before the policy incepted, the claim is not covered. Some carriers offer a discovery period or prior-and-pending litigation coverage as an endorsement, but it is not standard. If you suspect a breach, get coverage in place before the breach is confirmed.
How do I renew data breach insurance? Renewals require the same application, controls attestation, and incident history as new business. Most carriers will not require a new assessment, but they will require updated documentation. Plan the renewal 90 days ahead of the bind date to leave time for follow-up questions and a clean transition.
Fazlur Rahman
