Does My Online Store Need Cyber Liability Insurance?
"My platform is secure, so I'm covered" is the single most expensive misconception in ecommerce insurance — and it isn't even true.
A single breach cost one online store $95,000 — cyber liability runs $60-200/mo
GL explicitly excludes cyber incidents — see the coverage comparison below.
Here's the misconception, stated plainly: "Shopify handles security, so I don't need my own cyber policy." It's the single costliest sentence we hear from ecommerce owners, and it's backwards on the specifics — Shopify secures its own servers; it has never once covered a store's liability for a breach that started with a compromised admin login, a vulnerable third-party app, or a phishing email that reached an employee's inbox.
Platform security and your liability coverage are two entirely different things — one doesn't substitute for the other.
What a breach actually costs — a real example
An online store's checkout system was breached, exposing 4,000 customers' payment details. The response — forensic investigation to determine what happened, legal counsel, mandatory customer notification, and credit monitoring for affected customers — totaled roughly $95,000. That figure is typical, not a worst case: breach costs routinely reach six figures even for a store with a few thousand customers, because notification and monitoring costs scale with customer count, not revenue.
What $95,000 breaks down into (illustrative allocation)
Why general liability doesn't help
GL's coverage list is explicit about what it excludes, and cyber incidents and data breaches are on that list by name — the same way GL doesn't cover your own vehicles or professional advice. A business carrying only general liability has, in practice, zero coverage for the single most expensive thing likely to go wrong at an online store.
What each policy actually covers
| Risk | General liability | Cyber liability |
|---|---|---|
| Customer slip/injury on your premises | ||
| Data breach forensics & legal counsel | ||
| Customer notification & credit monitoring | ||
| Ransomware payment & system restoration | ||
| Product-liability injury claim |
Coverage exclusions aren't a technicality you can argue around after a breach — an insurer will deny a cyber claim filed against a GL-only policy outright, regardless of how the breach happened.
What the policy covers
What a cyber liability policy pays for
- Forensic investigation to determine what was accessed and how
- Legal counsel for regulatory and customer-facing breach obligations
- Mandatory customer notification and credit monitoring
- Ransomware payments and system restoration costs, up to the policy's sub-limit
- Business interruption from a covered cyber event
- Liability for third-party claims tied to the exposed data
Signs your current coverage has a gap
Signs your cyber coverage has a gap
- You've never confirmed whether your GL policy explicitly excludes cyber events (it does, but check your specific policy language)
- Your cyber policy's ransomware coverage is a small sub-limit buried inside a larger aggregate limit
- Nobody at the company can name the deductible or waiting period before cyber coverage responds
- You've added new checkout apps or payment integrations since the policy was last reviewed
Cyber liability is inexpensive relative to what it covers — $60-200/mo against a real claim example of $95,000. It is the single most important policy an ecommerce business is likely to be missing.
See the full cyber liability coverage breakdown and where to get a quote on our policy guide.