Cyber Liability Insurance for Energy Brokers and Retail Suppliers
Your customer file does not describe your customers, it can act on their accounts. Cyber Insurance Group has agents dedicated to cyber liability, comparing broker and supplier coverage across 12+ A-rated carriers.
Compare your brokerage across 12+ A-rated carriers in about 4 minutes. Free, no obligation, and no need to know your limits in advance. We are an independent agency, so the recommendation is based on what covers your risk, not on one carrier’s product sheet.
Get My QuoteYou Hold Permission, Not Just Records
Almost every other business on this site stores information about people. This one stores the ability to do something to them.
Account numbers plus authorizations
Held together, they are the instrument that lets a supplier be changed on a customer’s account.
Usage data is an operating schedule
Interval consumption shows when a commercial site runs and when it stands empty.
A portfolio larger than you
Your book routinely includes commercial accounts many times the size of your own business.
Several commissions at once
Deregulated markets each set their own licensing and enrollment conduct rules, so a multi-state broker answers to several of them.
A File That Is Operative, Not Descriptive
The difference decides how bad a compromise is, and most brokers have never framed it this way.
Why the combination is the asset
A utility account number on its own is of limited use. A signed letter of authority on its own is of limited use. Held together, in the system where you keep both, they are what a market needs to see in order to move a customer from one supplier to another. Your customer database is therefore closer to a set of credentials than to a contact list, and it should be protected on that basis.
The conduct rules assume paper
State enrollment and anti-slamming requirements were largely written around signed forms and recorded calls, with the regulatory question being whether a particular customer genuinely consented. When an entire book of authorizations sits in one platform, a single compromise raises that question across every account at once, and answering it is a commission matter as well as a breach response.
Nobody federal is standing behind this
Licensing and conduct for retail energy sit with state public utility commissions rather than with a national regulator, and they differ between markets. There is no single standard to certify against and no federal approval to point at after an incident, which leaves reasonableness as the measure and your own documentation as the evidence.
And the data rules still reach you
Separately from anything energy specific, state breach notification statutes apply to the personal and financial information in your systems, and the duty runs to where your customers are located rather than where your office is. Source: NCSL, security breach notification laws.
Which rules actually reach your business
- Solar installers answer to no mandatory grid reliability standard at all, because the systems you commission sit on local distribution.
- Energy brokers and suppliers answer to state commission licensing, plus whatever you can do with the authority a customer signed over to you.
- Oilfield service companies answer to the operator’s contract, where your downtime is priced as their deferred production.
- EV charging operators answer to a federal rule that binds the State for security and binds you directly for customer data.
Why it changes the policy conversation
Your exposure scales with the load you administer rather than with your commission income, and a limit sized against revenue will understate it badly. Regulatory defense cover matters more here than in most sectors, because a commission inquiry can follow the incident. Our data breach response guide walks through the sequence.
Built for a Book of Business That Can Be Acted On
Questions from a commission
Regulatory defense coverage funds the response when a state commission asks whether enrollments on your book were genuinely authorized.
Customers across several states
Breach coach and notification coverage handle the multi-state determination your portfolio creates.
Claims from commercial accounts
Third-party liability responds when a customer alleges your systems exposed their account or their usage data.
Contracts keep renewing
Business interruption and extortion coverage respond when your platform is locked and renewal and enrollment dates do not move.
Before You Decide
The objections we actually hear from business owners, answered straight.
What makes a broker’s customer file different from an ordinary CRM?
It contains authority, not just information. A utility account number held alongside a signed letter of authority is the combination that lets a supplier be changed on that account. Most businesses hold records that describe a customer. This one holds records that can be acted on against a customer, which is why the file is worth stealing rather than merely worth selling.
Who regulates energy brokers and retail suppliers?
State public utility commissions, not a federal agency, and the requirements vary considerably between deregulated states. Licensing, disclosure and enrollment conduct rules all sit at state level, which means a broker operating across several markets is answering to several different regimes at once and has no single national standard to point at.
Is unauthorized switching really a cyber problem?
It becomes one the moment the authorizations are stored electronically. Enrollment conduct rules were written with paper and call recordings in mind. When the signed authorizations and account numbers for an entire book of business sit in one system, a compromise of that system is simultaneously a data breach, a potential regulatory enforcement matter and a customer relations event across your whole portfolio.
What is sensitive about commercial usage data?
Interval data describes when a building draws power and when it does not. For a commercial customer that is an operating schedule: shift patterns, which sites run at weekends, and when a facility is effectively empty. Your customers would not generally expect their broker to be holding a usable picture of when their premises are unoccupied.
We are a small brokerage. Why would anyone target us?
Because of concentration rather than size. A broker aggregates account credentials and authorizations for many customers, including commercial accounts far larger than the brokerage itself. The attacker is not valuing your revenue, they are valuing the portfolio you administer, and small firms are generally the easier route to it.
Does our errors and omissions policy cover a breach?
Usually not in the way you need. Errors and omissions responds to claims that you gave bad advice or made a mistake in placing a contract. It is generally not built to fund forensics, customer notification, a commission inquiry or an extortion demand, and any cyber endorsement attached to it is commonly sublimited well below what a real event costs.
What does cyber liability insurance not cover for an energy broker?
It does not answer a claim about the contract you placed, such as a dispute over rates or terms, which belongs to your professional liability policy. It does not pay a commission penalty for a licensing violation. It covers the breach response, the liability, the regulatory defense and the interruption.
What Would Cyber Liability Insurance Cost Your Brokerage?
Pricing follows the size of the book you administer, the states you operate in, how authorizations are stored and the controls you can evidence. See the breakdown in our cost guide, or get a number for your firm.
Compare 12+ A-rated carriers for your firm
Free, no obligation, about 4 minutes.