See what can happen to companies like yours.
Incidents, losses and lessons - including clearly-labeled composite scenarios where the real names aren't public. Filter by the vertical that matches your company. When you're ready, sketch the limits these losses imply with the Coverage Estimator or build your stack in the Tower Builder.
General information only. Not insurance advice.
What the first six months look like.
A breach isn't a single event — it's a sequence. Each stage pulls a different policy into the response.
Breaches, losses, and the policy that answered.
Reported incidents and clearly-labeled composite scenarios - what your underwriter is actually pricing.
One vendor zero-day. 2,700+ customers breached.
What happened: The Clop group exploited a MOVEit Transfer SQL-injection flaw (CVE-2023-34362), cascading the breach through thousands of downstream organizations' file transfers - banks, pension plans and public agencies.
Exposure it created: Tens of millions of individuals' records exposed; aggregate loss widely estimated in the billions of dollars.
Coverage that may respond: Cyber (vendor / supply-chain and contingent business interruption) and Tech E&O for downstream customer claims both engaged.
Vendor concentration is a Cyber line item now - underwrite contingency, not just your own perimeter.
Tribunal holds airline liable for its own chatbot's lies.
What happened: In Moffatt v. Air Canada, the BC Civil Resolution Tribunal found the airline vicariously liable after its chatbot invented a bereavement-fare policy, rejecting the argument that 'the chatbot is its own entity.'
Exposure it created: CAD $812.02 awarded to the customer - and a Canadian precedent tying companies to their AI's misrepresentations.
Coverage that may respond: Tech E&O with an AI / model-output endorsement may respond; standard Cyber and CGL typically will not.
An LLM feature is a representation your company can be sued for - carry AI E&O the day you ship it.
Privacy commissioners: lab breached PHIPA in 15M-record breach.
What happened: A breach exposed roughly 15 million Ontarians' and British Columbians' lab records. The Information and Privacy Commissioner of Ontario and the BC OIC jointly found LifeLabs violated PHIPA and BC's PIPA.
Exposure it created: Mandatory notification and a security overhaul, plus ongoing class-action litigation.
Coverage that may respond: Cyber & Privacy funded breach response, notification and regulatory engagement.
The PHIPA notification clock starts the moment PHI touches your systems - pre-retain breach counsel.
When the billing vendor got hit, its customers sued the startup.
What happened: A 40-person Toronto SaaS company discovered its billing vendor was a MOVEit-affected downstream victim; customer card data and contact lists required notification within days.
Exposure it created: About $380K in forensic, notification and credit-monitoring spend, plus two churned enterprise accounts.
Coverage that may respond: Cyber contingent business interruption and notification cover responded; the vendor's own policy did not indemnify the startup.
Your vendor's breach is your customer's problem - and yours. Contingent BI isn't optional at any stage.
Regulator opens inquiry days after an onboarding glitch.
What happened: A Toronto fintech's automated KYC checks mis-routed high-risk clients; FINTRAC opened an examination and an institutional investor raised questions about compliance-management cost.
Exposure it created: $1.1M in external counsel and remediation, plus a compliance monitor for 12 months.
Coverage that may respond: D&O (regulatory-investigation endorsement) and Cyber (privacy regulatory) split the defence.
Regulator inquiries trigger D&O before fines - a regulatory-defence endorsement is cheap at Series B.
Healthtech races the PHIPA clock after a misconfigured bucket.
What happened: A misconfigured cloud bucket exposed PHI for 60,000 Ontario patients; the IPC was notified and PHIPA's assessment and notification window began immediately.
Exposure it created: $650K in forensic, notification and remediation, plus a written safeguards undertaking to the IPC.
Coverage that may respond: Cyber & Privacy funded breach response, notification and regulatory engagement.
PHIPA shortens your response runway - pre-retain breach counsel before you need them.
Customer sues after the model spits out a wrong, costly number.
What happened: A Series A AI vendor's model produced materially wrong defaults for a customer, who sued for the economic loss the bad output caused downstream.
Exposure it created: $900K to defend and settle; an AI-output carve-out added to future customer contracts.
Coverage that may respond: Tech E&O with an AI model-output endorsement responded; the base E&O policy alone was ambiguous on hallucination.
Ship an LLM without an AI E&O endorsement and you're self-insuring the hallucination.
Investors sue directors after a down round wipes early shares.
What happened: After a 60% down round, early investors alleged the board overstated traction and understated runway in pre-round disclosures; a securities suit followed.
Exposure it created: $2.3M to defend, settled below the D&O tower's limits.
Coverage that may respond: D&O (Side-A / Side-B for named directors, plus securities and regulatory defence) responded within limits.
Down rounds are D&O flashpoints - keep Side-A limits dedicated and disclosures documented.
Misconfigured firewall exposes 100 million credit applications.
What happened: A single SSRF vulnerability against a misconfigured cloud instance exposed roughly 100 million US and Canadian credit applications.
Exposure it created: Settlements, fines and a $190M FTC consent order (2022) pushed total cost beyond USD $270M.
Coverage that may respond: Cyber & Privacy funded breach response, notification and settlements (where insurable).
Right-size Cyber limits to your data volume, not headcount.
Ready to build your stack?
You've learned the basics and built a stack. When you're ready, a licensed Ontario broker will walk through it with you - stage, limits and the endorsements your buyers actually require.