Security Breach
Written by Justin Goodman, CIC, CISC, CLCS, CEO and Co-Founder, Total CSR
Published: October 6, 2026 · Last reviewed: October 6, 2026
In plain language: A security breach happens when someone gets into a computer system or steals data without permission. It could be a hacker, a lost laptop, or an employee who clicks a phishing email. This event is often what starts the insurance claim process.
Technical definition: Security breach refers to unauthorized access to, acquisition of, or disclosure of a computer system, network, or the data it holds. Cyber liability and data breach policies define this term specifically in their declarations and define sections, since the exact wording controls whether a given incident triggers first-party and third-party coverage grants.
Security Breach at a Glance
| Attribute | Detail |
|---|---|
| Also known as | Data breach, cyber breach, network security breach, unauthorized access event |
| Category | Cyber liability policy trigger |
| Lines of business | Cyber Liability, Technology E&O, Commercial Crime, sometimes Commercial General Liability |
| Industries most affected | Healthcare, retail, financial services, professional services, construction, manufacturing |
| Related forms or endorsements | ISO CY 00 01 Cyber Policy Jacket; most cyber coverage is written on proprietary carrier forms |
| Who bears the risk | The business holding or processing the data, often shared with vendors and cloud providers |
| Common solution | Standalone cyber liability policy with first-party and third-party coverage grants |
| Also interacts with | Technology E&O, Commercial Crime coverage, state data breach notification statutes |
Key Takeaways
- A security breach is unauthorized access to, or theft of, a computer system or the data stored on it.
- Agencies need to understand this term because it is the trigger event that opens or closes cyber insurance coverage.
- The most common pitfall is assuming any cyber incident automatically qualifies; many policies require proof of actual unauthorized access or acquisition, not just a suspected intrusion.
- A quick win for agencies is confirming how each carrier's policy defines security breach before binding, since definitions vary significantly between cyber forms.
What Is Security Breach in Insurance?
Security breach is the triggering event that insurance carriers use to decide whether a cyber liability policy responds to a loss. Carriers created this specific definition because early general liability and crime policies were never designed to address electronic data theft, ransomware, or network intrusions. Cyber forms isolate this concept so underwriters can price it separately and insureds can understand exactly what circumstances open the door to coverage.
The legal doctrine behind this trigger borrows from both tort law and contract law. Third-party exposure arises when a breach harms someone outside the insured business, such as a customer whose credit card data was stolen, creating potential negligence claims. First-party exposure arises directly to the insured business itself, covering costs like forensic investigation, notification, and business interruption. A security breach definition in the policy ties both exposures to one triggering fact pattern.
Consider a medical billing company that stores patient records on a cloud server. An employee reuses a weak password, and a hacker gains access to the database containing thousands of patient Social Security numbers. That unauthorized access is the security breach. It triggers notification obligations under state law, potential HIPAA liability, and the insured's cyber policy, which should respond with forensic investigation costs, legal fees, notification expenses, and possibly regulatory defense costs.
Security breach differs from a simple system outage or a failed login attempt. Most cyber policies require proof that unauthorized access or acquisition actually occurred, not merely that a vulnerability existed. An unsuccessful hacking attempt that never accessed data typically does not meet the definition, even though it may feel alarming to the insured business.
How Does Security Breach Work?
- The intrusion. An unauthorized party gains access to a network, system, or dataset, often through phishing, stolen credentials, malware, or an unpatched vulnerability.
- The discovery. The insured business identifies the intrusion, either through internal IT monitoring, a third-party notification, or a ransom demand.
- The notice to the carrier. The insured reports the incident to the cyber carrier, usually through a 24-hour breach response hotline required by most cyber policies.
- The forensic investigation. A carrier-appointed forensic firm determines the scope of the breach, confirms whether protected data was actually accessed or acquired, and documents the timeline.
- The coverage response. The carrier applies first-party coverage for breach response costs and, if third parties were harmed, evaluates third-party liability coverage for resulting claims or regulatory action.
Real Claim Examples Involving Security Breach
Ransomware attack on a manufacturing plant
A mid-size manufacturer's network was encrypted by ransomware after an employee opened an infected attachment. Operations halted for nine days while the carrier's forensic team negotiated with the threat actor and restored systems from backups. The cyber policy covered the ransom negotiation, system restoration costs, and business interruption income loss, because the encryption event met the policy's security breach definition.
Stolen laptop at a financial advisory firm
A financial advisor's laptop containing unencrypted client account numbers was stolen from a parked car. Because the data was unencrypted and potentially accessible, state breach notification law required the firm to notify every affected client. The cyber policy paid for notification letters, credit monitoring services, and a call center, even though no confirmed unauthorized access to the data was ever proven.
Vendor breach affecting a contractor's payroll data
A general contractor used a third-party payroll vendor that suffered its own security breach, exposing employee Social Security numbers for several of the contractor's workers. The contractor's cyber policy included contingent business interruption and vendor breach language, so it responded to notification and credit monitoring costs even though the breach originated outside the contractor's own network.
Security Breach vs. Data Breach: What Is the Difference?
Security breach and data breach are often used interchangeably, but they are not identical concepts in a policy context. Security breach is the broader trigger describing unauthorized access to a system, while data breach more narrowly refers to the compromise of specific protected information, such as personal data or payment card numbers.
| Comparison area | Security Breach | Data Breach |
|---|---|---|
| Primary use case | Defines the triggering event for cyber policy response | Defines the specific category of compromised information |
| Coverage / concept type | System or network-level unauthorized access | Subset involving personal or protected data exposure |
| Typical exclusions | Attempted but unsuccessful intrusions, internal system errors without access | Breaches that do not involve personally identifiable or regulated data |
| Who is most affected by errors | Insureds relying on broad cyber coverage assumptions | Insureds in regulated industries like healthcare and finance |
| Common mistakes | Assuming any IT problem is a covered breach | Assuming data breach notification laws and insurance definitions align exactly |
What Are the Most Common Mistakes With Security Breach?
- Agencies sometimes assume a generic Commercial General Liability policy will respond to a security breach; most CGL forms exclude electronic data loss, leaving the insured with no coverage.
- Clients often believe any suspicious activity qualifies as a covered breach, but most policies require proof of actual unauthorized access or acquisition, not just a vulnerability scan finding.
- Producers frequently fail to compare how different carriers define security breach, and a narrow definition can exclude incidents a client reasonably expected to be covered.
- Agencies sometimes skip confirming the policy's notification deadline, and late reporting under a claims-made cyber form can jeopardize coverage entirely.
- CSRs occasionally overlook contingent or vendor breach coverage, leaving clients exposed when a third-party vendor, not the insured's own network, suffers the breach.
- Agencies rarely verify sublimits on notification costs, credit monitoring, and regulatory fines, which can be far lower than the overall policy limit and surprise the client after a loss.
How to Explain Security Breach to a Client
Explaining security breach to a personal lines client
A security breach means someone got into your information or accounts without permission, like a hacker stealing your email password or your bank card number being used without your consent. Personal cyber coverage can help pay for things like identity restoration services and fraud-related losses. We can talk about whether adding that protection to your homeowners policy makes sense for you.
Explaining security breach to a small business owner
A security breach is when someone accesses your business's computer systems or customer data without permission, whether through hacking, a stolen device, or an employee mistake. If that happens, you may have to notify customers, hire forensic experts, and defend against lawsuits, and those costs add up fast. A cyber liability policy is built specifically to cover those expenses so one bad click does not sink your business.
Explaining security breach to a CFO or risk manager
Security breach is the defined trigger in your cyber policy that determines whether coverage responds to an incident, and the exact wording varies by carrier. We need to review how your current form defines unauthorized access and acquisition, confirm your notification deadline, and check whether vendor and contingent business interruption exposure is addressed. Given your data volume and regulatory exposure, I recommend we stress-test the definition against your actual risk profile before renewal.
Frequently Asked Questions About Security Breach
What counts as a security breach for insurance purposes?
A security breach typically means unauthorized access to, or acquisition of, a computer system or the data it contains. The exact threshold depends on the policy's specific definition, so an attempted intrusion that never actually accessed data may not qualify under some forms.
Does a lost laptop count as a security breach?
A lost or stolen device containing unencrypted sensitive data often triggers breach notification obligations under state law, even without confirmed unauthorized access. Most cyber policies will treat this as a covered event because the potential for data exposure exists, regardless of whether anyone actually viewed the data.
Will General Liability cover a security breach?
Standard Commercial General Liability policies generally exclude electronic data loss and most cyber-related claims. A business needs a standalone cyber liability policy or a cyber endorsement to respond to notification costs, forensic investigation, and third-party liability arising from a security breach.
How fast does a business need to report a security breach to its insurer?
Reporting timelines vary by carrier, but many cyber policies require notice within 24 to 72 hours of discovering a breach, especially for ransomware events. Delayed reporting on a claims-made form can jeopardize coverage, so agencies should confirm the exact deadline with the client at policy issuance.
Does a security breach always trigger notification to customers?
State data breach notification laws vary, and notification is typically required only when specific categories of personal information, like Social Security numbers or financial account data, are involved. A security breach that exposes only non-regulated information may not require customer notification even though it still represents a coverage trigger under the cyber policy.
Can a vendor's security breach affect my client's coverage?
A vendor's breach can affect the insured's business even though the intrusion happened outside their own network, especially when the vendor stored or processed the insured's data. Agencies should confirm the cyber policy includes contingent business interruption and vendor breach language, since not every policy extends coverage to third-party vendor incidents automatically.
Related Insurance Terms
- Data Breach: The compromise of specific personal or protected information, often a subset of a broader security breach that triggers state notification laws.
- Cyber Liability Insurance: The standalone policy type built specifically to respond to security breaches, covering both first-party response costs and third-party liability.
- Privacy Liability: Coverage for claims arising from the failure to protect personal information, frequently triggered by the same security breach event.
- Network Security Liability: Third-party coverage responding to claims that a failure in the insured's network security caused harm to others, such as spreading malware.
- First-Party Cyber Coverage: Policy provisions paying the insured's own breach response costs, including forensic investigation, notification, and business interruption after a security breach.
- Third-Party Cyber Coverage: Policy provisions defending and indemnifying the insured against lawsuits filed by people harmed by a security breach, such as affected customers.
Sources and References
- National Association of Insurance Commissioners (NAIC). Cyber Insurance Basics.
- Federal Trade Commission. Data Breach Response: A Guide for Business.
About the Author
Justin Goodman, CIC, CCIP, CISC, CLCS, CRIS, PCIA, QCLS, MFHR CEO and Co-Founder, Total CSR, Inc.
Justin Goodman is a third-generation insurance broker with over two decades in agency operations. He has trained more than 100,000 CSRs, account managers, and producers in commercial and personal lines coverage, from workers' compensation to construction risk. He was named 2024 Insurance Journal Agent of the Year and one of the nation's top five construction insurance experts by Risk & Insurance. He is the author of Retain, which applies cognitive science research on memory and knowledge transfer to insurance training, and speaks nationally on how agencies build durable technical expertise in their teams.