Why Money Managers and Fiduciaries Get Asked About Cyber

Daily money managers, fiduciaries, guardians and bookkeepers all share one feature: the work requires holding exactly the information an attacker wants. Bank access, account numbers, social security numbers, medical and financial records for people who are often elderly or vulnerable.

The costly part of a breach is usually not the breach. It is what follows. Nearly every US state requires notification of affected individuals, on a clock, in a prescribed form. That means legal advice on what the statute requires, a forensic investigation to establish what was actually taken, notification letters, and often credit monitoring. Those costs arrive whether or not anyone sues you.

Two common assumptions are wrong. The first is that ordinary business property insurance covers it — it generally does not, because data is not damaged property. The second is that small firms are not targets. Small firms are attractive precisely because they hold valuable data with fewer defences, and most incidents are opportunistic rather than aimed.

The exposure is not only hacking, either. A lost laptop, a phone left in a taxi, an email sent to the wrong client, or a bookkeeper's mailbox compromised by a password reused from somewhere else are all routine causes. So is ransomware, where the demand is often the smaller number and the downtime is the real loss.

Cyber cover for this kind of practice usually does three things: it responds to claims brought by people whose data was exposed, it pays the response costs described above, and it addresses extortion demands. It sits alongside your professional liability rather than replacing it — E&O answers for advice that was wrong, cyber answers for data that got out.

Worth asking yourself: if a client's account details left your office tomorrow, who would you call first, and who is paying for the notifications? If neither answer is immediate, that is the gap the cover is for.