Cyber Liability Insurance for E-commerce and Online Stores
If your storefront is a website, a few lines of injected JavaScript can take payments from your customers and leave the liability with you. Cyber Insurance Group has agents dedicated to cyber liability, comparing online retailer coverage across 12+ A-rated carriers.
Compare your online store across 12+ A-rated carriers in about 4 minutes. Free, no obligation, and no need to know your limits in advance. We are an independent agency, so the recommendation is based on what covers your risk, not on one carrier’s product sheet.
Get My QuoteYour Checkout Page Is the Attack Surface
Online merchants rarely lose money the way people imagine. The losses cluster in four places, and none of them require an attacker to breach your office.
Digital skimming
Attackers modify a script that runs on your payment page and quietly copy card details as customers type them. Your site keeps working perfectly, which is why this is often found by a card brand, not by you.
Account takeover
Credentials leaked from somewhere else are replayed against your customer logins and your admin panel, usually in bulk.
Storefront downtime
A locked or defaced store is lost revenue by the hour, and unlike a physical shop you cannot serve a single customer while it is down.
Third-party and plugin compromise
Your theme, apps, analytics tags and chat widgets all execute code on your pages. Their compromise becomes your incident.
The PCI Rules for Payment Pages Moved, and Most Store Owners Missed It
This is the part that catches online sellers out, because the answer genuinely depends on how your checkout is built.
The deadline that has already passed
PCI DSS v4.0 introduced 64 new requirements, 51 of them future-dated. Those future-dated requirements stopped being best practice and became mandatory on 31 March 2025. Two of them, Requirements 6.4.3 and 11.6.1, exist specifically to reduce e-skimming during e-commerce transactions: payment page scripts have to be authorized, integrity-checked, and monitored for tampering. Source: PCI Security Standards Council.
The exception that is widely misread
In January 2025 the Council removed Requirements 6.4.3, 11.6.1 and 12.3.1 from SAQ A, the self-assessment used by merchants who have outsourced their account data functions completely. That is not a free pass. The Council replaced them with an eligibility criterion: the merchant has to confirm their site is not susceptible to script attacks that could affect their e-commerce systems. If your checkout embeds payment fields directly into your own page instead of using a hosted iframe or redirect, you are not in SAQ A territory and the script requirements apply to you in full. Source: PCI Security Standards Council.
Why this matters for your insurance
PCI compliance and cyber insurance solve different halves of the same problem. Compliance is what the card brands expect of you beforehand. Insurance is what pays the forensic investigator, the notification costs, and the card-brand fines and assessments afterwards. A policy written for an online retailer should name PCI fines and assessments explicitly, and that is one of the first things we check when comparing quotes for a store.
Two Online Sellers Were Penalized Over the Response, Not the Break-In
In both cases below the regulator’s complaint centered on what the company did after it knew, which is the part a store owner actually controls.
-
2022Zoetop Business Company (SHEIN and ROMWE)Online Fashion Retail
The New York Attorney General secured a $1.9 million penalty after a breach affecting 39 million SHEIN accounts, more than 800,000 of them New Yorkers. The penalty was not simply for being breached. The Attorney General found the company failed to notify all affected shoppers and downplayed the scope of the incident to consumers.
Source: NY Attorney General → -
2022CafePressOnline Marketplace for Small Sellers
The FTC acted against CafePress over a 2019 breach that exposed more than 180,000 unencrypted Social Security numbers, along with millions of names, addresses and security answers, some of which later turned up for sale on the dark web. The company patched the hole but did not tell affected customers until months later. It had also been charging hacked shopkeepers a $25 account closure fee. The settlement required $500,000 in redress specifically to compensate small businesses, plus mandatory multi-factor authentication.
Source: Federal Trade Commission →
By the Numbers
- 88% of attacks against basic web applications involved the use of stolen credentials.Verizon, 2025 Data Breach Investigations Report. Source
What This Means for Your Store
Neither company was punished simply for being breached. Both were penalized for what followed: delayed notice, downplayed scope, and in one case a fee charged to the victims. Notification is a legal obligation with deadlines, not a public relations decision, and getting it wrong is independently punishable. That is the clearest argument for a policy that includes breach coach access: a specialist lawyer who takes the first call and tells you what you are legally required to send, to whom, and by when. We walk through that sequence in our data breach response guide.
Coverage Built Around How Online Stores Lose Money
Your store keeps trading
Business interruption and restoration costs cover the revenue you lose while the storefront is down and the cost of getting it back, which for an online seller is the single largest exposure.
Someone else pays the card brands
PCI fines and assessments coverage responds to penalties passed down by the card brands after a payment-page compromise, rather than leaving them on your balance sheet.
You get an expert before you speak publicly
Breach coach and forensic coverage puts a specialist lawyer and investigator on the incident from day one, so your notifications are correct the first time.
Extortion does not become your decision alone
Cyber extortion coverage brings in negotiators and funds the response, instead of leaving a store owner deciding alone whether to pay.
Before You Decide
The objections we actually hear from business owners, answered straight.
Does an e-commerce business need cyber insurance?
If you take card payments on a site you control, the exposure is direct. Your storefront is both your revenue and your attack surface, and a compromised payment page can take customer card details while the site keeps working normally. The losses that follow, card-brand fines, forensic work and downtime, are not covered by a general liability or business owner’s policy.
Do I need cyber insurance if I only sell on Etsy, Amazon or another marketplace?
Your exposure is smaller but not zero. The marketplace secures its own checkout, so payment card risk largely sits with them. What remains yours is your seller account and the customer information you hold outside the platform, including your own email, order exports and any mailing list. Account takeover and a fraudulent payout change are the realistic losses for a marketplace-only seller.
What does cyber insurance not cover for an online store?
It does not cover lost or damaged physical stock, which is a commercial property matter, and it does not cover a customer claiming your product harmed them, which is products liability. It will not fund the security upgrades you make afterwards, and it does not retroactively cover a compromise that started before the policy began.
How much does cyber insurance cost for an online store?
Most small businesses pay between $400 and $8,000 a year, with the average landing around $1,500. For an online retailer the drivers are annual transaction volume, whether card data touches your own systems or a hosted checkout, and the controls on your admin accounts. How your checkout is built also decides which PCI self-assessment applies to you, which in turn affects underwriting. See the cost guide for the full breakdown.
Is cyber insurance worth it for a small online store?
The question usually turns on business interruption rather than data. A physical shop with a systems outage can still serve the person at the counter; an online store with a down or defaced site serves nobody, and loses revenue by the hour. That single exposure is what makes the economics work for most small merchants.
Our checkout is hosted by our payment provider, so PCI is their problem, right?
Not entirely, and the answer changed in 2025. If your payment page is fully outsourced you may validate under SAQ A, and in January 2025 the PCI Council did remove the new payment-page script requirements from SAQ A. But it replaced them with an eligibility criterion: you have to confirm your site is not susceptible to script attacks that could reach your e-commerce systems. If your checkout embeds fields directly in your own page rather than a hosted iframe or redirect, the script requirements apply in full. Either way the liability for your own site is yours.
What Would Cyber Liability Insurance Cost Your Online Store?
Most small businesses pay between $400 and $8,000 a year depending on revenue, the data they handle, and how their checkout is built. See the full breakdown in our cost guide, or get a number for your own store.
Compare 12+ A-rated carriers for your store
Free, no obligation, about 4 minutes.