Updated October 2026

Cyberattacks are no longer a concern only for large corporations.

Small businesses across Ontario increasingly rely on email, online banking, electronic payments, cloud-based software and digital customer records to operate.

These technologies make running a business more efficient, but they also create opportunities for cybercriminals.

A single compromised email account, fraudulent payment instruction or ransomware attack can disrupt operations and result in significant financial losses.

Unfortunately, many business owners assume their existing commercial insurance will cover these incidents.

That is not always the case.

Cyber liability insurance is designed to address certain financial consequences of cyber incidents, but the protection available varies significantly between policies.

At L.D. Dermody Insurance Brokers, we believe Ontario business owners should understand both the benefits and limitations of cyber insurance before an incident occurs.

1. Why Would a Cybercriminal Target a Small Business?

It is easy to assume that cybercriminals are interested only in large companies with substantial financial resources.

However, smaller businesses can be attractive targets.

A small business may have:

• Limited information technology support.

• Employees performing several different roles.

• Fewer cybersecurity safeguards.

• Access to online banking and electronic payments.

• Customer records containing personal information.

• Dependence on a small number of computers or cloud applications.

• Limited financial resources to recover from a serious disruption.

Cybercriminals also use automated tools to identify vulnerable systems and accounts.

They do not necessarily select each victim individually.

A small accounting office, contractor, retailer, professional services firm or family-owned business can experience a costly cyber incident.

2. What Is Cyber Liability Insurance?

Cyber liability insurance is a type of commercial insurance intended to help businesses manage certain expenses and liabilities arising from cyber incidents.

Depending on the policy, it may provide protection for events such as:

• Unauthorized access to computer systems.

• Theft or disclosure of confidential information.

• Ransomware attacks.

• Malicious software infections.

• Certain network security failures.

• Cyber-related business interruption.

• Claims arising from a privacy or data security breach.

Cyber insurance policies generally include two broad categories of protection.

First-Party Coverage

First-party coverage addresses certain expenses incurred directly by the insured business.

Examples may include forensic investigation costs, data restoration expenses and lost income arising from a covered cyber incident.

Third-Party Coverage

Third-party coverage addresses certain claims made against the business by others.

For example, customers may allege that a company failed to protect their personal information.

Depending on the policy, coverage may include eligible legal defence expenses and certain damages or settlements.

Not every cyber policy includes the same protection, and some coverages may be optional.

3. What Happens When a Business Experiences a Cyberattack?

Consider a small Ontario business with six employees.

One employee receives an email that appears to come from a familiar supplier.

The message asks the employee to review an invoice through a link.

The employee clicks the link and enters their Microsoft 365 password into a fraudulent website.

The cybercriminal now has access to the employee's email account.

The attacker may be able to:

• Read confidential business correspondence.

• Search for invoices and payment information.

• Send fraudulent messages to customers or suppliers.

• Create email forwarding rules.

• Impersonate the employee.

• Attempt to gain access to other business systems.

The business may not immediately realize that anything has happened.

By the time the incident is discovered, the attacker may have obtained confidential information or redirected a payment.

The resulting expenses can involve much more than changing a password.

A business may need professional assistance to determine what happened, secure its systems, assess whether personal information was exposed and address any legal obligations.

This is where appropriate cyber insurance may become valuable.

4. What Expenses Can Cyber Insurance Cover?

Coverage varies by insurer, but a comprehensive cyber policy may include several important components.

Cyber Incident Response

Some policies provide access to specialized incident-response teams.

These professionals may help coordinate the response to a suspected breach or attack.

Computer Forensic Investigation

A forensic specialist may be needed to determine how the attacker gained access, what systems were affected and whether information was accessed or removed.

Data Restoration

Coverage may be available for eligible expenses to restore damaged or lost electronic data and software.

However, the policy may limit which systems and restoration expenses qualify.

Legal Assistance

Cyber incidents can create privacy, contractual and regulatory questions.

Some policies provide access to legal professionals experienced in cybersecurity and privacy matters.

Customer Notification

If personal information has been compromised, the business may need to notify affected individuals.

Certain policies cover eligible notification expenses and related services.

Credit Monitoring

Some policies provide coverage for credit monitoring or identity protection services when these are appropriate following a covered breach.

Business Interruption

A cyberattack may prevent a company from accessing systems needed to operate.

Certain cyber policies provide coverage for qualifying lost income and additional expenses during a covered interruption.

Cyber Extortion

Some policies include coverage for certain expenses associated with ransomware and cyber extortion incidents.

This does not mean that ransom payments are automatically insured or advisable.

The insurer's approval, legal requirements, exclusions and other conditions may apply.

5. What Is Ransomware?

Ransomware is malicious software or an attack technique used to disrupt access to systems or data, often accompanied by a demand for payment.

An attacker may encrypt files, interfere with operations or threaten to release confidential information.

For example, an Ontario business could arrive at work and discover that its accounting records, customer database and shared files are inaccessible.

The attacker demands payment in exchange for restoring access or promising not to release stolen information.

Even if the business has backups, recovering its systems may take considerable time.

Expenses may include:

• Investigating the attack.

• Removing malicious software.

• Restoring systems and data.

• Rebuilding compromised devices.

• Hiring external technology specialists.

• Addressing privacy obligations.

• Managing interruptions to business operations.

A cyber insurance policy may respond to certain expenses, but coverage depends on the policy wording and circumstances.

Paying a ransom does not guarantee that data will be restored or that stolen information will remain confidential.

The Canadian Centre for Cyber Security recommends strong backups, incident-response planning and multiple layers of security to reduce ransomware risk.

6. What Is Business Email Compromise?

Business email compromise is a form of fraud in which criminals use deceptive or compromised email communications to trick people into taking actions that benefit the attacker.

One common example involves fraudulent payment instructions.

Imagine that a contractor receives an email appearing to come from a regular supplier.

The message advises that the supplier has changed banks and asks the contractor to send an outstanding payment to a new account.

The email appears legitimate.

The contractor transfers $35,000.

Several days later, the real supplier contacts the contractor to ask why the invoice remains unpaid.

The money was sent to the criminal's account.

The contractor may still owe the supplier the original $35,000.

This type of incident raises an important insurance question.

Does the business have coverage for money voluntarily transferred as a result of fraudulent instructions?

The answer is not necessarily yes.

7. Does Cyber Liability Insurance Cover Fraudulent Money Transfers?

Not automatically.

This is one of the most important distinctions for business owners to understand.

A cyber liability policy may cover certain costs arising from a compromised email account without covering the money lost through a fraudulent transfer.

Coverage for these losses may appear under terms such as:

• Social engineering fraud.

• Fraudulent instruction coverage.

• Funds transfer fraud.

• Computer fraud.

• Cybercrime coverage.

These coverages may be included in a cyber policy, offered as optional extensions or available under certain commercial crime policies.

However, their definitions and requirements can differ significantly.

For example, a policy may distinguish between money transferred because an employee was deceived and money transferred directly through unauthorized access to a computer system.

The coverage limit for social engineering fraud may also be much lower than the overall cyber liability limit.

A business with a $1 million cyber policy should not assume it has $1 million of protection for fraudulent electronic payments.

Ask your broker specifically about these exposures.

8. What Is the Difference Between Cyber Liability and Commercial Crime Insurance?

Cyber liability and commercial crime insurance can address different types of losses.

Cyber liability insurance generally focuses on certain costs and liabilities associated with cyber incidents, data breaches and technology-related disruptions.

Commercial crime insurance may provide protection against specified forms of theft or fraud involving money, securities or other property.

Some commercial crime policies offer extensions for computer fraud, funds transfer fraud or social engineering.

There can be overlap between policies, but there can also be gaps.

For example, the circumstances under which a payment was authorized may affect which policy, if any, responds.

The important point is not simply whether your business has cyber insurance.

It is whether the combination of your policies adequately addresses the types of losses your business could experience.

9. Does Your Commercial General Liability Policy Cover Cyberattacks?

Business owners sometimes assume that their commercial general liability (CGL) policy provides sufficient protection for cyber incidents.

Traditional CGL policies are primarily designed to address certain third-party bodily injury, property damage and other specified liability claims.

They are not intended to provide comprehensive protection for modern cyber risks.

Similarly, a commercial property policy may provide only limited coverage for certain electronic data or computer-related losses.

Some commercial packages include a small amount of cyber coverage, but the limits and scope may be restrictive.

Do not assume that your existing commercial property or liability insurance provides adequate protection against a ransomware attack, data breach or fraudulent electronic payment.

A separate cyber policy or appropriately designed cyber endorsement may be necessary.

10. Can a Cyberattack Interrupt Your Business?

Yes.

For many small businesses, the loss of access to computer systems can be just as damaging as the loss of equipment.

Consider a business that depends on cloud-based software for scheduling, invoicing and customer records.

If those systems become unavailable, employees may be unable to perform their usual work.

The business may experience:

• Lost sales.

• Delayed invoicing.

• Missed appointments.

• Interrupted customer service.

• Additional payroll expenses.

• Emergency technology costs.

• Reputational damage.

Some cyber policies include business interruption coverage for qualifying cyber incidents.

However, important limitations may apply.

For example, the policy may contain a waiting period before coverage begins.

There may also be restrictions involving the type of event, affected systems, maximum indemnity period or coverage for outages involving third-party technology providers.

A general internet outage or routine software failure is not necessarily covered.

Business owners should review how the policy defines a covered interruption.

11. What if a Cloud Service Provider Is Attacked?

Many Ontario businesses use cloud-based services such as Microsoft 365, online accounting software, customer management systems and cloud storage.

Using a reputable cloud provider can offer important security benefits.

However, it does not eliminate the business's exposure to cyber incidents.

There are two different situations to consider.

Your Own Account Is Compromised

A cybercriminal obtains an employee's login credentials and accesses the company's cloud account.

This may result in unauthorized access to email, files or customer information.

The Cloud Provider Experiences an Incident

A technology provider experiences a cyberattack or service disruption that affects its customers.

Some cyber policies include contingent business interruption coverage for specified incidents involving third-party service providers.

Others may exclude these events or provide more limited protection.

Businesses that depend heavily on one cloud service should consider this exposure when reviewing cyber insurance.

12. What Are a Business's Privacy Responsibilities After a Data Breach?

A cyberattack can create obligations beyond repairing computers and restoring files.

Canadian businesses that are subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) must comply with applicable privacy requirements.

Under PIPEDA, organizations must generally report breaches of security safeguards involving personal information when there is a real risk of significant harm to affected individuals.

They must also notify affected individuals in qualifying circumstances and maintain records of breaches involving personal information under their control.

Recordkeeping obligations can apply even when a breach does not meet the threshold for reporting to the Privacy Commissioner.

The applicable legal obligations depend on the organization, information involved and relevant legislation.

Some businesses may also be subject to sector-specific rules, contractual requirements or other privacy legislation.

For this reason, businesses should obtain appropriate legal guidance when a breach occurs.

Cyber insurance may provide access to legal and privacy specialists, subject to the policy terms.

13. Can a Business Be Sued Following a Data Breach?

Potentially.

Customers, suppliers or other parties may allege that a business failed to take reasonable steps to protect confidential information.

Depending on the circumstances, a business could face claims involving:

• Unauthorized disclosure of personal information.

• Failure to protect confidential records.

• Alleged negligence in maintaining cybersecurity.

• Breach of contractual confidentiality obligations.

Whether such a claim succeeds depends on the facts and applicable law.

Cyber liability insurance may provide defence coverage for certain insured claims.

However, not every allegation, contractual obligation or legal expense is necessarily covered.

Businesses should review the policy's third-party liability provisions carefully.

14. Are Fines and Regulatory Penalties Covered?

Some cyber insurance policies refer to coverage for certain regulatory proceedings, investigations, fines or penalties.

However, coverage is subject to the policy wording and whether the amount is legally insurable.

Not every fine or penalty can be insured.

Businesses should not purchase cyber insurance on the assumption that it will pay all regulatory consequences arising from a privacy breach.

The availability of legal defence and regulatory coverage should be reviewed separately.

15. What Cyber Insurance Exclusions and Limitations Should You Watch For?

Cyber policies can differ substantially.

When comparing quotations, consider the following.

Coverage Limits

The overall policy limit may not apply equally to every type of loss.

Sublimits

Certain coverages, such as social engineering fraud, may have their own lower limits.

Deductibles or Retentions

The business may be responsible for paying a specified amount before coverage responds.

Waiting Periods

Business interruption coverage may not begin immediately after an incident.

Prior Incidents

Known or previously discovered incidents may not be covered under a newly purchased policy.

Security Requirements

The insurer may require specified cybersecurity controls or rely on representations made in the application.

Territorial and Jurisdictional Restrictions

Policies may limit where covered incidents, claims or legal proceedings can occur.

Vendor Requirements

Some policies require the insured to use approved incident-response providers or obtain authorization before incurring certain expenses.

Exclusions

Policies may exclude particular events, losses or circumstances.

A lower premium is not necessarily better value if the policy does not address your business's most significant exposures.

16. Why Do Insurers Ask About Cybersecurity Controls?

When applying for cyber insurance, businesses may be asked detailed questions about their computer systems and security practices.

These questions help the insurer assess the risk.

They may include:

• Is multifactor authentication enabled?

• Are operating systems and software regularly updated?

• Are backups maintained and tested?

• Are backups protected from unauthorized access?

• Is endpoint security installed?

• Do employees receive cybersecurity training?

• Are administrator privileges restricted?

• Is there a process for verifying payment changes?

• Does the business have an incident-response plan?

Some insurers require particular controls as a condition of eligibility.

Others may adjust premiums, limits or deductibles based on the safeguards in place.

It is essential to answer application questions accurately.

If a business represents that a particular security measure is in place when it is not, this could create serious coverage issues.

If you are unsure about a technical question, consult your IT provider rather than guessing.

17. Why Is Multifactor Authentication So Important?

Multifactor authentication (MFA) adds another verification step when someone signs in to an account.

For example, an employee may enter a password and then be required to approve the login using an authenticator application or another approved method.

This provides additional protection if a password is stolen.

MFA is particularly important for:

• Business email accounts.

• Microsoft 365 and other cloud services.

• Remote access systems.

• Administrator accounts.

• Financial applications.

• Systems containing sensitive customer information.

However, not all MFA methods provide the same level of protection.

Businesses should use stronger phishing-resistant authentication methods where practical and review their account security settings with qualified IT support.

MFA is an important safeguard, but it does not eliminate every cyber risk.

18. Why Are Backups Essential?

A reliable backup system can significantly reduce the impact of ransomware, accidental deletion or other data loss.

However, simply having a backup is not enough.

Businesses should consider:

• How frequently backups are created.

• Whether critical systems and data are included.

• Whether backups are protected from ransomware.

• Whether copies are maintained offline or otherwise isolated.

• How quickly information can be restored.

• Whether restoration procedures are tested regularly.

A backup that has never been tested may not work when needed.

The Canadian Centre for Cyber Security recommends maintaining protected backups and testing recovery procedures.

Businesses should also understand the difference between file synchronization and a true backup system.

A cloud service that synchronizes changes between devices may also synchronize accidental deletions or malicious changes.

19. How Can Businesses Reduce the Risk of Fraudulent Payments?

Cybersecurity is not only an IT responsibility.

Financial procedures are equally important.

For example, a business can establish a rule that changes to supplier banking information must be verified using a previously known telephone number.

Do not rely solely on the telephone number provided in the email requesting the change.

Other useful procedures include:

• Requiring secondary approval for large transfers.

• Separating payment preparation and authorization duties.

• Verifying unusual or urgent payment requests.

• Training employees to recognize impersonation attempts.

• Reviewing banking transactions regularly.

• Establishing procedures for suspected fraud.

These safeguards can help reduce the likelihood of a successful social engineering attack.

They may also be relevant when applying for certain insurance coverages.

20. What Should You Do if Your Business Experiences a Cyberattack?

A prompt and organized response can help limit the damage.

Step 1: Contact Your IT Support Provider

Obtain qualified assistance to assess the incident, contain the threat and protect unaffected systems.

Avoid unnecessarily deleting evidence or making uncontrolled changes that could interfere with an investigation.

Step 2: Contact Your Cyber Insurer or Broker

Report the incident as soon as possible.

Many cyber policies provide access to an emergency response hotline.

The insurer may arrange approved forensic, legal or incident-response assistance.

Step 3: Secure Compromised Accounts

Work with qualified IT personnel to revoke unauthorized access, secure accounts, review authentication methods and identify malicious changes.

Step 4: Contact Your Financial Institution if Money Is Involved

If a fraudulent transfer has occurred, immediately contact the bank or financial institution.

Rapid reporting may improve the possibility of stopping or recovering funds, although recovery is not guaranteed.

Step 5: Preserve Records

Retain relevant emails, logs, invoices, communications and other evidence.

Step 6: Assess Privacy Obligations

Determine whether personal information was affected and obtain legal guidance about notification or reporting requirements.

Step 7: Consider Reporting the Incident

Depending on the circumstances, report the incident to police and appropriate Canadian cybercrime reporting authorities.

Step 8: Review What Happened

Once operations are stabilized, identify the weaknesses that contributed to the incident and implement improvements.

Do not wait until every detail is known before notifying your insurer.

Early notification may be required under the policy and can help the business obtain appropriate assistance.

21. How Much Cyber Liability Insurance Does a Small Business Need?

There is no single coverage limit suitable for every business.

The amount of insurance required depends on factors such as:

• Annual revenue.

• Number of employees.

• Type and volume of customer information held.

• Dependence on computer systems.

• Online sales and payment processing.

• Contractual obligations.

• Potential business interruption costs.

• Exposure to fraudulent electronic transfers.

• Financial ability to absorb an uninsured loss.

A business holding extensive customer information may have a different exposure from a contractor that primarily uses email and online banking.

However, both could experience a costly cyber incident.

When considering coverage limits, it is also important to review the limits for individual coverages rather than focusing only on the overall policy limit.

22. Is Cyber Insurance Expensive?

The cost of cyber insurance varies depending on the business and the coverage selected.

Insurers may consider:

• Industry.

• Revenue.

• Number of employees.

• Cybersecurity controls.

• Claims history.

• Amount and type of sensitive information.

• Coverage limits.

• Deductibles.

• Selected endorsements.

Some small businesses may qualify for relatively straightforward cyber insurance packages.

Others may require more detailed underwriting.

The appropriate approach is to compare the available coverage with the potential financial consequences of a cyber incident.

A policy should be evaluated on what it covers, not simply its annual premium.

23. A Cyber Insurance Checklist for Ontario Businesses

Before purchasing or renewing cyber liability insurance, ask:

• Does the policy cover ransomware and cyber extortion?

• Are forensic investigation and incident-response services included?

• Is data restoration covered?

• Is cyber business interruption included?

• Are outages involving third-party technology providers covered?

• Does the policy include privacy liability and legal defence?

• Are customer notification expenses covered?

• Is social engineering fraud included?

• What is the limit for fraudulent electronic transfers?

• Are there separate sublimits or deductibles?

• Are there waiting periods for business interruption?

• What security measures does the insurer require?

• Is there a 24-hour incident-response hotline?

• Must the insurer approve vendors before expenses are incurred?

• What incidents or losses are excluded?

These questions can help identify important differences between policies.

Cyber Insurance Is One Part of Protecting Your Business

Cybersecurity involves more than antivirus software and strong passwords.

It requires a combination of technology, employee awareness, financial controls, backups and a plan for responding when something goes wrong.

Even a business with good security practices can experience a cyber incident.

Cyber liability insurance can provide valuable financial protection and access to specialized assistance, but it should not be viewed as a replacement for sound cybersecurity practices.

It is also important to understand that a cyber policy may not automatically cover every type of fraud or financial loss.

At L.D. Dermody Insurance Brokers, we encourage Ontario business owners to review their cyber exposures alongside their other commercial insurance needs.

If you own or operate a small business in Ontario, contact L.D. Dermody Insurance Brokers to discuss whether cyber liability insurance should form part of your overall business insurance program.

We can help you review the coverage options available through the insurance companies we represent and identify important questions to ask before purchasing a policy.

This article provides general insurance information as of October 2026. Cyber insurance coverage, definitions, limits, exclusions and underwriting requirements vary by insurer and policy. References to potential coverage do not guarantee that a particular claim will be insured. Businesses should obtain appropriate legal and technical advice concerning cybersecurity incidents and privacy obligations.