Does Cyber Insurance Cover Stolen Passwords?

FTC cybersecurity guidance discusses phishing that tricks staff into revealing passwords and recommends access protections such as multi-factor authentication. Insurance coverage depends on what happened after credential theft and whether the resulting event satisfies the policy’s terms.

Check definitions of unauthorized access and security event, whether compromised credentials are included, and whether the policy excludes losses tied to missing controls or known vulnerabilities. Separate the costs of investigating a compromised account, restoring systems, notifying affected people, and recovering a fraudulent transfer; each may fall under a different coverage section or sublimit. Review any MFA representation in the application and the incident-notice condition.