Cyber Liability Insurance for Connecticut Businesses: What the Policy Actually Pays

Why Cyber Coverage Reaches Smaller Connecticut Businesses

The businesses that get hit are rarely the ones with the most valuable data. They are the ones with the least resistance: a twelve-person medical billing office, a manufacturer running an unsupported server, a professional services firm where one person approves every wire. Attackers select for weak controls, not for size, and small and mid-size Connecticut employers hold exactly the information that triggers legal obligations when exposed — Social Security numbers, driver's license numbers, financial account details, health information.

Cyber insurance exists because the cost of an incident is mostly not the cost of fixing the technology. It is the forensics, the lawyers, the notification, the credit monitoring, the regulator, the customers who sue, and the lost revenue.

What Triggers a Breach Notification Obligation

Connecticut, like every state, has a data breach notification law. The trigger is generally unauthorized access to or acquisition of personal information about state residents held by your business. In practice the obligation turns on what categories of information were involved, whether the data was rendered unusable through encryption or similar means, and whether the facts show information was actually compromised rather than merely exposed.

Connecticut's framework has commonly required notice to affected residents and to the state Attorney General, and has commonly required that identity theft protection services be offered where certain categories of information are involved. Deadlines apply and have been tightened in recent years. We are deliberately not printing a number, because timing rules change and getting one day wrong is a regulatory problem — confirm the current deadline with breach counsel, which is one practical reason a policy's panel of pre-approved breach lawyers matters.

Two points owners miss. Obligations follow the residency of the affected individuals, not your location, so a Bridgeport company with customers in six states faces six statutes. And contracts, HIPAA, financial services rules, and payment card requirements can each impose faster or broader duties than state law.

First-Party Versus Third-Party Coverage

Every cyber policy splits into money spent on your own business and money spent on claims against you. Read yours with that split in mind.

First-Party Coverages

• Incident response: forensics, breach counsel, notification, call center support, and credit or identity monitoring.
• Business interruption and extra expense: lost net income and continuing expenses while systems are unusable, plus the added cost of operating in a degraded state.
• Data restoration: recovering or recreating data and software, limited to restoration rather than upgrade.
• Cyber extortion: ransom negotiation and payment where legally permitted.

Third-Party Coverages

• Privacy liability: defense and damages when individuals or businesses claim their information was mishandled.
• Network security liability: claims that your systems transmitted malware or were the entry point into someone else's network.
• Regulatory defense and penalties: responding to a regulator, plus fines where insurable by law.
• Payment card liability: assessments and case management costs under card brand rules — contractual rather than statutory, and frequently sublimited.

Our overview of cyber liability insurance for Connecticut businesses covers how these pieces are assembled. Firms that give professional advice should also check how cyber interacts with professional liability coverage, since a claim alleging both a security failure and a service failure can fall between two policies.

Ransomware Sublimits Are Not Your Policy Limit

This is the most misread part of a cyber policy. Owners assume the full aggregate limit is available for a ransomware event; frequently it is not. Cyber extortion is commonly written as a sublimit sitting inside the aggregate, and many carriers additionally apply coinsurance, meaning the insured retains an agreed percentage of the payment.

Sublimits are also increasingly tied to controls. Carriers commonly condition full extortion limits on multi-factor authentication for remote access and email, tested and segregated backups, endpoint detection, and privileged access management. Where those are absent, some carriers cut the sublimit, raise the retention, or apply coinsurance to ransomware specifically. Two conditions matter: most policies require the carrier's consent before any payment, and none will fund a payment that violates sanctions law — paying first turns a covered event into an uncovered one.

So the question for your broker is not "what is my limit" but "what is my ransomware sublimit, what coinsurance applies, and which controls must I maintain to keep it."

Social Engineering and Funds Transfer Fraud

The most common way Connecticut businesses lose money to a cyber event involves no malware at all. Someone impersonates a vendor, an executive, or a closing agent, and an employee sends a legitimate payment to a fraudulent account. Because the employee authorized the transfer, this is a different loss than theft — insurers call it voluntary parting, which is why standard computer fraud wording often does not respond. Coverage usually comes by endorsement, labeled social engineering fraud, funds transfer fraud, fraudulent instruction, or deception coverage. Expect three things:

• Its own sublimit, commonly far below the policy aggregate. A seven-figure cyber limit may leave only a small fraction available for a wire loss.
• Conditions precedent, typically out-of-band verification: a call-back to a known number, not one supplied in the request, before changing payment instructions or releasing funds above a threshold. Fail the procedure and the claim can fail with it.
• Definitions that vary by carrier. Some forms cover impersonation of employees and vendors but not clients; some respond only to your own funds, not funds you hold for others.

If you handle client escrow or third-party funds, that last distinction deserves attention, and the endorsement should be compared against any commercial crime policy you carry.

Business Interruption Waiting Periods

Cyber business interruption does not start paying the moment systems go down. A waiting period applies, expressed in hours, and the number varies meaningfully by carrier and class of business. Many outages resolve inside a short waiting period, meaning coverage never engages — so the waiting period, more than the limit, often decides whether the clause is useful. Three related mechanics to check:

• Period of restoration. Coverage typically runs until systems are restored, sometimes plus a short tail — not until customers come back.
• How loss is measured. Recovery is generally net income plus continuing operating expenses, not gross revenue.
• Dependent business interruption. If you rely on a cloud platform, payment processor, or managed service provider, ask whether their outage is covered. Some forms cover named vendors only, some require a security failure at the vendor rather than any outage, and some exclude it entirely.

Ask too whether the policy covers system failure — an outage with no attack behind it — or only security failure.

Common Exclusions and Conditions

• Prior known incidents and retroactive dates. Cyber is generally claims-made, so anything known before inception or occurring before the retroactive date is typically outside coverage. Preserve your retroactive date when changing carriers.
• Application warranties. Applications ask directly about multi-factor authentication, backups, and access controls. Answering optimistically about controls you have not fully deployed gives a carrier grounds to contest a claim later.
• War and state-backed attack wording, rewritten across the market in recent years and far from uniform. Ask what broad attribution language means for an attack later attributed to a nation-state.
• Infrastructure failure of utilities, telecommunications, or internet backbone outside your control, commonly excluded unless added back.
• Betterment. Policies fund restoration, not improvement.
• Bodily injury and property damage, handled under general liability and property forms.

How to Approach the Decision

Start with what would actually happen to your business. Estimate how many records you hold and how many states those people live in, because notification cost scales with both. Identify the systems whose loss stops revenue. Look at your payment approval process and decide honestly whether a convincing email could move money out the door. Those answers drive limits, waiting periods, and which sublimits need negotiating. Then read the endorsements rather than the summary page: two policies with identical limits can behave completely differently in a ransomware event or a wire fraud.

Review Your Cyber Exposure With a Connecticut Advisor

New England Insurance advises business owners from our Bridgeport office across Connecticut, including companies in Stamford and New Haven. We do not publish premium figures, because cyber pricing depends on revenue, data volume, industry, and the controls you can evidence. What we will do is compare the forms in front of you and show where sublimits and waiting periods leave a real gap. Contact us for a coverage review.