Reviewed by licensed advisers at Smiths Insurance & KiwiSaver (FSP712931) · Updated 11 November 2026

Cyber Insurance NZ: What It Covers for a Small Business

Cyber insurance pays for the cost of responding to a cyber incident at your business: specialists to contain it, restoring data, lost income while you are offline, and claims from people whose data was exposed. It is not a legal requirement. Cover depends on the insurer's wording and on the security controls you have in place, so it is worth checking both before you buy.

In short

Cyber cover has two halves: your own costs (response, restoring data, lost income) and claims against you (privacy liability, defence costs).
Insurers usually ask about multi-factor authentication, tested backups and software updates before they quote.
Public liability and professional indemnity policies generally do not respond to cyber incidents. Check the wording of each.

In the three months to 30 June 2026, the National Cyber Security Centre received 1,129 incident reports. Most are not dramatic. They are a hacked email account, a fake invoice that gets paid, or a laptop locked by ransomware on a Monday morning.

Picture a Nelson homeware store whose supplier is hit by an invoice-redirection scam. A criminal sits in the supplier's mailbox, then sends your accounts person new bank details. The payment goes out. Nobody notices until the real supplier chases it. Whether any insurance helps depends on whose system was compromised, who approved the payment, and what the policy says about funds transfer fraud. That is why the detail matters more than the label.

If it has already happened: phone your bank first and ask about recalling the payment. Tell any insurer you already hold, in writing, before you act on advice from anyone else, because late notice can cause problems. Then report it to the NCSC. A new cyber policy will not cover a loss you already know about, but an adviser can read your existing wording and tell you which policy, if any, responds.

What does cyber insurance cover?

Policies differ, but most split into two parts.

Your own losses (first party)

Incident response. IT forensic specialists, legal advice and a breach coach to contain the problem and work out what was taken.
Data restoration. The cost of rebuilding lost or corrupted data and systems.
Business interruption. Lost gross profit and extra costs while systems are down, usually after a waiting period.
Cyber extortion. Many policies respond to ransom demands and the negotiation costs, where the law allows it. Insurers normally want to be called before anything is paid.
Notification and monitoring. Costs of telling affected customers and, in some cases, credit or identity monitoring.

Claims against you (third party)

Privacy liability. Claims from customers or staff whose personal information was exposed.
Defence costs. Legal fees to respond to a claim or a regulator's enquiry.
Media or content claims. Some policies cover defamation or copyright claims arising from your online content.

Funds transfer fraud and social engineering (the fake-invoice scam above) are often optional extras with a lower limit and stricter conditions, such as a call-back check on any change to bank details. Ask for it by name. Do not assume it is included.

What do insurers ask before they quote?

Expect a short security questionnaire. Underwriters usually look for:

Control	What they usually want to see
Multi-factor authentication	On email, remote access and admin accounts
Backups	Regular, kept separately from your main network, and restore-tested
Patching	Operating systems and software kept up to date
Payment checks	A second person or a phone call to a known number before changing bank details
Staff awareness	Some training on phishing and fake invoices
Endpoint protection	Up-to-date antivirus or similar on every device

Weak answers can mean a higher price, a lower limit, conditions on the policy or a decline. Strong answers help. The same controls also cut the chance you need to claim at all, and the NCSC publishes guidance on protecting your organisation.

What are the numbers in New Zealand?

The NCSC (formerly CERT NZ) received 1,129 incident reports in the quarter from 1 April to 30 June 2026. Reported direct financial loss was $2.7 million, with 49 incidents of $10,000 or more accounting for $2.4 million, or 91%, of it. Scams and fraud was the most common category, with 348 reports. Source: NCSC Quarter Two Cyber Security Insights 2026.

Those are reported figures only. The pattern worth noting is that a few large losses make up most of the money. For a small business, one bad incident is the risk, not a steady drip.

What does the Privacy Act require after a breach?

If your business holds personal information, such as customer names, addresses and order histories, the Privacy Act 2020 requires you to tell the Privacy Commissioner and the affected people when a breach has caused, or is likely to cause, serious harm. The Commissioner says to do this as soon as you are practically able, using its Notify Us tool. Serious harm can include financial fraud, identity theft and blackmail.

A cyber policy with response cover means a legal adviser and forensic team are already lined up when you need to make that call.

What does cyber insurance usually exclude?

Check the wording for each of these.

Known or prior incidents. Anything you knew about before the policy started. A scam that has already happened is not covered by a policy bought afterwards.
Poor security. Some policies exclude or reduce a claim where agreed controls, such as multi-factor authentication, were not actually switched on.
Betterment. The insurer restores what you had. It does not usually pay to upgrade to newer, better systems.
Fines and penalties. Where the law does not allow them to be insured.
Physical damage. A fire or flood is a property claim, not a cyber one. See business interruption insurance.
Future profits and reputation. Lost goodwill is hard to prove and often limited or excluded.
Dishonest staff. Deliberate dishonesty by your own people is commonly excluded or sits under a separate crime cover.

Do my other policies already cover this?

Usually not. Public liability insurance deals with injury and property damage, and standard wordings often exclude data and cyber events. Professional indemnity may respond if a cyber failure causes a client a financial loss through your professional service, but many policies carve out data breaches. Business interruption cover normally needs physical damage to trigger it.

Read each wording, or ask an adviser to explain how they differ. Our business insurance overview shows where cyber sits next to the other covers, and insurance for business owners covers the personal side. If you are setting up from scratch, start with the start-up checklist.

Who should think about it first?

The businesses with the most to lose are those that hold customer data or depend on being online to trade.

Online retailers and stores that take card or account details.
Businesses that pay suppliers by bank transfer from emailed invoices.
Accountants, bookkeepers, medical and legal practices holding client files.
Anyone who would struggle to trade for a week without their systems.

A sole trader with a notebook and a paper diary has less exposure. A five-person business running on a cloud accounting file has more than it thinks. And if the owner is the one person who knows the passwords, see key person insurance and the wider business protection options.

How to get a quote

A licensed adviser at Smiths Insurance & KiwiSaver will ask about your business, what data you hold, how you pay suppliers, and what controls you have. They can then explain wording, limits and exclusions. A Smiths adviser will phone you to talk through which covers to look at. Some business covers we refer to another licensed Financial Advice Provider, and we will tell you who, and how they are paid, before your details go to that firm. There is no online quote. There is no cost to talk it through. Smiths Insurance & KiwiSaver may receive a commission or referral payment if you buy. Cover and price depend on insurer underwriting and the policy wording.

Financial advice is provided by Craig Smith Business Services Limited, trading as Smiths Insurance & KiwiSaver, a licensed Financial Advice Provider (FSP712931).

By industry: IT contractors, Accountants, Lawyers and Retail shops.

The exposure is different for each kind of firm, so see the guides for IT contractors, consultants, lawyers, accountants.

Frequently Asked Questions

Is cyber insurance compulsory in New Zealand?

No. No law requires it. Some clients, lenders and larger customers now ask for it in supplier contracts, so check what yours say.

Does cyber insurance cover a fake invoice or invoice redirection scam?

Sometimes. It depends on whether the policy includes funds transfer fraud or social engineering cover, the limit, and whether you followed the verification steps the policy requires. It is often an add-on. Ask your adviser to confirm it in writing before you buy.

Will an insurer pay a ransom?

Many policies include extortion cover where the law allows it, but insurers normally require you to notify them first and to involve their response team. Do not pay anything before you have spoken to the insurer.

Do I need cyber insurance if I use cloud software?

Probably yes. Your provider secures its platform, but a stolen password, a phished staff member or a fraudulent payment is usually still your loss.

What happens if I do not report a breach?

The Privacy Act 2020 sets the duty to notify, and the Commissioner can act on non-compliance. Get legal advice if you are unsure, and report through the Privacy Commissioner's tool as soon as you are practically able.

References

Read the full insurance guides

Tell us how the business trades and a Smiths adviser will phone you to talk through which covers to look at. Check what cover you need. No cost to talk it through.