CYBER LIABILITY INSURANCE
Cyber liability insurance for Alabama businesses.
A single ransomware attack or data breach can cost a small business $200,000 or more in response, recovery, regulatory fines, and lawsuits. Cyber liability is no longer specialty coverage. It is essential for almost every business that uses email, processes payments, or stores customer data.
What it covers
What cyber liability covers.
What it covers
Breach response and notification
Pays the costs of notifying affected customers, hiring forensic investigators, providing credit monitoring, and engaging breach coaches and lawyers. State and federal breach notification laws make this expensive even for small breaches.
What it covers
Cyber extortion and ransomware
Covers ransom payments (when legally permitted) and the costs of negotiating, recovering, and rebuilding systems after a ransomware attack. Most policies also cover business income loss while systems are down.
What it covers
Network security and privacy liability
Pays defense costs and damages if customers, vendors, or regulators sue you because of a breach or privacy violation. This is the liability coverage side of a cyber policy. Includes regulatory fines and penalties where insurable by state law.
What it covers
Business interruption from a cyber event
Pays lost income and continuing expenses if a cyber attack disrupts your operations. Often includes contingent business interruption from an attack on a vendor or cloud provider you depend on. This is income protection, not damage to your building or equipment, which falls under commercial property insurance.
Where policies have edges
What cyber liability does not cover.
Not covered
Failure to maintain basic security
Most policies require minimum security controls like multi-factor authentication, regular backups, and staff training. Failing to maintain these can be grounds for denial of a claim.
Not covered
Pre-existing breaches
Breaches that began before the policy started are not covered, even if discovered during the policy period. The application asks about prior incidents and answers must be accurate.
Not covered
Bodily injury and property damage
Physical injury to people or damage to property is excluded under cyber. Those losses fall under general liability or commercial property and may not be covered if cyber is the underlying cause.
Not covered
Acts of war and certain state-sponsored attacks
Recent cyber events have triggered carrier disputes over war exclusions when state-sponsored actors are involved. Read the war exclusion language carefully and ask your agent how it has been applied.
Who needs this
Who needs Alabama Cyber Liability Insurance?
Any business that uses email, processes credit cards, stores customer information, or relies on computer systems to operate. Many small firms pair this with a business owners policy for broader protection. The smallest businesses are now common ransomware targets because they often have weaker defenses than large enterprises. State breach notification laws apply to businesses regardless of size in nearly every state.
What it costs
What can you expect to pay?
Varies by industry, data volume, security controls, and revenue. Most small businesses pay between $700 and $3,500 per year for typical $1M cyber liability limits. Higher data volume or regulated industries pay more.
Not sure how much you need?
Check your coverage before you need it
In Alabama
How does this work in Alabama?
Alabama's Data Breach Notification Act of 2018 (Code of Alabama Sec. 8-38-1 et seq.) requires any business holding sensitive personally identifying information about Alabama residents to notify affected individuals within 45 days of determining a breach occurred, regardless of business size. If more than 1,000 Alabama residents are affected, the business must also notify the Alabama Attorney General within the same 45-day window. Violations are enforced exclusively by the Attorney General, with civil penalties up to $5,000 per day capped at $500,000 per breach. Alabama was one of the last states to pass a breach notification law, and its penalty structure is dollar-specific in a way many states' laws are not. Businesses that pair cyber coverage with a business owners policy get broader protection against the physical-damage risks cyber excludes. A coverage review can confirm what cyber coverage matches your data exposure and notification obligations.
If You Need to File a Claim
Claims tips
A cyber claim moves fast. The first 24 hours determine whether the breach gets contained or spreads, whether evidence is preserved, and whether you meet legal notification deadlines.
- Do not turn off systems. Do not pay anything yet. Disconnect from the network if you can to contain the spread, but leave systems running so forensic investigators can preserve evidence. Premature payment or system reset can destroy your ability to recover and your insurance claim.
- Notify your cyber carrier immediately. Most cyber policies have a 24/7 breach hotline. Use it. The carrier provides access to a panel of breach coaches, forensic investigators, and lawyers, and using their panel is often a coverage requirement.
- Engage the carrier's breach counsel before you communicate with anyone. Anything you say to customers, employees, or the public can affect liability and coverage. Breach counsel coordinates messaging and protects privilege.
- Preserve all evidence. System logs, ransom notes, suspicious emails, network traffic captures. Forensic investigators need this to determine scope. Do not let IT staff wipe or rebuild systems before evidence is collected.
- Track every cost and every hour. Forensic fees, breach counsel time, customer notification mailings, credit monitoring, and overtime by your staff. All are likely reimbursable under the policy. See our claims page for how we help you through the process.
- Watch the breach notification clock. Different states and federal laws set different notification deadlines, often 30 to 60 days from discovery. Missing deadlines compounds the cost dramatically. Your deductible still applies, so track spending against it. Breach counsel will track these for you.
OUR CARRIER PANEL
Carriers We Work With
The carriers we compare are licensed and regulated in your state. We shop these markets and present the options that match your situation; a licensed advisor reviews the fit with you in a free coverage review.
Chubb Commercial Insurance
Mid-market and specialty commercial insurance for established businesses above $5M revenue.
Learn moreCNA Commercial Insurance
Mid-market commercial package, professional liability, and workers comp for businesses above $1M revenue.
Learn moreCoalition Cyber Insurance
Technology-forward cyber insurance with active threat monitoring and purpose-built claims response.
Learn moreCowbell Cyber Insurance
AI-powered cyber insurance with continuous risk assessment for small and mid-market businesses.
Learn moreHanover Commercial Insurance
Small and mid-market commercial insurance through independent agents.
Learn moreLiberty Mutual Commercial
Multi-line commercial insurance for small to mid-market businesses. business owners policy, workers comp, commercial auto, and cyber from a
Learn moreThe Hartford Commercial Insurance
The Hartford's Spectrum business owners policy is one of the broadest small business policies available. An honest review of their commercia
Learn moreCommon Questions
Alabama Cyber Liability Insurance: frequently asked questions
How long does an Alabama business have to notify customers after a data breach?
45 days. Alabama's Data Breach Notification Act (Code of Alabama Sec. 8-38-5) requires a covered entity to notify affected individuals within 45 days of determining a breach of sensitive personally identifying information occurred, or within 45 days of…