This crucial section covers the costs of getting your data and applications repaired, restored, or recreated where your computer systems are damaged, corrupted, encrypted, deleted, or rendered inaccessible as a result of a cyber event.

It also reimburses your loss of income, and the increased cost of working incurred to keep operating, as a result of interruption to your operations caused by a cyber event, a system failure, or prolonged downtime — including an outage at a third-party technology provider your business depends on. Cover applies once the interruption exceeds the waiting period stated in the policy, and continues for the indemnity period.

Employees at businesses of all sizes may not recognize a phony link, a spoofed invoice, or a malicious attachment for what it is. This section responds when that leads to financial loss: funds transfer fraud, where money is moved out of your accounts without authorization; social engineering fraud, where an attacker impersonates a supplier, a client, a senior executive, or your bank to induce your staff to send money or change payment details; theft of your funds or of funds you hold for others; and misuse of your telephone or cloud accounts to run up charges.

Where an attacker threatens to publish, sell, or withhold access to data they have accessed, extortion cover responds to the negotiation, specialist, and settlement costs, subject to sanctions screening.

This section covers third party claims arising out of a network security or privacy event — whether your transmission of malware to a third party’s systems, an unauthorized access or denial-of-service condition affecting others, or a failure to prevent the loss, theft, or unauthorized disclosure of personal information, including personal information held on your behalf by a supplier or cloud provider.

It also covers the costs of responding to and defending an investigation or inquiry by the Office of the Privacy Commissioner of Canada or a provincial privacy or health information commissioner, and any resulting fines or penalties to the extent they are insurable by law. Where you accept payment cards, it further covers PCI DSS contractual fines, penalties, and card brand or payment network assessments levied under your merchant agreement — particularly important for retail businesses.