Can My Business Be Liable for Third-Party Cyber Breaches?

TL;DR Businesses can indeed be liable for cyber breaches that occur at third-party vendors, which can disrupt operations and expose sensitive data. Understanding the difference between Business Interruption and Contingent Business Interruption insurance is key to managing these risks, especially for companies heavily reliant on external providers. The rise of AI adds new challenges, with potential for errors and regulatory issues increasing liability concerns. To protect themselves, businesses should conduct thorough vendor and AI risk assessments, implement strong security measures, and carefully review their cyber insurance policies. Working with brokers like Berkley Risk helps ensure coverage matches evolving threats and supports a robust cyber resilience strategy.

Businesses today often depend on third-party vendors and service providers, which means cyber breaches at these external partners can affect your own operations and data security. If a supplier’s system is hacked, your business might face financial losses from disrupted services or legal claims, especially when customer or employee data is exposed. Notable cases like the 2024 Change Healthcare breach show how such incidents cause cascading effects across industries. To manage this risk, it’s crucial to have adequate cyber insurance that includes contingent business interruption coverage, protecting you from losses caused by third-party incidents. Regular risk assessments and clear AI governance also help minimise liability.

What Are Third-Party Cyber Breaches and How Can They Affect Your Business?

Third party breaches happen when an external vendor, supplier or service provider’s systems get compromised and it affects your business indirectly. As companies rely more and more on outsourced services, software platforms and suppliers, this creates a web of connected cyber risks. For example a breach at a key software provider could disrupt your operations, cause data loss or even damage your reputation.

These incidents don’t just stop business; they can lead to financial liability if customer or partner data is exposed or if regulatory rules are broken. Contractual agreements often hold your business responsible for managing these third party risks so it’s important to know where the vulnerabilities are. The 2024 ransomware attacks on Change Healthcare and CDK Global show how a single vendor breach can impact an entire industry, causing operational delays and legal claims. To protect your business you need to assess your vendors’ cyber controls and monitor their compliance continuously, so you know the full extent of your third party relationships and the risks they bring.

Understanding Financial and Legal Liability from Third-Party Breaches

If a third party breaches your customer or employee data your business can face serious financial and legal consequences. Liability arises when you’re negligent in selecting vendors or don’t enforce robust cybersecurity standards. For example, if your chosen supplier doesn’t have adequate security controls and a breach occurs, your business will be held liable for not identifying or addressing those risks proactively.

Regulations like South Africa’s POPIA impose tough data protection rules, so timely breach reporting and safeguarding personal information is mandatory. Non-compliance can result in hefty fines and legal claims. Plus, contracts with third party providers usually outline responsibilities and liabilities for cyber incidents so unclear or poorly negotiated terms can increase your exposure. Financial losses go beyond fines; they include costs for notification, legal defence, compensation payouts and operational disruption that damages revenue and customer trust.

Insurance claims for these breaches can be complicated and often require clear evidence linking the loss to the third party event. Getting legal and cyber risk experts involved early on helps you understand your obligations, manage your liabilities and make sure your business is ready to respond.

Business Interruption vs Contingent Business Interruption Insurance Explained

Business Interruption (BI) insurance covers the losses your business suffers when your own IT systems are hit by a cyber incident, such as a ransomware attack or system outage. It pays for downtime, lost income and extra expenses to get back up and running. But many businesses also rely on third party suppliers, software platforms or service providers. That’s where Contingent Business Interruption (CBI) insurance comes in. CBI covers financial losses caused by cyber events that hit your suppliers or partners, even if your own systems are unaffected.

For example, if a cloud service provider or payment platform you use suffers a breach that takes them offline, your business could face downtime or delays that BI insurance won’t cover. CBI steps in to fill that gap. But be aware that CBI coverage often has different terms than BI. These can include longer waiting periods before you can claim, lower sub-limits on payouts and restrictions such as only covering full shutdowns not partial slowdowns. Some policies may exclude losses from partial interruptions altogether.

Because CBI claims require clear proof that a supplier’s cyber incident directly caused your losses, businesses in industries like healthcare, automotive and retail where supply chains and digital platforms are deeply connected must pay extra attention. Insurers may also ask for vendor risk assessments before agreeing to cover you, so understanding your third party dependencies is key.

Reviewing both BI and CBI policies regularly ensures they keep up with how your business and its supplier relationships evolve. Otherwise you could have coverage gaps if a third party breach hits you unexpectedly.

How Does AI Increase Your Company’s Cyber Liability Risk?

Artificial Intelligence is reshaping how businesses operate, but it also brings fresh cyber liability challenges that can catch many off guard. One major issue is algorithmic bias, where AI systems make decisions that unfairly disadvantage certain customers or partners, potentially leading to claims of discrimination or harm. Many AI models function as “black boxes,” producing outputs that are difficult to explain or audit, which complicates determining responsibility when things go wrong. Another concern is data mishandling: if AI systems rely on inaccurate or incomplete data sets, they can generate faulty results that increase the risk of cyber incidents or privacy breaches. Failures in AI-driven processes may lead not only to direct financial losses but also to third-party claims, for instance if an automated decision causes harm or violates privacy regulations.

While cyber insurance policies are starting to address AI risks, they frequently exclude losses from intentional misuse or unexplained AI errors, and premiums tend to be higher due to the novelty and complexity of these exposures. Additionally, regulators around the world are rolling out new rules focused on AI transparency and data protection, meaning businesses must carefully manage compliance to avoid penalties. Cyber attackers are also adapting, exploiting vulnerabilities unique to AI systems to trigger failures or breaches, further broadening liability concerns. To navigate these risks, businesses need robust AI governance frameworks and thorough risk assessments to identify potential liabilities arising from automated decisions affecting third parties. Taking these steps helps manage the evolving landscape of AI-related cyber liability and supports more informed insurance and compliance strategies.

Types of Cyber Insurance to Cover Third-Party and AI Risks

Cyber insurance comes in many forms to address the many risks your business faces, especially when it comes to third-party breaches and AI exposures. First-party coverage is for direct losses your business suffers, such as data recovery costs, ransomware payments, business interruption and reputational damage. This type of cover often includes notification expenses and regulatory fines after a breach. Third-party coverage is for claims made by clients or partners due to data breaches, network security failures or privacy violations on your systems or those of your suppliers.

With the rise of AI in business, many policies now offer AI-specific endorsements to cover the risks unique to artificial intelligence, such as algorithm errors or data mishandling. These endorsements are becoming essential as AI failures can trigger both first-party losses and third-party liability claims. Contingent Business Interruption (CBI) coverage is another important one, for losses when a third-party service provider has a cyber incident that affects your business. This is especially important for industries that rely heavily on external platforms, such as healthcare or automotive. But cyber liability insurance terms can vary greatly between providers, especially around waiting periods, coverage limits and exclusions. Some insurers offer modular policies so you can tailor protection to your specific AI and third-party risk profile.

There are often exclusions for intentional acts, unknown AI errors or certain types of data misuse, so working with experienced insurance brokers is key to identifying gaps and negotiating the right terms. Reviewing and updating your policies regularly helps ensure you stay protected as cyber threats and AI risks evolve.

Practical Steps to Manage Third-Party and AI Cyber Risks

Managing third-party and AI cyber risks starts with thorough assessments of all vendors before engagement. Understanding their cybersecurity posture and AI risk exposure helps you identify potential weaknesses early. You need to integrate AI risk into your broader cyber risk management framework so you consider algorithmic errors or data misuse alongside traditional threats. Clear, written policies around information security and AI governance should define roles and responsibilities so everyone knows their part in keeping things secure. Strong access controls, including multi-factor authentication for both internal and third-party systems, reduces the risk of unauthorised access.

Cybersecurity audits and penetration testing of connected vendor systems keeps your defences sharp and finds vulnerabilities before the attackers do. Train your employees to recognise cyber threats and AI risks so they can respond accordingly. Incident response plans must be tested regularly, including AI failures or third-party breaches, so your team can act fast and right. Monitor third-party compliance, ideally through automated tools, so they stay secure.

Additionally, review and update your cyber insurance policies annually, reflecting changes in your technology use and supplier network. Finally, engage with industry experts and intermediaries to stay ahead of emerging risks and best practises, keeping your business resilient against evolving cyber threats.

• Perform thorough cybersecurity assessments on all third-party vendors before engagement.
• Include AI risk evaluation as part of your overall cyber risk management framework.
• Develop written policies for information security and AI governance that define roles and responsibilities.
• Implement multi-factor authentication and strict access controls for both internal and third-party systems.
• Conduct regular cybersecurity audits, including penetration testing of connected vendor systems.
• Train employees on recognising cyber threats and AI-related risks to ensure vigilance.
• Test incident response plans regularly, incorporating scenarios involving AI failures and third-party breaches.
• Monitor third-party compliance continuously using automated tools where possible.
• Review and update cyber insurance policies annually to reflect changes in dependencies and technology use.
• Engage with intermediaries and experts to stay informed about emerging risks and best practices.

How Insurance Brokers Like Berkley Risk Support Your Cyber Liability Needs

Berkley Risk bring valuable expertise to the table when it comes to navigating the often complex cyber liability and AI risk insurance markets. They work closely with medium to large South African businesses to accurately assess exposures linked to third-party vendors and emerging AI technologies. By facilitating thorough risk assessments, Berkley Risk helps businesses understand the nuances of their cyber risks and compares multiple insurance policies to find the best fit. Their brokers negotiate policy terms to include critical coverages such as Contingent Business Interruption and AI-specific endorsements, which are essential in today’s evolving threat landscape. Beyond just placing insurance, Berkley Risk stays abreast of the latest cyber threats and regulatory changes, advising clients when updates to policies are necessary.

They also simplify the claims process, providing guidance and support during incidents to ensure smoother recoveries. Encouraging early engagement, Berkley Risk acts as a bridge between businesses and insurers, breaking down complex policy wording into clear, understandable language. Regular consultations with their brokers help maintain cyber resilience as technology advances and risks shift. With direct contact options for bookings and tailored consultations, Berkley Risk equips businesses to strengthen their cyber defences effectively and proactively.

Frequently Asked Questions

1. How can my business be responsible if a cyber attack happens through a company we work with?

Your business might be liable if the cyber breach occurs because of negligence or poor security practises by the third party you collaborate with, especially if you handle sensitive data or have legal duties to protect information.

2. What types of third-party relationships might put my business at risk for cyber breaches?

Any connections with vendors, suppliers, or service providers that access your data or systems could lead to risks. This includes cloud services, software providers, or even contractors who connect to your network.

3. What steps can I take to reduce my business’s liability in case a third-party cyber breach occurs?

Implement thorough vetting of third parties, insist on strong security measures in contracts, monitor their compliance regularly, and have a clear incident response plan that involves them. Regular reviews help lower your risk.

4. Are there legal consequences for my business if a third-party breach exposes customer data?

Yes, depending on data protection laws like the UK GDPR, your business could face fines, compensation claims, or regulatory scrutiny if it’s found you didn’t take reasonable care to protect personal information, even if the breach was caused by a third party.

5. Can using third-party cybersecurity insurance protect my business from liabilities related to cyber breaches?

Cyber insurance can help cover costs linked to breaches, including those caused by third parties, but it doesn’t remove your legal responsibility. It’s important to combine insurance with strong security and compliance measures to properly manage risk.

Related reading

• Specialised cyber insurance Sandton