Cyber Liability Insurance for Small Carolina Businesses

Beach Insurance LLC 2026-07-27

Opening answer

Cyber liability insurance (also called cyber insurance) is a commercial policy that can help a small business pay the costs of a cyber incident, from forensic investigation and customer notification to ransomware-related expenses and claims from people whose data was exposed. The Federal Trade Commission describes cyber insurance as one option that can help protect a business against losses from a cyber attack, and notes that coverage is often discussed as first-party protection for your own losses, third-party protection for claims against you, or both.[1] For shops, clinics, professional firms, and other small employers in Myrtle Beach, Charleston, Charlotte, and coastal North and South Carolina, that usually means pairing basic security practices with a policy review that matches how you store customer, employee, and payment data.

Why small businesses show up on attackers’ lists

Size is not a shield. The Cybersecurity and Infrastructure Security Agency (CISA) states that small businesses often do not have the resources to defend against devastating cyber threats such as ransomware, and that much of the older “coffee shop Wi-Fi” advice no longer matches how organizations are compromised today.[2] Attackers look for the path of least resistance: unpatched software, reused passwords, staff accounts without multifactor authentication, and backups that were never tested.

That pattern shows up in national complaint data. In its 2024 Internet Crime Report, the FBI’s Internet Crime Complaint Center (IC3) recorded 859,532 complaints and more than $16.6 billion in reported losses, a 33 percent increase in losses from 2023.[3] Among crime types, phishing and spoofing led by complaint volume, personal data breaches were common, and business email compromise (BEC) alone accounted for about $2.77 billion in reported losses.[3] Ransomware complaints rose 9 percent year over year to 3,156, and IC3 noted ransomware remained the most pervasive threat to critical infrastructure, while also stressing that published ransomware loss totals understate downtime, wages, and remediation costs victims often do not report as a single dollar figure.[3]

Carolinas businesses are part of that reporting picture. For 2024, IC3 recorded 9,661 complaints from South Carolina and 22,021 from North Carolina, with reported losses of about $146.5 million and $324.3 million respectively.[3] Those figures cover many kinds of internet crime, not cyber liability claims alone. They still illustrate why a retail counter, a medical practice’s scheduling system, or a coastal contractor’s email inbox is not “too small to matter.”

Common entry points we discuss with local owners include:

Phishing and spoofed vendor invoices that redirect a payment or harvest login credentials
Compromised business email used to request wire changes, payroll redirects, or sensitive files
Ransomware that encrypts point-of-sale, practice-management, or file servers and may also steal data for “double extortion”
Lost or stolen laptops and phones holding customer lists, tax IDs, or health information
Vendor or cloud outages and breaches that expose data you entrusted to a third party

CISA’s #StopRansomware Guide defines ransomware as malware designed to encrypt files and systems until a ransom is demanded, and notes that many actors now steal data and threaten release (double extortion), sometimes even skipping encryption and relying on the data theft threat alone.[4] Those incidents can leave an organization unable to access the data needed to operate and can carry lasting economic and reputational costs through recovery.[4]

What a data breach actually costs (beyond the ransom headline)

When owners hear “cyber,” they often picture a ransom demand. Real incidents usually create a stack of tasks that must run in parallel: contain the problem, figure out what was taken, satisfy legal notice rules, talk to customers, and keep the doors open. The FTC’s Data Breach Response: A Guide for Business walks through that work in plain order: secure operations and stop additional loss, bring in forensics and counsel when needed, fix vulnerabilities (including at service providers), build a communications plan, and notify law enforcement, affected businesses, and individuals as the law requires.[5]

The same guide notes that all states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information, and that other federal rules can apply depending on the data type (for example, health information).[5] That is why counsel and a breach coach appear early in many cyber claims: the notice content, timing, and audience are not optional marketing choices.

Cyber insurance is designed, in part, to fund those response costs. On first-party coverage, the FTC (with content developed with the National Association of Insurance Commissioners) lists typical cost categories such as legal counsel for notification and regulatory obligations, recovery and replacement of lost or stolen data, customer notification and call center services, lost income from business interruption, crisis management and public relations, cyber extortion and fraud, forensic investigation, and certain fees, fines, and penalties related to the incident, subject to the policy wording.[1] Third-party coverage is framed as protection when others bring claims against you, including payments to affected consumers, claim and settlement expenses, certain intellectual property or defamation-type losses when included, costs of litigation and regulatory inquiries, and other settlements, damages, and judgments, again subject to form and exclusions.[1]

None of that is a promise that every policy pays every invoice. Sub-limits, waiting periods, social-engineering exclusions, unencrypted portable media conditions, and minimum security requirements vary by carrier. Our job as an independent agency is to read the form against your actual workflow, not sell a label.

First-party vs third-party: a shop-floor translation

Think of first-party coverage as “costs we incur to fix our own house after an incident,” and third-party coverage as “claims others make against us because their information or systems were harmed through us.”

| Situation (plain language) | Often first-party | Often third-party | |---|---|---| | Forensic firm maps how attackers got in | Yes | Sometimes also | | Letters and call center for customers | Yes | Usually no | | Extra payroll and lost sales while systems are down | Business interruption (if included) | Usually no | | Ransom negotiation / extortion demand (if covered) | Extortion | Usually no | | Customer or patient sues over exposed records | Usually no | Yes | | Regulator inquiry tied to the breach | May be both, form-dependent | Often | | Client alleges your firm leaked their project files | Usually no | Yes |

The FTC also suggests asking whether a policy includes a duty to defend in a lawsuit or regulatory investigation, coverage that can sit excess of other insurance, and a breach hotline available every day of the year.[1] Those operational details matter as much as the aggregate limit when something happens on a Saturday during tourist season.

Carolina notice rules shops and professional firms actually face

Insurance does not replace the legal duty to notify. Two state frameworks come up constantly for our clients who serve both shores of the Carolinas.

South Carolina. Under S.C. Code Section 39-1-90, a person conducting business in the state who owns or licenses computerized data that includes personal identifying information must disclose a security breach to a South Carolina resident whose unencrypted (or otherwise usable) personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person when illegal use has occurred or is reasonably likely to occur, or when use of the information creates a material risk of harm to the resident. Disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with law enforcement needs and measures needed to determine scope and restore system integrity.[6] The South Carolina Department of Consumer Affairs also explains that a business must let South Carolina residents know when their personal information is breached, and that when a breach affects more than 1,000 residents, the business must give the Department a copy of the notice sent to those residents.[7]

North Carolina. Under G.S. 75-65 (part of the Identity Theft Protection Act), any business that owns or licenses personal information of North Carolina residents, or that conducts business in North Carolina and owns or licenses personal information in any form (computerized, paper, or otherwise), must provide notice to the affected person after discovery or notification of a security breach. Notice must be made without unreasonable delay, consistent with legitimate law enforcement needs and measures needed to determine contact information, scope, and system integrity.[8] The statute also lists required elements of a clear and conspicuous notice, including a general description of the incident, the type of personal information involved, steps the business has taken to protect the information, contact information for the business, advice to monitor accounts and free credit reports, major consumer reporting agency contacts, and contacts for the FTC and the North Carolina Attorney General’s Office.[8]

If you operate in both states, or hold data on residents of both, you may need a response plan that can satisfy multiple notice templates at once. Clinics and other health-related businesses may also face federal health breach notification frameworks in addition to state law; the FTC’s breach guide specifically points businesses to check HIPAA and related health breach rules when electronic health information is involved.[5] That is counsel’s domain; insurance’s role is often to help fund the specialists who get the timeline right.

How cyber liability sits next to general liability, property, and crime

A standard commercial general liability policy is built around bodily injury, property damage, and certain personal and advertising injury exposures. It is not a reliable substitute for a dedicated cyber form when the loss is data confidentiality, network interruption, or social-engineering fraud. Property insurance may respond to physical damage after a fire or storm; it rarely pays to rebuild a corrupted database or notify 8,000 loyalty-program members. Crime or fidelity coverage can address some employee dishonesty or funds-transfer fraud, but wording on social engineering and computer fraud is highly form-specific and often narrower than owners expect.

In practice, we treat cyber liability as part of a broader business and commercial insurance conversation: general liability, property, business interruption, commercial auto, workers compensation, professional liability where needed, and cyber sized to the data you hold and the systems you depend on. Vendors, landlords, payment processors, and professional networks increasingly ask for cyber certificates the same way they ask for general liability. Meeting a contract’s cyber limit without understanding the exclusions is a hollow win.

Practical security steps that support underwriting (and sleep)

Insurance works best next to prevention, not instead of it. CISA’s small-business guidance emphasizes a culture of security led by ownership, a written incident response plan, multifactor authentication on email and administrator accounts, patching (including attention to known exploited vulnerabilities), tested backups, reduced admin rights on user machines, and disk encryption on laptops.[2] NIST’s Small Business Cybersecurity Corner collects free, plain-language starting points for the same themes for owners who do not staff a full security team.[9]

A short list that shows up in underwriting questionnaires for many markets:

Multifactor authentication on email, remote access, and financial systems
Documented backups that are offline or immutable, with restore tests on a calendar
Endpoint protection and timely patching on servers and workstations
Staff training that covers phishing and invoice fraud (not a one-time video)
Clear vendor access rules and offboarding when staff leave
A one-page call tree for “we think we have a breach” (who calls IT, counsel, carrier, and law enforcement)

CISA’s ransomware guide adds prevention practices grouped by common initial access vectors and a response checklist developed with partners including the FBI and NSA, aimed at IT and incident-response stakeholders inside the organization.[4] You do not need a federal agency binder on the break-room wall. You do need to know who makes the first three phone calls.

Who among coastal businesses should take this seriously

Almost any firm that stores names with Social Security numbers, driver’s license numbers, payment card data, health information, tax records, or confidential client files has a cyber story to tell an underwriter. That includes:

Retail and hospitality businesses taking cards and holding guest or loyalty data
Medical, dental, therapy, and other clinics with electronic health or billing records
Law, accounting, engineering, and consulting firms with client files and wire instructions
Contractors and suppliers using email for change orders and payments
Nonprofits and associations with donor and member databases

The goal is not to frighten you into a policy. The goal is to match limits, sub-limits, and security controls to the data and downtime your business cannot absorb out of cash flow.

Practical takeaways

Cyber liability insurance is built for breach response costs, certain extortion and interruption losses, and liability claims tied to cyber incidents; confirm first-party and third-party scopes in writing.[1]
Small organizations are targeted in part because defenses are thinner; CISA’s small-business guidance is a practical baseline for MFA, backups, patching, and an incident response plan.[2]
National 2024 IC3 data shows large and rising internet-crime losses, with BEC, phishing, data breaches, and ransomware all material to businesses.[3]
Ransomware often includes data theft threats (double extortion), not only locked screens.[4]
After a breach, follow a structured response and treat state and federal notice rules as mandatory workstreams, not optional PR.[5]
South Carolina and North Carolina each impose specific security-breach notice duties for personal information; multi-state operations need a plan that can satisfy both.[6][7][8]
Free federal small-business cybersecurity materials from CISA and NIST are worth reading before you complete an insurance application.[2][9]
Review cyber next to your full commercial program so gaps between general liability, property, crime, and cyber are intentional, not accidental.

How we can help

Beach Insurance LLC is an independent agency serving personal and commercial clients across Myrtle Beach, Charleston, Charlotte, and coastal North and South Carolina. If you want a plain-language review of cyber liability insurance for a small business (what a form covers, what underwriters will ask, and how it fits with your other commercial lines), our team can walk the application and specimen forms with you. Start with our business and commercial insurance page, request a commercial quote, or call (843) 626-9244. We will keep the conversation practical: your systems, your data, and the coverages that match them.

Citations

Federal Trade Commission, "Cyber Insurance" (n.d.; FTC small-business cybersecurity series, developed with NAIC)
Cybersecurity and Infrastructure Security Agency, "Cyber Guidance for Small Businesses" (updated April 2024)
FBI Internet Crime Complaint Center (IC3), "Internet Crime Report 2024" (2025)
Cybersecurity and Infrastructure Security Agency, "#StopRansomware Guide" (n.d.; joint ransomware prevention and response guide)
Federal Trade Commission, "Data Breach Response: A Guide for Business" (n.d.)
South Carolina Legislature / S.C. Code of Laws, "SECTION 39-1-90. Business data, breach of security; notifications, definitions, penalties, and exceptions" (current code text)
South Carolina Department of Consumer Affairs, "Security Breach Notices" (notices updated through 2026)
North Carolina General Assembly, "G.S. 75-65. Protection from security breaches" (Identity Theft Protection Act)
National Institute of Standards and Technology, "Small Business Cybersecurity Corner" (n.d.)