A bookkeeper at a six-person landscaping company outside Decatur opened an invoice email that looked exactly like it came from a regular supplier and paid it without a second thought. It wasn't the supplier. By the time the real invoice arrived a week later, the money was gone, the company's bank was unwilling to reverse it, and the owner discovered that his general liability and commercial auto policies, the two coverages he'd always considered thorough, had nothing to say about any of it.
Cyber liability insurance covers the costs a data breach, ransomware attack, or invoice fraud scheme creates: notifying affected customers, forensic investigation, business interruption, and in many cases the stolen funds themselves. A standard general liability or commercial property policy generally excludes these losses, since they were never written to cover digital fraud or data exposure.
Most small business owners assume cyber insurance is for companies big enough to be worth hacking. Criminals running these schemes at scale don't share that assumption, and neither should the business. The exposure also isn't limited to money moved out the door; a breach that exposes customer records can trigger a lawsuit large enough to run past a standard liability limit, the same way excess liability coverage exists to backstop a serious bodily-injury claim.
Small doesn't mean invisible
Automated attacks don't pick targets by company size. Scanning software probes thousands of small business email systems and networks a day looking for the same handful of weaknesses: an unpatched system, a password reused from another breach, or an employee who can be tricked into clicking a link or approving a fraudulent payment. A six-person landscaping company and a six-hundred-person manufacturer look identical to that kind of automated attack, and the six-person company is usually the easier target. An
independent agent in Decatur sees this play out across small landscaping crews, retail shops, and one-truck contractors alike, since none of them are large enough to assume they are beneath an automated attacker's notice.
Businesses that handle any customer payment information, store any customer data at all, or simply send and receive invoices by email, which describes nearly every small business in Texas, carry real exposure whether or not anyone in the building thinks of the company as a technology business.
What actually triggers a claim
First-party costs. The business's own direct losses: money paid out to a fraudulent invoice, the cost of a forensic IT investigation, system restoration after ransomware, and the business income lost while systems are down.
Third-party costs. Costs owed to others because of the breach: notifying customers whose data was exposed, credit monitoring for affected individuals, and legal defense if a customer or vendor sues over the exposure.
A single incident routinely triggers both categories at once. The landscaping company's invoice fraud was a first-party loss, but if customer payment data had also been exposed in the same intrusion, notification costs and potential legal exposure would have stacked on top of the stolen funds.
Why the legal exposure can run past a standard limit
A data breach lawsuit behaves a lot like any other liability claim once it reaches a courtroom: legal defense costs accumulate whether or not the business is ultimately found at fault, and a large enough class of affected customers can turn a single incident into a claim that tests a standard policy limit fast. Businesses that already carry
excess liability coverage on top of their general liability policy, specifically to handle a claim that outgrows an underlying limit, are thinking about exactly the right kind of exposure, even if they've never connected that same logic to a data breach specifically.
Cyber liability and excess liability aren't the same coverage and don't replace each other, but a business carrying one without asking about the other is often protecting against the wrong version of a large claim.
Where general liability actually stops
General liability insurance responds to bodily injury and property damage to third parties, which is exactly why it has nothing to offer a data breach or a wire fraud loss. Commercial property coverage protects physical assets, not digital ones. A business owners policy that bundles the two still leaves this specific gap open unless a cyber endorsement or standalone cyber policy is added on top.
A business owner can confirm, in plain terms, whether cyber exposure is covered anywhere in an existing package by asking directly rather than assuming, since a lot of business owners genuinely don't know the answer until something happens and they go looking for it in the fine print.
Basic habits that make a policy work harder
Coverage responds better, and sometimes underwriting requires it in the first place, when a few habits are already in place. Multi-factor authentication on email and financial accounts closes off the single most common entry point criminals use. A written policy requiring a phone call to a known number before wiring money or paying an invoice over a certain size would have stopped the landscaping company's loss cold. Regular data backups, kept separate from the main network, limit how much leverage a ransomware attack actually has.
None of those habits replace the coverage; they just make a claim less likely and, often, less expensive when a carrier is pricing the policy in the first place. Underwriters increasingly ask about these specific practices before quoting a policy at all, which means a business with none of them in place may find coverage harder to obtain, not just more expensive, until at least the basics are addressed.
Sizing coverage to what the business actually handles
The right coverage amount depends less on company size and more on what kind of data and money moves through the business day to day. A company processing frequent customer payments or storing sensitive personal information generally needs a higher limit than a business with minimal digital footprint, even if the two companies are otherwise similar in size and revenue. A landscaping company sending a handful of invoices a week has a different exposure profile than a retailer running customer credit cards daily, and the coverage amount should reflect that difference rather than a generic industry default.
The landscaping company owner added cyber coverage within a month of the fraud, alongside the phone-verification policy his bookkeeper now follows for every invoice over a modest threshold. Getting a
business insurance quote that specifically addresses this gap, before an invoice like that one lands in an inbox, is the version of this story that ends with a phone call instead of an empty bank account.
Call
(800) 666-2254 — or text
QUOTE to
(817) 646-6700 · tapinsuretx.com
Educational only; coverages and availability vary by carrier. TAP Insurance Agency, PLLC — Rhome, TX, licensed in Texas and Oklahoma.
