A comprehensive cyber insurance policy in New Zealand covers two types of loss: first-party losses (costs your business incurs directly from a cyber incident) and third-party liability (claims made against your business by customers, partners or regulators). Below, we break down each coverage component in detail.
Not every policy covers every component — and limits, sub-limits and excesses vary significantly between insurers. Our brokers help you identify the gaps before you buy.
Data Breach Response
When your customer or employee data is exposed
A data breach is one of the most costly and stressful events a business can face. First-party breach response cover activates immediately, funding the specialist resources needed to contain, investigate and remediate.
What's Covered:
- ✓IT forensic investigation to determine cause and scope
- ✓Legal advice on Privacy Act 2020 notification obligations
- ✓Individual notifications to affected customers/employees
- ✓Call centre setup to handle enquiries
- ✓Credit monitoring services for affected individuals
- ✓Public relations and media statement support
- ✓Regulatory liaison with the Office of the Privacy Commissioner
Real World Example
A healthcare provider's patient management system is breached, exposing 3,000 patient records. Cyber insurance funds the IT forensic investigation ($25,000), legal advice and notification costs ($35,000), credit monitoring for affected patients ($20,000), and PR support ($8,000).
Ransomware & Cyber Extortion
When criminals encrypt your systems and demand payment
Ransomware is one of the most disruptive and costly cyber threats facing NZ businesses. Modern ransomware groups combine encryption with data theft, creating a "double extortion" scenario. Expert response is critical.
What's Covered:
- ✓24/7 incident response team activation
- ✓Specialist ransomware negotiator access
- ✓Ransom payment funding (subject to legal guidance)
- ✓Decryption key verification and testing
- ✓System restoration and data recovery costs
- ✓Business interruption losses during recovery
- ✓Threat intelligence and post-incident hardening advice
Real World Example
A manufacturing company's production systems are hit by ransomware. Cyber insurance funds the incident response team ($20,000), negotiation resulting in a reduced settlement ($60,000), system restoration ($45,000), and 3 weeks of business interruption losses ($90,000).
Business Interruption
Lost revenue when your systems go down
When a cyber attack takes your systems offline, the clock starts immediately on lost revenue. Business interruption cover compensates for income lost during the period your operations are impaired — often the largest component of a cyber claim.
What's Covered:
- ✓Lost net revenue during the recovery period
- ✓Fixed ongoing costs (rent, salaries, loan repayments)
- ✓Extra expenses to maintain operations
- ✓Dependent business interruption (if a key supplier is attacked)
- ✓Cloud service outage cover (on some policies)
Real World Example
A legal firm's case management system is encrypted by ransomware. The firm is unable to operate at full capacity for 18 days during recovery. Business interruption cover pays $140,000 in lost billings and ongoing fixed costs during the period.
Third-Party Cyber Liability
When others claim against your business
If your business suffers a breach that exposes customer or third-party data, those affected parties may pursue compensation claims. Third-party liability cover protects your business from these claims.
What's Covered:
- ✓Defence costs against privacy breach claims
- ✓Compensation and settlement payments
- ✓Network security liability (if your systems attack others)
- ✓Media liability for content-related cyber claims
- ✓Regulatory investigation defence costs
- ✓Fines and penalties where legally insurable
Real World Example
A retail business suffers a database breach exposing 8,000 customer credit card records. Twenty customers suffer financial fraud and bring claims. Cyber liability cover funds $180,000 in legal defence and settlement costs.
Regulatory Defence & Fines
Privacy Commissioner investigations and penalties
The Privacy Act 2020 gives the Privacy Commissioner significant investigatory and enforcement powers. If your business suffers a notifiable breach, you may face an investigation — and potentially significant penalties.
What's Covered:
- ✓Legal costs to respond to Privacy Commissioner investigations
- ✓Representation in Human Rights Review Tribunal proceedings
- ✓Regulatory fines and penalties (where legally insurable)
- ✓Compliance guidance and remediation advice
- ✓Mandatory notification costs
Real World Example
An aged care provider suffers a breach affecting resident health records and is investigated by the Privacy Commissioner. Regulatory defence cover funds $45,000 in legal representation and compliance costs.
Crisis Management & PR
Protecting your reputation when it matters most
A significant cyber incident can permanently damage your business reputation. Crisis management cover funds specialist PR and communications support to manage your public response and protect customer trust.
What's Covered:
- ✓Specialist PR firm fees
- ✓Media statement drafting and management
- ✓Customer communication strategy
- ✓Social media monitoring and response
- ✓Reputational harm assessment
- ✓Brand recovery campaigns
Real World Example
A retail business suffers a high-profile data breach that attracts media coverage. Crisis management cover funds a specialist PR firm ($35,000) to manage media enquiries, customer communications and brand recovery activity.
Coverage FAQs
What does cyber insurance cover in New Zealand?▾
Does cyber insurance cover ransomware attacks?▾
Is data breach response covered?▾
Does cyber insurance cover business interruption?▾
What is business email compromise (BEC) and is it covered?▾
Get Cover Tailored to Your Business
Our brokers will match you with the right policy for your specific risk profile — not just the cheapest option.
Social Engineering & Fraud
Business email compromise and invoice fraud
Social engineering fraud — particularly business email compromise (BEC) — is the most common cyber claim in New Zealand. It requires no hacking: criminals impersonate trusted parties to trick businesses into making fraudulent payments.
What's Covered:
Real World Example
A construction company receives what appears to be an email from their long-term supplier, advising of changed bank account details. Staff transfer $95,000 to the fraudulent account before the fraud is discovered. Social engineering cover reimburses the loss.