As mature a risk management product as Cyber Liability Insurance has become, we still hear agents and brokers’ “war stories” about how hard it can be to persuade clients they need it.

Case in point: One agent recently told us their clients in the retail and hospitality spaces often push back against purchasing Cyber Insurance because they think that in the event of a data breach, their POS (point-of-sale) provider—the vendor supplying the hardware and software used to process customer transactions—assumes full liability.

Pointing a finger at the POS vendor is an understandable impulse. After all, aren’t their systems at the heart of payment processing? Shouldn’t they have done more to secure their tech, their networks, and consumers’ information?

Unfortunately, this common misconception fosters a false sense of security. And it could end up costing businesses dearly.

The truth is the retailer, not their vendor, bears most of the financial and reputational risk of a POS data breach.

Retail cyber attacks have been on the rise, as several high-profile breaches among UK retailers illustrate. The average cost of a data breach in the retail sector is $3.48 million—a faster growth in breach costs than any other industry.

In hospitality, too, cyber attacks are becoming more common and costly. The average cost of a data breach in this sector is $3.86 million.

Your clients need to understand that cyber security in the retail industry and in the hospitality industry is a shared responsibility, and that they can’t afford to ignore Cyber Liability Insurance.

Shared Responsibility, Not Sole Blame

Established, reputable POS providers do implement such retail cyber security measures as end-to-end encryption (E2EE) for data in transit, tokenization (replacing sensitive credit card details with a unique identifier for processing), compliance with Payment Card Industry Data Security Standards (PCI DSS), and secure network architecture. And in service-level agreements (SLAs), POS vendors spell out their obligations, including core software security and server uptime.

However, they can’t and don’t manage merchants’ internal network security, employee access controls, or software update schedules. As the SLA’s fine print often makes clear, the retailer is also responsible for complying with regulations like PCI DSS and for securing their own environment.

When it comes to the consequences of a POS data breach affecting customer information, the burden generally shifts away from POS providers. Contract exclusions may specify that the POS provider isn’t liable for:

• Any business losses associated with the breach.
• Any costs related to customer communication following a breach.
• Any regulatory penalties if compliance lapses occur on the business’s side.

The bottom line? While POS providers secure the technology they supply, retailers and hospitality businesses must secure the environment in which this technology operates.

What a POS Data Breach Can Cost Retailers

Cyber criminals often realize a business’s internal environment is the path of least resistance. POS providers may secure their fortress, but attackers will simply walk through the unlocked front door of the merchant’s network.

In the wake of a POS data breach, retailers must contend with expenses that could have lasting effects on their operations and reputation. The costs can include:

• Business Interruption
  Retail cyber attacks can disrupt business operations and revenue streams. Companies may have to take systems offline for security assessments and remediation, putting a stop to sales and customer service. This downtime can have knock-on effects on inventory management, supply chain logistics, and employee productivity.
  

• Forensic Investigations
  Specialized cyber security teams must investigate cyber attacks to determine their scope, close security gaps, retrieve or restore data, and prevent future incidents. These experts’ services come at a premium.
  

• Notification and Credit Monitoring
  Alerting affected and potentially affected customers about a breach involves significant administrative effort and cost, and providing free credit monitoring to them to mitigate their dissatisfaction and potential future fraud represents a considerable financial burden.
  
• Legal Fees
  Legal fees can accumulate quickly, especially if class-action lawsuits emerge or if the business faces fines and penalties from regulatory bodies for noncompliance with data protection laws.
• Reputational Harm
  In industries reliant on customer loyalty, regaining trust can be a prolonged and strenuous process. Loss of trust can lead to decreased customer retention and acquisition, affecting retailers’ bottom lines over the long term.

How Cyber Breach Insurance Bridges the Gap

Cyber Liability Insurance can address the financial gaps POS contracts leave open.

A strong, comprehensive Cyber policy can help ensure a POS data breach doesn’t leave a business devastated by covering:

• Revenue lost due to business interruption
• Bills for forensic IT investigation
• Costs of customer notification and credit monitoring
• Attorney fees, court costs, and legal judgments
• Public relations efforts to restore customer trust

By investing in Cyber Insurance, retailers and hospitality businesses can protect themselves against the financial consequences of a breach.

Understandably, companies don’t usually call public attention to how much their Cyber Insurance helps them pay for the costs of a breach. But when Marriott faced a massive data breach in 2018, the hotel chain reported insurance proceeds of $25 million, significantly offsetting its costs.

A more recent example of Cyber Insurance’s power from the hospitality industry is Caesars Entertainment’s decision to pay $15 million in ransom following a 2023 ransomware attack. CNBC, among other outlets, reported that Caesars’ Cyber Insurance policies partially covered the payment.

ProWriters Makes Selling Cyber Insurance Simpler

While cyber security is a shared responsibility in the retail and hospitality industries, businesses bear ultimate responsibility for protecting their systems and guest data. Clearly, Cyber Liability Insurance is an essential component of any comprehensive risk management strategy.

ProWriters can help you research, quote, and bind the Cyber Insurance policies your retail and hospitality clients need. We also make the process faster and easier than it’s ever been.

Find out more and get started as a registered ProWriters broker today.