Cyber liability insurance claims from Canadian small businesses in 2026 have ranged from $25,000 for a DDoS attack to more than $250,000 for ransomware. Below are six real claims we resolved for clients this year – what happened, what it cost, and which coverage paid out.
No business or industry is immune to the threat of cyberattacks and data breaches, even highly knowledgeable technology industry experts.
AI-driven attacks have made phishing emails harder to spot and ransomware faster to deploy. Small businesses feel it first. A Zensurance survey of 1,000 Canadian small business owners found more than half (53%) had experienced an attack last year.
Strong defences matter. But defences fail, and when they do, cyber liability insurance is what stands between an incident and a six-figure hole in your bank account.
The six claims below all come from technology businesses, which makes them worth a close look: if the companies that live inside these systems can get hit, so can a clinic, a consultancy, or a contractor with a customer database.
The claims at a glance:
- Phishing/fraudulent transfer: $100,000
- Data breach exposing health records: $120,768
- Third-party app compromise: $106,678
- Ransomware attack: $250,000+
- DDoS attack: $25,000+
- Ransomware found during a security audit: $60,000+
1. A Phishing Email Cost This Business $100,000
Industry: Software Development
Claim Payout: $100,000
Coverage that responded: Social engineering fraud
A fraudster phished their way into our client’s account and transferred money straight out of it. No malware, no sophisticated intrusion. Just a convincing email and one wrong click.
Because they’d added social engineering fraud and funds transfer fraud coverage to their cyber liability policy, they were reimbursed the full $100,000.
Why it matters: social engineering fraud is often an add-on, not standard. If your policy doesn’t name it, a wire transfer to a fake supplier may not be covered.
2. Stolen Health Records Triggered a $120,768 Breach Response
Industry: Technology (SaaS)
Claim Payout: $120,768.33
Coverage that responded: Breach response, legal defence, forensics
Our client, a SaaS analytics provider, had their customers’ personal health data stolen. Health records are among the most sensitive data you can hold, and the response was correspondingly expensive: privacy lawyers, cyber forensics specialists, and the work of figuring out exactly whose information was exposed.
Their cyber liability policy covered the full $120,768.33.
Why it matters: the more sensitive your data, the higher your breach response costs, and that applies to any business holding health, financial, or identity information.
3. A Third-Party App Gave a Hacker a Way In: $106,678
Industry: Technology (web development)
Claim Payout: $106,678
Coverage that responded: Forensics, legal defence, business interruption
One of our web developer clients got an alert from an e-commerce platform they integrate with that applications connected to their account were accessing the platform’s API through the Tor network. That’s not normal behaviour, and it’s not something you catch on your own.
The platform’s investigation turned up evidence that a threat actor had accessed sensitive information, including personally identifiable information sitting in our client’s system.
Their cyber liability policy paid $106,678, covering the forensic investigation, legal assistance, and the hit to their business income while they sorted it out.
Why it matters: you can do everything right and still get breached through a vendor, a plugin, or an integration you didn’t build.
4. Ransomware Locked Down an IT Provider’s Data: $250,000+
Industry: Technology (managed services)
Claim Payout: $250,000+
Coverage that responded: Cyber extortion, forensics, data recovery
Our client is a managed service provider – the company other businesses call when their technology breaks. Attackers encrypted their confidential data and demanded a ransom to release it.
Their cyber extortion coverage paid more than $250,000 to investigate the attack, protect their remaining assets, and get their data back.
Why it matters: this was the most expensive claim on the list, and ransomware doesn’t check whether you’re an IT company or a bakery before it encrypts your files.
5. A DDoS Attack Took a Web Designer’s Sites Offline: $25,000+
Industry: Web Design
Claim Payout: $25,000+
Coverage that responded: Business interruption, incident response
A distributed denial of service (DDoS) attack hit our client and their customers. DDoS attacks flood a website with junk traffic until it buckles, and the downtime costs everyone involved real income.
Their cyber liability insurance covered more than $25,000 to investigate the attack, shut it down, and replace part of the lost income.
Why it matters: no data was stolen here. If your website is how customers find you or pay you, downtime alone is a covered loss.
6. A Routine Audit Uncovered Hidden Ransomware: $60,000+
Industry: Software Development
Claim Payout: $60,000+
Coverage that responded: Forensics, system remediation
During a routine cybersecurity audit, one of our software development clients found ransomware already sitting in their systems. No demand had arrived yet. They had no idea whether customer data had been touched.
Their policy covered more than $60,000 to run the forensic investigation, determine whether customer data was compromised, remove the ransomware, and lock down their systems.
Why it matters: you don’t need a ransom demand to have a claim. The cost of finding out what happened is a covered loss on its own.
What These Cyber Claims Have in Common
Look past the industry labels and the pattern is hard to miss.
Not one of these businesses was careless. They build software, manage networks, and run security audits for a living. They still got hit.
Four of the six claims cost more than $100,000 – enough to end a small business that’s self-funding its recovery. And the losses weren’t all about stolen data. Two of them were about downtime and disruption.
Most of the money went to things you can’t do yourself: forensic investigators, privacy lawyers, negotiators, and system remediation. That’s what a cyber policy actually buys, and not just a cheque, but the people who show up.
Frequently Asked Questions About Cyber Liability Insurance in Canada
What is cyber liability insurance?
Cyber liability insurance covers the costs your business faces after a data breach, ransomware attack, or other cyber incident. That includes breach response, legal fees, notifying affected customers, credit monitoring, business interruption losses, and third-party claims if someone sues you over their compromised data. Many policies come bundled with 24/7 incident response – forensic IT specialists, breach coaches, and privacy lawyers you’d otherwise have to find yourself.
Does a small business really need cyber liability insurance?
Yes – if you collect customer data, take online payments, use email and social media, have a website, or store anything on a cloud service. Small businesses aren’t flying under the radar. They’re targeted precisely because they usually have weaker defences and fewer people watching.
Does cyber liability insurance cover ransomware?
Most Canadian cyber policies include cyber extortion coverage, which can pay a ransom demand, but only with the insurer’s prior approval and typically after their negotiators get involved. Coverage also extends to investigation, data recovery, and system remediation, whether or not a ransom is ever paid.
How much does cyber liability insurance cost in Canada?
Premiums for most Canadian small businesses land in the low four figures annually, though your actual cost depends on revenue, industry, the volume and sensitivity of data you hold, your coverage limit, and the security controls you have in place. The easiest way to find out what a cyber liability insurance policy may cost you is to get a free quote.
Does my general liability policy already cover cyber incidents?
Almost certainly not. Commercial general liability responds to bodily injury and physical property damage. Data isn’t tangible property, so a general liability policy generally won’t pay for a breach, and many now carry explicit cyber exclusions.
What isn’t covered by cyber liability insurance?
Standard exclusions may include losses from known vulnerabilities you failed to patch, insider theft by an owner or director, bodily injury and property damage, and the cost of upgrading your systems after an incident. Insurance restores you to where you were. It doesn’t fund an IT overhaul.
Am I legally required to report a data breach in Canada?
In many cases, yes. Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), organizations must report a breach of security safeguards to the Office of the Privacy Commissioner and notify affected individuals when the breach creates a real risk of significant harm. You must also keep records of all security incidents for at least 24 months, whether or not they triggered reporting.
Get Cyber Liability Insurance in Minutes
Cyberattacks don’t send warnings, and they don’t check what industry you’re in. Cyber liability insurance covers the risks tied to your technology systems and your customers’ data, which, these days, is every business.
Fill out our online application now for a free quote in minutes.
Our brokers are business insurance experts. They will shop our partner network of 50+ insurers to get the right type of cyber coverage your business needs, customize it to suit your budget, and issue your policy documents and a certificate of insurance.
– Reviewed by Mohammad Samin, Sr. Claims Advisor, and Brandon Bowie, Sr. Broker and Team Lead, Professional Lines, Zensurance.
Related Posts
Categories
Related Posts
6 Real Cyber Insurance Claims Canadian Small Businesses Filed in 2026
Phishing, ransomware, and DDoS attacks keep evolving, and Canadian small businesses are squarely in cybercriminals' crosshairs. Here are six real claims we helped clients recover from – payouts from $25,000 to more than $250,000 – and what they mean for your business, whatever industry you're in.
What Type of Insurance Do Software Developers Need?
Software developers build the systems everything else runs on, and carry the liability when something breaks. Here's the coverage Canadian devs, freelancers, and dev shops actually need, and what each policy does when a claim lands.
How Much Is Commercial Vehicle Insurance in Canada?
The cost of commercial vehicle insurance in Canada varies by insurer. Here's what drives your rate, why business vehicles cost more to insure than personal ones, and how to keep your premium down.