Your company runs on technology. So do many of its risks.
Cyber & Privacy liability is designed to help cover breach response, ransomware, forensics, regulatory fines under PIPEDA, GDPR and PHIPA, and the business interruption that follows. For a technology company it's often the first policy to trigger - and a natural entry point into the rest of your insurance stack.
Covered sections in solid line. The hatched strip is what this policy leaves exposed — click through to see if it applies to you.
The cover that lives inside this policy.
First-party breach response - forensics, legal, notification and credit monitoring
Ransomware payments, negotiation and recovery
Regulatory fines & investigations (PIPEDA, GDPR, PHIPA)
Third-party claims from customers whose data you held
Business interruption & contingent BI from vendor breaches
Cyber extortion and social-engineering fraud
First-party breach response - forensics, legal, notification and credit monitoring
Ransomware payments, negotiation and recovery
Regulatory fines & investigations (PIPEDA, GDPR, PHIPA)
Third-party claims from customers whose data you held
Business interruption & contingent BI from vendor breaches
Cyber extortion and social-engineering fraud
Vertical-specific risk breakdown.
The same policy prices differently the moment you leave "software company" behind.
PCI-DSS and FINTRAC exposure; wire-fraud and BEC are the top severity drivers.
PHI triggers PHIPA; breach windows are tight and the IPC enforces with real teeth.
High user volume means record-count-driven settlements scale fast.
You're the supply chain - one compromised release is contingent BI for every customer.
Breaches, losses, and the policy that answered.
Reported incidents and clearly-labeled composite scenarios - what your underwriter is actually pricing.
One vendor zero-day. 2,700+ customers breached.
What happened: The Clop group exploited a MOVEit Transfer SQL-injection flaw (CVE-2023-34362), cascading the breach through thousands of downstream organizations' file transfers - banks, pension plans and public agencies.
Exposure it created: Tens of millions of individuals' records exposed; aggregate loss widely estimated in the billions of dollars.
Coverage that may respond: Cyber (vendor / supply-chain and contingent business interruption) and Tech E&O for downstream customer claims both engaged.
Vendor concentration is a Cyber line item now - underwrite contingency, not just your own perimeter.
Privacy commissioners: lab breached PHIPA in 15M-record breach.
What happened: A breach exposed roughly 15 million Ontarians' and British Columbians' lab records. The Information and Privacy Commissioner of Ontario and the BC OIC jointly found LifeLabs violated PHIPA and BC's PIPA.
Exposure it created: Mandatory notification and a security overhaul, plus ongoing class-action litigation.
Coverage that may respond: Cyber & Privacy funded breach response, notification and regulatory engagement.
The PHIPA notification clock starts the moment PHI touches your systems - pre-retain breach counsel.
When the billing vendor got hit, its customers sued the startup.
What happened: A 40-person Toronto SaaS company discovered its billing vendor was a MOVEit-affected downstream victim; customer card data and contact lists required notification within days.
Exposure it created: About $380K in forensic, notification and credit-monitoring spend, plus two churned enterprise accounts.
Coverage that may respond: Cyber contingent business interruption and notification cover responded; the vendor's own policy did not indemnify the startup.
Your vendor's breach is your customer's problem - and yours. Contingent BI isn't optional at any stage.
Regulator opens inquiry days after an onboarding glitch.
What happened: A Toronto fintech's automated KYC checks mis-routed high-risk clients; FINTRAC opened an examination and an institutional investor raised questions about compliance-management cost.
Exposure it created: $1.1M in external counsel and remediation, plus a compliance monitor for 12 months.
Coverage that may respond: D&O (regulatory-investigation endorsement) and Cyber (privacy regulatory) split the defence.
Regulator inquiries trigger D&O before fines - a regulatory-defence endorsement is cheap at Series B.
Healthtech races the PHIPA clock after a misconfigured bucket.
What happened: A misconfigured cloud bucket exposed PHI for 60,000 Ontario patients; the IPC was notified and PHIPA's assessment and notification window began immediately.
Exposure it created: $650K in forensic, notification and remediation, plus a written safeguards undertaking to the IPC.
Coverage that may respond: Cyber & Privacy funded breach response, notification and regulatory engagement.
PHIPA shortens your response runway - pre-retain breach counsel before you need them.
Misconfigured firewall exposes 100 million credit applications.
What happened: A single SSRF vulnerability against a misconfigured cloud instance exposed roughly 100 million US and Canadian credit applications.
Exposure it created: Settlements, fines and a $190M FTC consent order (2022) pushed total cost beyond USD $270M.
Coverage that may respond: Cyber & Privacy funded breach response, notification and settlements (where insurable).
Right-size Cyber limits to your data volume, not headcount.
You rarely buy Cyber & Privacy alone.
Cyber + Tech E&O is the standard blend - most tech claims touch both data exposure and product failure.
Explore Tech E&OA serious breach can trigger investor and regulator scrutiny of the board directly.
Explore Management D&OCyber & Privacy is one piece of the stack. Depending on your business model, other exposures may also be worth considering — bring them together in the Tower Builder.
Keep exploring
The questions founders ask before they bind.
Still not sure what applies to you?
This page covers the basics of Cyber & Privacy. For a plan specific to your stack and stage, Truly Insurance's brokers can walk you through it - no pressure, no jargon. You can also reach the team directly at trulyinsurance.ca.
Talk to an Advisor