Why general liability insurance is not enough
Cyberattacks are no longer limited to large corporations. Contractors, professional offices, retailers, restaurants, property managers and other small businesses are frequent targets because they process payments, store customer information and often operate with limited cybersecurity resources.
The FBI received 2,618 internet-crime complaints from Montana in 2025, with more than $53 million in reported losses. Nationwide, business-email-compromise incidents generated more than $3 billion in reported losses during the year.
One of the most concerning findings for Western Montana is the type of businesses being targeted. Among ransomware complaints from businesses outside designated critical-infrastructure sectors, legal services accounted for 18%, contracting services for 17% and engineering or architectural services for 10%.
Source: FBI Internet Crime Report 2025
A realistic small-business scenario
A contractor receives an email that appears to come from a regular supplier. The message says the supplier has changed banks and provides new payment instructions.
An employee sends a $45,000 payment to the new account. Several days later, the real supplier calls asking why the invoice has not been paid. The email was fraudulent.
This type of incident may be described as social engineering, fraudulent instruction or business-email compromise. A basic general liability or commercial-property policy typically is not designed to cover it.
What cyber insurance may cover
- Data-breach investigation and response
- Customer notification expenses
- Credit-monitoring services
- Legal and regulatory assistance
- Data restoration
- Ransomware response
- Business interruption caused by a covered cyber event
- Network-security and privacy liability
- Payment-card penalties
- Cyber extortion
- Social-engineering or fraudulent-transfer losses
Social-engineering coverage frequently has a separate limit, deductible and verification requirement. Business owners should not assume that a general cyber endorsement provides the same protection as a broader standalone policy.
Insurance cannot replace basic security
Insurers increasingly ask applicants about controls such as multifactor authentication, employee training, backups and payment-verification procedures. Weak controls can affect eligibility, pricing and coverage.
The FBI recommends that businesses maintain encrypted off-site or offline backups, eliminate default passwords, restrict administrative privileges, use multifactor authentication and promptly install security updates.
- Verify every request to change payment instructions using a known phone number
- Require two-person approval for large transfers
- Use unique passwords and multifactor authentication
- Limit employee access to sensitive systems
- Back up essential data and test restoration regularly
- Maintain an incident-response plan
- Report suspected cybercrime promptly through IC3.gov
| The takeaway: A Montana business does not need millions of customer records to experience a costly cyber loss. One compromised email account or fraudulent payment request can create a five- or six-figure problem. |
Sapphire Peak Insurance can help business owners evaluate cyber liability, data-breach, ransomware and social-engineering coverage as part of a complete commercial insurance program.
Cyber policies vary substantially. Coverage is subject to underwriting, policy conditions, exclusions, sublimits and security requirements.
