This one is for the household, not the company.

Read this first: personal is not commercial

Most of what gets written about cyber insurance is about businesses. It describes a different product answering a different problem, and mixing the two up is how households end up with nothing.

Commercial cyber liability is written for an organization. It takes in a business's systems, employees, client and patient records, regulatory duties and contracts. Also its income when the doors close, and what it owes the third parties whose data it was holding. That side lives on our business cyber insurance pages.

Personal cyber is written for a household. Your money, your identity, your devices, and what your family is on the hook for online. It doesn't carry the machinery a business needs, and it isn't priced or underwritten as though it did.

People get this wrong in both directions, so here it is plainly. A personal cyber policy won't answer a business problem, and a commercial one won't answer a household problem. If somebody in the house owns a business, or works from home in a way that touches company systems or client records, look at the two separately and then read them against each other. Business owners and executives covers that crossover more broadly.

The blurred cases are where the mistake actually happens. A home office holding client files. A side venture run off a personal laptop. Rental properties managed from the kitchen computer, a board seat with documents on a personal device, or a household employee moving money for the family. Every one of those deserves a look from both sides instead of being filed under one.

Identity theft and restoration

Identity theft is the part people already associate with this coverage. Restoration is usually the part that matters more.

You can often get the money from a fraudulent account back through the bank or the card issuer. What you can't get back that way is the labor of putting the identity together again. The correspondence, the affidavits, the credit bureau disputes, the tax filings that now contradict each other. The time off work and the legal fees. The months where a mortgage or a refinance sits still because the credit file is wrong.

Personal cyber forms commonly address case management support, the expenses of restoring an identity, and some categories of lost income and legal cost. What's in and at what limit varies a lot between carriers. Check it against the policy. The phrase on your renewal notice may not mean what it sounds like.

Nearby problems sit in that section on some forms and nowhere on others. Fraudulent tax filings in a family member's name, medical identity theft, a child's identity used to open credit, and misuse of a dead relative's identity while the estate is being settled.

Cyber extortion in a household

Extortion reaches houses too. A household holds decades of photographs, financial records, tax returns, appraisals, estate documents and correspondence, all of it sitting on equipment nobody patches on a schedule.

The household versions look like this. A home computer or a backup drive on the network gets encrypted and somebody demands a payment. A cloud account is taken over and the family is locked out of its own archive. A family member is threatened with the release of material pulled off a compromised account. Somebody gets into a connected home system and a demand follows.

Personal cyber forms that address extortion usually take in the response costs: the specialists who assess and clean up, the negotiation help, and the work of restoring the data. Some address the payment itself, under stated conditions, and the conditions here are real rather than formalities. Prior consent and notification requirements are common. Read the actual wording on this one. Forms differ more here than almost anywhere else.

Funds transfer and social engineering fraud

Households need this one more than any other section and have it less often than any other. The closing wire is the reason.

The pattern is well documented and not clever. Somebody breaks into or imitates an email account in a real estate transaction. Wiring instructions arrive that look correct, from an address that looks correct, about a purchase that is genuinely happening, usually on closing day when there is no time to think. The money goes to the wrong account. Once it has moved, it is often gone.

The same trick reaches a household in other ways. A contractor's invoice with new banking details partway through a renovation. An instruction that looks like it came from a family member traveling abroad, or from an advisor, a trustee or a household manager. A message to whoever in the house handles the payments.

Forms that address this commonly cover money transferred because of a fraudulent message, subject to a limit that is often well below the main policy limit and subject to conditions about how you verified it. Whether any one incident falls inside any one form depends on the wording, the conditions and the facts. Eligibility and terms vary by carrier and by state. Closing week is the wrong time to be finding out.

The defense is older than the problem and it still works. Before the wire, every time, call the title or escrow company on a number you looked up yourself, and confirm the instructions out loud. Treat any change to banking details as a lie until proven otherwise. If a build is involved, our page on custom homes is worth a look too.

Online liability and reputational harm

This one doesn't feel like insurance until it does.

People in the house post, comment, review and share. A claim can come out of a review of a contractor, a comment about a neighbor, something a teenager put up, or material shared from an account nobody had secured. The words on the demand letter are usually defamation, invasion of privacy, or harassment.

Two things are worth knowing. A personal umbrella may pick up some categories of personal injury liability and exclude others, depending on the form, so see personal umbrella insurance and check what yours actually says. And personal cyber forms sometimes add an online liability piece, and sometimes cover the cost of answering reputational attacks on the family, specialists included.

It matters most where the family has a public profile or the family name is on a business. Board service, charitable work and anyone who is active online for a living pull in the same direction. Worth a read either way.

Connected home systems

A large modern house has more ways in than a small office does. Cameras, locks, thermostats, irrigation, water shutoff valves, lighting, alarm panels, audio, car chargers, solar and battery systems, and whatever the home technology contractor installed years ago and left on the default password.

Three separate problems come out of that, and they don't all sit in the same place on a policy.

• Physical damage set off through a connected system. Somebody gets into the water or climate control and the house takes damage. Whether the homeowners policy answers for that damage is a question about the peril and the exclusions on that form. It isn't a cyber question.
• Damage to the devices and the data themselves, which personal cyber forms sometimes pick up, including the cost of getting systems and files back after an attack.
• Privacy, which is mostly about cameras and microphones inside the house, and mostly about who gets recorded. Household employees, guests and contractors all count.

If you employ anyone at the house, cameras and recordings run straight into employment questions, and that deserves its own thinking. See domestic employee insurance.

The controls that actually matter

Insurance is the last line. Most of what happens to a household gets stopped by ordinary habits, and carriers ask about those habits more than they used to.

• Multi factor authentication on email first, then on banking, brokerage, cloud storage and anything that can reset a password. Email is the master key, because that's where everything else goes to recover itself.
• A password manager and unique passwords, especially on financial accounts. A reused password is how somebody else's old breach becomes your current problem.
• Verbal verification for money, on an independently obtained number, for every transfer and every change of banking detail, with no exception for urgency. Urgency is the tell.
• Backups that aren't attached to the network, and a check once in a while that they actually restore.
• A separate home network for connected devices, with the default passwords changed and the firmware kept current.
• A credit freeze at the bureaus for the adults in the house, and for the children where that applies.
• A conversation with everyone in the house, younger family members and anyone who works there included. None of this holds if only one person does it.
• Household and business equipment kept apart, accounts included. Good practice on its own, and it keeps the personal and commercial coverage questions from tangling.

What to check on your own policy

First, find out whether you have a personal cyber endorsement at all. Plenty of households don't, and plenty of the ones that do are carrying a limit somebody defaulted into years ago.

Then read four things. The limit. The sublimits on each section. The conditions attached to extortion and funds transfer. And the definition of who counts as an insured, which decides whether the policy reaches adult children, family living elsewhere and people who work at the house. After that, ask separately whether anything business-shaped in the household needs a policy of its own.

Send us the declarations page and we'll read it. A coverage review is educational, carries no pricing and no obligation, and often ends with us telling you what you have is fine. If you want terms, start with a private client quote. The private client overview shows how this sits alongside the home, the vehicles and the umbrella, and the learning center collects the underlying answers.

Reviewed for insurance accuracy by Richard Sweet, owner of Vantage Point Risk and an independent insurance advisor. Last reviewed September 26, 2026. How we review this.