Quick Answer: What does cyber insurance actually cover for law firms?
Cyber insurance covers two main categories: first-party costs (your firm's direct losses) and third-party liability (lawsuits and regulatory actions from others). Most law firm policies cost $95–$1,250/mo depending on firm size and limits.
First-Party Coverage: Your Firm's Direct Losses
First-party coverage pays for your firm's own costs when a cyber incident hits. This is the "your building caught fire" equivalent for the digital world.
Data Breach Response
When client data is compromised, the clock starts ticking. Cyber insurance covers:
- Forensic investigation — Hiring specialists to determine what happened, what data was exposed, and how to stop it
- Legal counsel — Privacy attorneys to navigate state notification laws (all 50 states have different requirements)
- Client notification — Letters, call centers, and communication to every affected individual
- Credit monitoring — Typically 12-24 months for affected clients
- Public relations — Crisis management to protect your firm's reputation
For law firms, breach response is critical because you hold privileged communications and client trust account data. The average cost of a data breach in legal services is $4.7 million (IBM, 2025).
Ransomware & Cyber Extortion
Ransomware is the #1 cyber threat to law firms. Coverage includes:
- Ransom payments — If your firm decides to pay (carrier will advise)
- Ransom negotiation — Professional negotiators who deal with threat actors
- System restoration — Rebuilding servers, recovering data from backups
- Business interruption — Lost revenue while your systems are down
⚠️ Important: Some policies exclude ransomware payments to sanctioned entities. Ask your carrier about OFAC compliance.
Business Interruption
When a cyber attack takes your systems offline, business interruption coverage pays for:
- Lost revenue — Billable hours you can't log while systems are down
- Extra expenses — Temporary IT infrastructure, overtime costs
- Dependent business interruption — Losses from your cloud provider or legal software going down
Data Recovery
- Restoring corrupted files — Case documents, client records, financial data
- Rebuilding databases — Practice management and billing systems
- Hardware replacement — If devices are compromised beyond repair
Get quotes from Hartford, Chubb, CNA & more →
Third-Party Coverage: Liability to Others
Third-party coverage protects your firm when clients, regulators, or other parties come after you because of a cyber incident.
Client Lawsuits
When client data is breached, lawsuits follow. Coverage includes:
- Defense costs — Attorney fees, expert witnesses, court costs
- Settlements and judgments — Payments to affected clients
- Class action defense — If multiple clients are affected
For law firms, this is especially important because a breach may also trigger malpractice claims — arguing that your firm failed to protect privileged information as required by professional duty.
Regulatory Defense & Fines
- State attorney general investigations — All 50 states can investigate data breaches
- Federal regulatory actions — FTC, SEC (if you handle securities work)
- State bar proceedings — Potential disciplinary actions for failing to protect client data
- HIPAA penalties — If your firm handles health-related cases with protected health information
- PCI fines — If credit card data from trust accounts is exposed
Media Liability
- Defamation claims arising from breach notification communications
- Privacy violation lawsuits from individuals whose data was exposed
What Cyber Insurance Does NOT Cover
Understanding exclusions is just as important as knowing what's covered:
| Exclusion | Why It Matters |
|---|---|
| Prior known incidents | If you knew about a vulnerability before buying the policy |
| Unencrypted device losses | Some carriers exclude breaches from unencrypted laptops/phones |
| War/terrorism | Nation-state attacks may be excluded (check your policy) |
| Intentional acts | Deliberate data theft by firm partners or employees |
| Infrastructure failures | Power outages, ISP failures (not cyber attacks) |
| Bodily injury/property damage | Covered by GL, not cyber |
💡 Pro tip: Ask carriers about their retroactive date — this determines how far back coverage extends for incidents that occurred before the policy start date.
How Coverage Limits Work
Cyber insurance uses two key limits:
- Per-occurrence limit — Maximum payout for a single incident
- Aggregate limit — Maximum total payout in the policy period
Recommended Limits by Firm Size
| Firm Size | Recommended Limit | Est. Monthly Cost |
|---|---|---|
| Solo / 2-3 attorneys | $1M / $1M | $95–$200/mo |
| Small firm (4-10) | $2M / $2M | $200–$500/mo |
| Mid-size firm (11-50) | $5M / $5M | $500–$1,250/mo |
Related Guides
- 📋 Law Firm Cyber Insurance: Top Carriers Compared — Full carrier comparison with pricing
- 💰 How Much Does Cyber Insurance Cost for Law Firms? — Detailed pricing breakdown
- 📦 Cyber + E&O Bundles for Law Firms — Save by combining policies
- ⚖️ ABA Cyber Insurance Compliance Guide — Meet Rule 1.6(c) requirements
Next Steps
The best way to understand what a policy covers is to compare actual quotes. Different carriers include different coverage modules, limits, and pricing.
Compare quotes from Hartford, Chubb, CNA, Hiscox & more →
Related Coverage Pages
- Cyber insurance for law firms — ABA-compliant cyber coverage for attorneys
- Data breach insurance — Forensics and notification for client data breaches
- Cyber insurance — Compare general cyber policies from top carriers
Ready to lock down your firm? Compare cyber quotes →
The Cyber + E&O Bundle for Law Firms: Why Most Firms Need Both
Cyber insurance and legal malpractice (E&O) coverage are often sold separately, but most law firms need both — and buying them together saves 10–20% versus two standalone policies.
The coverage gap that bundles close:
- Cyber insurance pays for breach response, ransomware, and system restoration
- Legal malpractice (E&O) pays when a client sues for professional negligence
- The gap: a breach that causes client harm leads to a client lawsuit — cyber pays the breach response costs, but malpractice covers the resulting lawsuit itself
| Coverage | Standalone Cost | Bundle Cost | Savings |
|---|---|---|---|
| Cyber ($2M limit) | $4,500–$8,000/yr | — | — |
| Legal malpractice E&O ($2M limit) | $3,000–$7,500/yr | — | — |
| Combined bundle | $7,500–$15,500/yr | $6,500–$12,000/yr | 10–20% |
Carriers offering strong law firm bundles: Chubb (via its Management Liability suite), CNA (ProTech® for law firms), and Hartford Spectrum.
ABA Rule 1.6(c): Your Professional Obligation to Have Cyber Insurance
ABA Model Rule 1.6(c) requires lawyers to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."
ABA Formal Opinion 477R (2017) identified these minimum reasonable cybersecurity measures for attorneys:
- Using encryption for email and file transfers containing client data
- Implementing multi-factor authentication on all firm accounts
- Having an incident response plan — and a cyber policy with an incident response retainer is central to executing that plan
- Training staff on phishing and social engineering threats
How cyber insurance satisfies Rule 1.6(c): A cyber policy with incident response retainer coverage demonstrates that you have engaged professionals — forensic investigators, breach counsel, notification specialists — ready to respond to unauthorized access. State bar ethics opinions in 45+ states have adopted the ABA framework; California, New York, and Illinois have issued opinions specifically requiring documented cyber response planning.
State bar discipline risk: A breach without an adequate response plan is not just bad for clients — it can trigger a Rule 1.6 disciplinary proceeding. Carriers like CNA and Chubb provide coverage documentation for ethics compliance purposes upon request.
Carrier Comparison: Best Cyber Insurance for Law Firms (2026)
| Carrier | Starting Cost | Key Strength | Best For |
|---|---|---|---|
| Chubb | $3,500–$8,000/yr | Highest limits; ABA compliance documentation | Larger firms (10+ attorneys) |
| Hartford | $2,500–$6,000/yr | Strong claims handling; bundles with malpractice | Small to mid-size firms (1–15 attorneys) |
| CNA | $2,800–$6,500/yr | ProTech® includes legal malpractice + cyber | Firms wanting one carrier for both coverages |
| Hiscox | $1,800–$4,500/yr | Competitive pricing; fast online quoting | Solo to small firms prioritizing cost |
| Coalition | $2,000–$5,000/yr | Active risk monitoring; breach prevention tools | Tech-forward firms with cloud-based practices |
Premium factors specific to law firms:
- Number of attorneys and staff with access to client data
- Annual revenue (billing volume correlates with data exposure)
- Practice areas handled (financial, healthcare, IP, criminal defense = higher risk)
- Whether the firm handles e-discovery or digital forensics for clients
- Claims history in the past five years
Frequently Asked Questions
Does cyber insurance cover a phishing attack on a law firm?
Yes — phishing attacks that lead to unauthorized access to firm systems, client data, or email accounts are covered under most cyber policies' data breach and business interruption modules. Social engineering coverage (wire fraud, BEC scams) is typically a sublimit you should confirm is included; it is sometimes capped at $100,000–$250,000.
What is the difference between cyber insurance and legal malpractice for a law firm?
Cyber insurance covers the costs of responding to a breach: forensics, client notification, ransom negotiations, business downtime. Legal malpractice (E&O) covers lawsuits from clients claiming you caused financial harm through negligence. A single breach event can trigger both coverages — the breach response is a cyber claim; the subsequent client lawsuit is a malpractice claim.
Does cyber insurance cover client trust account fraud?
Partially. If a hacker diverts funds from billing or trust account systems, cyber insurance may cover it under a social engineering or funds transfer fraud sublimit — often capped at $250,000–$500,000. This may fall well below the exposure for a mid-size firm. Always review crime coverage as a separate layer.
Do solo attorneys need cyber insurance?
Yes. Solo practitioners are targeted precisely because they typically have fewer defenses than large firms. A solo attorney holding 50+ client files containing SSNs, financial data, or health records faces significant exposure under all 50 states' data breach notification laws. Policies start as low as $95–$150/month for solos with $1M limits from Hiscox and Hartford.
Compare quotes from Chubb, Hartford, CNA, Hiscox & Coalition →