By Chris Painter, Director of Commercial Lines, Advanced Insurance Solutions · Updated November 2, 2026

Quick tip from Chris: Before the holiday rush, turn on multi-factor authentication for your email, banking and payroll accounts, and make a rule that no one changes payment instructions based on an email alone. A quick phone call to a number you already have stops most fake-invoice scams. Then check whether your business policy actually covers cyber events. Most general liability and property policies cover little or none of a data breach or a fraudulent wire transfer, and a dedicated cyber policy is usually what fills that gap.

Most small business owners I talk with assume cyber criminals go after big companies. The numbers say otherwise. Small businesses tend to have fewer safeguards, busier owners and staff who wear several hats, and that's exactly what scammers look for, especially when offices are short-staffed around the holidays.

From our Hershey and York offices, our commercial team works with offices, contractors, medical practices, salons, restaurants and retailers across Dauphin, Lebanon, Cumberland, Lancaster, York and Adams Counties, plus Harford, Baltimore and Carroll Counties in northern Maryland. Here's how I explain cyber risk and cyber insurance to them.

How big is the cyber threat for small businesses?

The FBI's Internet Crime Complaint Center (IC3) received nearly 860,000 complaints in 2024, with reported losses of about $16.6 billion. Business email compromise, where a criminal impersonates a vendor, customer or executive by email to redirect a payment, accounted for 21,442 complaints and close to $2.8 billion in losses, the second-highest dollar total of any crime type.

Those are only the losses people reported. Many small businesses never file a complaint, so the real figures are likely higher.

Why do the holidays raise the risk?

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have warned that criminals have historically targeted organizations during holidays and weekends, when offices are thinly staffed and more people work remotely. Fewer eyes on the systems means attacks can go unnoticed longer. Add year-end invoices, bonus payroll runs and a flood of shipping notices, and it's an easy time to slip a fake email past a busy bookkeeper.

What does cyber liability insurance cover?

Cyber policies vary more than almost any other coverage we sell, but most combine two parts.

First-party coverage (your own costs). This can include forensic experts to find out what happened, legal guidance on your notification duties, the cost of notifying affected customers and offering credit monitoring, data restoration, business interruption while your systems are down, and ransomware response.

Third-party coverage (claims against you). This can help if customers, patients or business partners sue because their information was exposed, and it may cover certain regulatory investigations and penalties where insurable.

Social engineering and funds transfer fraud. This is the coverage for fake-invoice and payment-redirect scams. It's often limited, offered as an add-on, or handled under a separate crime policy, so ask about it specifically. It's the gap I see most often.

Many cyber policies also come with a breach response hotline and access to pre-approved vendors, which can be just as valuable as the money when you're in the middle of an incident.

Doesn't my general liability or business owners policy already cover this?

Usually not much. Many general liability policies exclude data breaches, and property policies generally cover physical damage, not lost data or stolen funds. Some business owners policies include a small cyber endorsement, but limits are often modest and may not include ransomware or fraudulent transfers. Check your policy, or send it to us and we'll tell you what's there.

What are Pennsylvania's data breach notification rules?

Pennsylvania updated its Breach of Personal Information Notification Act in 2024, with the changes taking effect September 26, 2024. Among the key points:

Notice to the Attorney General. If a breach requires notifying more than 500 Pennsylvania residents, the business must also notify the Pennsylvania Attorney General at the same time.

Credit monitoring. When a breach involves a person's name together with a Social Security number, bank account number, or driver's license or state ID number, the business must offer 12 months of credit monitoring at no cost and access to one independent credit report.

Maryland and other states have their own notification laws, so a business with customers in more than one state may have several sets of rules to follow. Notification and monitoring costs are exactly the kind of expense a cyber policy is designed to help with. For specific legal questions, talk with your attorney.

How can small businesses reduce cyber risk?

Turn on multi-factor authentication. CISA and the FBI recommend it, especially for email, remote access and administrator accounts. Many cyber insurers now ask about it on the application.

Verify payment changes by phone. Call a known number before changing bank details for a vendor, employee or customer. Never use the phone number in the suspicious email.

Back up your data and test it. Keep backups separate from your main network so ransomware can't reach them.

Keep software updated. Install updates for operating systems, routers and point-of-sale systems promptly.

Train your team. Short, regular reminders about suspicious links and urgent payment requests go a long way.

Plan holiday coverage. Know who will respond if something goes wrong over a long weekend, and keep your insurer's breach hotline handy.

Frequently asked questions

Do I need cyber insurance if I don't store credit card numbers?

Probably still worth considering. Email accounts, payroll records, employee Social Security numbers, customer addresses and online banking are all exposures. Business email compromise doesn't require any stored data at all.

Will cyber insurance reimburse money I wired to a scammer?

Only if your policy includes social engineering or funds transfer fraud coverage and the loss meets its terms. Many policies limit this coverage, so ask about it directly.

What do insurers ask on a cyber application?

Expect questions about multi-factor authentication, backups, employee training, software updates and your revenue. Stronger controls can make coverage easier to get and may improve pricing.

Is cyber insurance expensive for a small business?

It depends on your industry, revenue, the type of data you handle and your security controls. For many small offices it's more affordable than owners expect. The best way to know is to compare quotes.

What should I do first if I think we've been hacked?

Call your insurer's breach hotline or your agent right away, before you start deleting files or paying anyone. Early expert help can preserve evidence and keep costs down.

Let's check your business for cyber gaps

We'll review what your current policies cover, explain where a cyber policy fits, and compare options across the insurance companies we represent. Request a business insurance quote or call us at 717-533-0252 (Hershey) or 717-845-1500 (York). You're also welcome to stop by our Hershey office on West Chocolate Avenue or our York office on South Queen Street.

Sources: FBI Internet Crime Complaint Center: 2024 Internet Crime Report · Nacha: FBI's IC3 Finds Almost $8.5 Billion Lost to Business Email Compromise in Last Three Years · BakerHostetler: Pennsylvania Makes Significant Changes to Its Data Breach Notification Law · Clark Hill: Holiday Cyber Best Practices, CISA and FBI Guidance

Coverage, eligibility and pricing vary by insurance company, policy and state. This article is general information, not a coverage guarantee or legal advice. Talk with a licensed agent about your specific business, and with an attorney about your legal obligations.