A small accounting firm in Naperville gets a phishing email. An employee clicks on it. The next morning, their files are encrypted and there's a message on the screen demanding $45,000 in bitcoin. The firm has a general liability policy, a BOP, and workers comp. No cyber coverage.
The ransom is $45,000. The forensics firm to figure out what happened costs $12,000. Notifying the clients whose data was exposed runs another $8,000. Lost billings while they rebuild from backup: $22,000. Total: $87,000. Their BOP paid nothing.
That's not hypothetical. That's the shape of small business cyber claims in Illinois right now.
What cyber insurance actually covers
A cyber liability policy is designed for exactly that scenario. None of it falls under a standard BOP or general liability policy. The coverage categories that matter most:
First-party costs (your own losses):
- Ransomware response and ransom payment
- Forensic investigation to determine what was accessed and how
- Business interruption while systems are down
- Data restoration
- Notification costs when you're required to tell affected clients their data was exposed
- Credit monitoring for breach victims
- PR and crisis management
Third-party costs (claims from others):
- Lawsuits from clients or vendors whose data you held
- Regulatory fines and defense costs
- Media liability (defamation, copyright infringement in your digital content)
Most Illinois small businesses don't realize how expensive the notification piece alone can be. Illinois has one of the stricter data breach notification laws in the country (815 ILCS 530). If you hold personal information about Illinois residents and that data gets compromised, you're required to notify them. The definition of "personal information" is broad. It covers names combined with financial account numbers, Social Security numbers, medical information, or login credentials. If your business stores any of that for clients, vendors, or employees, you've got legal exposure a BOP doesn't touch.
What it doesn't cover
Cyber policies have real exclusions, and some of them will surprise you.
War and nation-state exclusions. After the NotPetya attack in 2017, which was attributed to Russian military operations, several carriers denied claims under war exclusions. The language in most policies has gotten more specific since then, but the exclusion still exists. If your business gets caught in a large-scale attack that a carrier can attribute to a foreign government, the claim may be contested.
Prior acts. Cyber policies cover claims from incidents that happen during the policy period. If your network was breached six months before you bought the policy and you didn't know it (more common than most owners realize), that incident isn't covered.
Unencrypted data. Some policies limit or exclude coverage for breaches involving data that wasn't encrypted when it should have been. That's where the carrier security questionnaire matters enormously.
Fraudulent wire transfers with no social engineering. A lot of business owners assume their cyber policy covers any wire fraud. But standard cyber policies cover social engineering fraud, where the attacker tricked a human into authorizing a transfer. If the attacker got into your systems directly and moved money without involving a human, that might fall under computer fraud, which some policies treat differently. More on that below.
Ransomware: what actually happens when you file a claim
Ransomware is the most common cyber claim for Illinois small and mid-size businesses right now. The claims process matters because it affects whether your policy actually pays.
When ransomware hits, most cyber policies have a required response protocol. You contact the insurer's breach response hotline, which should be 24/7 for any decent policy. They assign a forensics firm. The forensics firm documents the encryption, determines what was accessed, and confirms the ransom demand is from a known threat actor.
The ransom payment itself gets handled by the carrier's incident response team, not you. They have established relationships with cryptocurrency exchanges. They often negotiate the amount down. They also verify whether the decryption key actually works before any payment clears. Most carriers require you to go through their process if you want the ransom covered. Paying on your own without notifying the carrier first can jeopardize the claim.
Illinois businesses that try to handle ransomware without their insurer consistently end up paying more. The forensics and negotiation expertise isn't something most IT vendors have.
Business interruption coverage under a cyber policy typically kicks in after a waiting period, usually 8 to 12 hours of downtime. For a small business doing $2 million a year in revenue, two weeks offline runs roughly $77,000 in lost income. Most small business cyber policies have business interruption sublimits in the $250,000 to $500,000 range, which is adequate for most small-business exposures but worth checking against your actual revenue before you bind.
Funds transfer fraud: the gap you're probably not thinking about
Funds transfer fraud is one of the fastest-growing categories of cyber claims, and it's also one of the most confusing to cover.
The scenario: your accounts payable person gets an email that looks like it's from your CEO, or from a vendor you've worked with for years. The email asks them to wire payment to a new account. The email is a forgery. Your employee completes the transfer. $60,000 leaves your account.
Whether that's covered depends entirely on the policy forms your carrier uses.
Social engineering coverage is in most cyber policies and covers fraud where a human was tricked into authorizing a payment. Your AP person clicked and wired the money. That's social engineering fraud, and a cyber policy with this endorsement covers it.
Computer fraud coverage covers losses from direct unauthorized access to your systems. If an attacker got into your banking portal and initiated the transfer themselves, that might be computer fraud, which is sometimes a separate rider on a crime policy rather than included in cyber.
Crime policies often cover employee theft and forgery but may not cover social engineering unless it's specifically endorsed.
The overlap between cyber, crime, and commercial crime coverage is genuinely messy, and it's where small business owners in Illinois consistently find gaps at claim time. If your policy doesn't specifically address social engineering fraud with its own sublimit, you might think you're covered and not be.
For businesses in DuPage County and the Chicago suburbs that process significant vendor or customer payments, this is worth reviewing carefully. The average social engineering fraud loss for small businesses is around $130,000. Getting the coverage structure right might cost $800 more in premium. Getting it wrong can cost far more than that.
Carrier security questionnaires: what they're actually asking
When you apply for cyber insurance, you'll fill out a security questionnaire. For most small businesses it's one to two pages. For larger operations it can be ten or fifteen. What you say here determines your eligibility, your premium, and whether a claim pays.
The questions carriers consistently ask right now:
- Do you use multi-factor authentication on email and remote access?
- Do you have offsite or cloud backups, and are they tested?
- Do you have endpoint detection and response (EDR), not just basic antivirus?
- Do you have a written incident response plan?
- Do you use privileged access management on administrative credentials?
- Have you had a security incident in the past three years?
Multi-factor authentication isn't optional anymore. Carriers that wrote cyber policies five years ago without asking about MFA are now declining renewals for businesses without it. A few major carriers stopped writing new business entirely for any company without MFA on email. If your business uses Microsoft 365 or Google Workspace without MFA turned on, you'll either be declined or rated significantly higher.
Backup integrity matters more than most people realize. Carriers ask whether backups are tested because the answer determines the actual claim cost in a ransomware event. Untested backups frequently fail to restore properly. Documented, tested, air-gapped backups get better pricing.
And be accurate. Misrepresenting your security posture on the application is the fastest way to have a cyber claim denied. If you say you have MFA and you don't, and then you have a breach, the carrier will audit your security posture during the claims investigation. Misrepresentation voids the policy.
What cyber coverage costs for Illinois small businesses in 2026
Pricing varies based on your industry, revenue, the type of data you hold, and your security questionnaire responses.
General ranges for Illinois small businesses right now:
- Small service businesses with under $1 million in revenue and no sensitive financial or health data: $1,200 to $2,500 per year for $1 million in coverage
- Accounting, legal, or financial services firms: $2,500 to $6,000 per year
- Healthcare-adjacent businesses handling any protected health information: $4,000 to $10,000 per year depending on record count
- E-commerce or retail businesses handling payment card data: $2,000 to $5,000 per year
The coverage limit question matters. Most small business owners default to $1 million because it sounds like a round number. But the right limit depends on what a realistic worst case looks like for your specific business. If you hold client Social Security numbers and financial data for 500 clients, the notification and credit monitoring costs alone can run $75 to $150 per record. That's $37,500 to $75,000 before you count forensics, legal defense, and business interruption.
Sublimits are the other thing to watch closely. A policy with $1 million aggregate coverage but a $100,000 sublimit on ransomware isn't a $1 million ransomware policy. Read the declarations page carefully, or have your agent walk through each sublimit against your actual exposure.
The industries in Illinois getting hit hardest right now
Property management companies in the Chicago suburbs are a consistent target. They hold financial data on tenants, ACH authorization, and often have staff with access to large payment accounts. One successful social engineering attack can result in six-figure losses.
Professional services firms (lawyers, accountants, consultants) in DuPage County, Lake County, and the Cook County suburbs hold sensitive client data and often have smaller IT budgets than their exposure warrants. They also process large wire transfers regularly.
Healthcare-adjacent businesses, medical billing firms, dental practices, physical therapy clinics, face particularly high risk because HIPAA breaches carry mandatory notification requirements and federal regulatory exposure on top of Illinois state law.
Manufacturers and contractors with lean IT infrastructure are increasingly targeted because attackers know they're less defended than larger enterprises and more likely to pay quickly to get operations running again. A DuPage County manufacturer down for a week isn't just losing revenue; they're potentially losing customer relationships they've built over years.
How to buy it without overpaying or under-covering
Start with what you actually hold. If you don't store Social Security numbers, payment card data, or healthcare information, your exposure is more limited than a professional services firm. That affects what limits make sense.
Get quotes from at least three carriers. Cyber pricing varies more between carriers right now than almost any other commercial line. The carrier that's cheapest for a law firm may not be the cheapest for a manufacturing company.
Don't optimize only for premium. The claims handling and incident response capability of the carrier matters in a real cyber event. A carrier with a strong breach response team and 24/7 hotline access is worth paying for. In a ransomware situation, response speed is measured in hours, and having the right forensics firm assigned quickly can meaningfully reduce the total claim cost.
Ask specifically about social engineering sublimits, ransomware sublimits, and whether the policy covers business interruption triggered by a cloud provider outage (sometimes called contingent business interruption). Most standard small business cyber policies don't include cloud outage coverage by default.
If you're running a commercial operation in Illinois without a cyber policy, you've got uninsured exposure sitting on top of your standard commercial lines. For questions about what coverage makes sense for your specific business, a licensed commercial producer at an independent brokerage in the RateShield trusted network can help. Call (773) 850-3801.