Industry Insight
BEC attacks on law firm trust accounts are one of the fastest-growing cyber claims in NZ.
Why Legal Businesses Need Cyber Insurance
Legal firms are high-value targets due to client privilege, trust account access, and commercial deal data. A breach of client confidentiality can result in professional indemnity claims, Law Society disciplinary action, and client loss. Trust account fraud via business email compromise is a growing threat.
The Privacy Act 2020 introduced mandatory breach notification obligations for all businesses that hold personal information. When a breach is likely to cause serious harm, you must notify both the Office of the Privacy Commissioner and affected individuals — a process that requires legal guidance and carries real cost. Cyber insurance covers those obligations and puts expert advisors in your corner from the moment an incident occurs.
We make this straightforward. We compare policies from multiple insurers, explain what's actually covered in plain language, and personally vet the brokers we recommend — so you get the right protection without having to wade through complex policy documents yourself. CERT NZ data shows the average data breach costs businesses $173,000 — cover starts from a fraction of that.
Top Cyber Risks for Legal Businesses
- 1Trust account fraud (BEC)
This is consistently the most reported and highest-cost cyber loss type for Legal businesses in New Zealand.
- 2Client confidential data breach
- 3Ransomware locking case management systems
- 4Privileged communications theft
- 5Law Society regulatory action
Recommended Coverage for Legal Businesses
The following coverage types are most relevant for Legal businesses based on sector-specific risk profiles. Your broker will confirm which apply to your specific situation.
For a full explanation of each coverage type, see our Coverage Guide.
How Cyber Insurance Claims Work for Legal Businesses
If you experience a cyber incident, follow these steps. Your insurer — not this website — is your primary resource. Contact them first.
Call Your Insurer Immediately
Contact your insurer's 24/7 breach hotline the moment you suspect an incident. Do not attempt to restore systems, wipe devices, or notify customers until you have spoken with them. Delays can affect your claim.
Incident Triage & Response Team Deployment
Your insurer deploys a specialist incident response team — typically forensic investigators, legal counsel, and a breach coordinator. They assess scope, contain the attack, and advise on next steps.
Investigation & Notification
If personal data was compromised, your legal team advises on Privacy Act notification obligations. Your insurer covers the cost of notifying the Privacy Commissioner and affected individuals.
Recovery & Restoration
Systems are restored, data recovered where possible, and business interruption losses are calculated. PR and reputation management support is provided if required. Your claim is assessed and settled.
What Cyber Insurers Look For When Assessing Legal Businesses
Insurers assess your security posture before offering cover. The following controls are commonly evaluated — and having them in place typically reduces your premium:
Multi-Factor Authentication (MFA)
Required on all email accounts, remote access and cloud systems. Single most important control for reducing ransomware and BEC risk.
Regular, Tested Backups
Backups stored separately from production systems, tested for restoration at least quarterly. Immutable backups (cannot be deleted by ransomware) are increasingly required.
Software Patching & Updates
Timely application of security patches to operating systems, applications and remote access tools. Unpatched systems are the most common ransomware entry point.
Incident Response Plan
A documented plan identifying who to call, what to do, and what NOT to do in the first 24 hours of an incident. Some insurers require this for higher coverage limits.
Staff Security Awareness Training
Regular training on phishing recognition and safe practices. Particularly valued by insurers as human error remains the leading cause of cyber incidents.
Typical Premium Range for Legal Businesses
Premiums vary by revenue, data held, sector, security controls and limits selected. Because we compare across Chubb, AIG, Zurich, Delta Insurance, QBE and Berkley Insurance, we regularly find businesses are paying more than they need to with their current insurer — or have gaps in cover they weren't aware of.
Compare NZ Cyber Insurers →Frequently Asked Questions — Legal Cyber Insurance
Do Legal Firms & Law Practices need cyber insurance in New Zealand?+
What does cyber insurance cover for Legal businesses?+
How much does cyber insurance cost for Legal businesses in NZ?+
What is the biggest cyber threat facing Legal businesses?+
What happens when a Legal business makes a cyber insurance claim?+
Is ransomware covered by cyber insurance for Legal businesses?+
Related Resources for Legal Businesses
Business Email Compromise: NZ's Most Common Cyber Claim Explained
6 min read
The Privacy Act 2020 and Your Business: What You Need to Know
6 min read
What Does Cyber Insurance Actually Cover? A Plain-English Guide for NZ Businesses
8 min read
Useful Regulatory Resources
These government and industry bodies provide authoritative guidance on cyber security and data protection obligations for businesses.
CERT NZ
National cyber security authority — incident reporting and threat guidance
Office of the Privacy Commissioner
Privacy Act 2020 compliance and breach notification guidance
Insurance Council of NZ (ICNZ)
Industry body for NZ insurers and fair insurance code
Financial Markets Authority (FMA)
Regulation of NZ financial advice and insurance advisors