Cyber Liability
First- and third-party cyber coverage for data breaches, ransomware, business email compromise, network interruption, and regulatory defense — with overlays for state breach-notification statutes and panel-counsel requirements.
Playbook Overview
- Category
- Property & Casualty
- Common Letter Types
- acknowledgmentreservation of rightscoverage investigationpartial denialfull denialpaymentstatusclosing
- High Complexity Jurisdictions
- californianew yorktexas
Cyber claims combine rapid-response incident coordination with evolving statutory duties. Correspondence must move at breach-notification speed while preserving coverage positions across first-party incident-response costs and third-party privacy/regulatory liability.
Jurisdiction Comparison Matrix
Acknowledgment, accept/deny, and payment deadlines alongside the breach notice (individuals) rule for each state. Click a column header to sort; click a state to see full requirements.
50 of 50 states
| Alabama(AL) | 15 calendar days | 30 calendar days | 30 calendar days | Yes | High |
| Alaska(AK) | 10 business days | 15 business days | 30 business days | Yes | High |
| Arizona(AZ) | 10 business days | 15 business days | 30 calendar days | Yes | High |
| Arkansas(AR) | 15 business days | 15 business days | 10 business days | Yes | High |
| California(CA) | 15 calendar days | 40 calendar days | 30 calendar days | Yes | High |
| Colorado(CO) | Reasonable time (no specific number) | 60 calendar days | 60 calendar days | Yes | Medium |
| Connecticut(CT) | Reasonable time (no specific number) | Reasonable time (no specific number) | 30 calendar days | Yes | Medium |
| Delaware(DE) | 15 business days | 30 calendar days | 30 calendar days | Yes | High |
| Florida(FL) | 7 calendar days | 60 calendar days | 60 calendar days | Yes | High |
| Georgia(GA) | 15 calendar days | 15 calendar days after receiving proof of loss, or 30 calendar days from notice of claim if no proof of loss is required; 60 calendar days absolute maximum (Ga. Comp. R. & Regs. 120-2-52-.03(3) & (5)) | 10 calendar days | Yes | High |
| Hawaii(HI) | 15 business days | Reasonable time (no specific number) | 30 calendar days | Yes | Medium |
| Idaho(ID) | Reasonable time (no specific number) | Reasonable time (no specific number) | 30 calendar days | Yes | Medium |
| Illinois(IL) | 15 business days | Reasonable time (no specific number) | 30 calendar days | Yes | Medium |
| Indiana(IN) | Promptly (no specific number) | Reasonable time (no specific number) | Promptly (no specific number) | Yes | Medium |
| Iowa(IA) | 15 calendar days | C30 (extendable with notice within the 30-day period) | 30 calendar days | Yes | High |
| Kansas(KS) | 10 business days | 15 business days | Promptly (no specific number) | Yes | High |
| Kentucky(KY) | 15 | Reasonable time (no specific number) | 30 calendar days | Yes | High |
| Louisiana(LA) | 14 calendar days | REASONABLE (written offer to settle within C30 after receipt of satisfactory proofs of loss) | C30 (C60 for catastrophic residential property claims) | Yes | High |
| Maine(ME) | Reasonable time (no specific number) | Reasonable time (no specific number) | C30 (for non-fire property claims after proof of loss is received); C60 (for fire policies after proof of loss is received and ascertainment of the loss is made) | Yes | Medium |
| Maryland(MD) | 15 business days | 15 business days | Promptly (no specific number) | Yes | High |
| Massachusetts(MA) | REASONABLE (Reasonably promptly per Mass. Gen. Laws ch. 176D, § 3(9)(b)) | REASONABLE (Within a reasonable time after proof of loss per Mass. Gen. Laws ch. 176D, § 3(9)(e); 15 days to notify intention to rebuild/repair per Mass. Gen. Laws ch. 175, § 99) | C30 (Within 30 days after statement of loss or executed proof of loss per Mass. Gen. Laws ch. 175, § 99) | Yes | Medium |
| Michigan(MI) | Promptly (no specific number) | Reasonable time (no specific number) | 60 calendar days | Yes | Medium |
| Minnesota(MN) | 10 business days | B60 (after proof of loss) / B30 (after notification of claim, unless delayed and properly noticed) | B5 (from settlement agreement receipt or condition performance); C60 (after proof of loss and ascertainment under Standard Fire Policy) | Yes | High |
| Mississippi(MS) | Promptly (no specific number) | REASONABLE (case law) | REASONABLE (case law) | Yes | Medium |
| Missouri(MO) | 10 business days | 15 business days | Promptly (no specific number) | Yes | High |
| Montana(MT) | Reasonable time (no specific number) | 30 calendar days to pay or discharge any duty, extendable to 60 calendar days with reasonable request for additional information; interest accrues after the 30/60 day period (Mont. Code Ann. § 33-18-232(1)). Must affirm or deny within a reasonable time (§ 33-18-201(5)). | C30 (extendable to C60 if additional information was requested) | Yes | High |
| Nebraska(NE) | 15 calendar days | 15 calendar days | 15 calendar days | Yes | High |
| Nevada(NV) | 20 business days | 30 business days | 30 calendar days | Yes | High |
| New Hampshire(NH) | 10 business days | No strict deadline; must decide within 5 working days of receiving requested documentation or send a delay letter (N.H. Admin. Code Ins 1002.05(d)-(e)) | 5 business days | Yes | High |
| New Jersey(NJ) | 10 business days | 30 calendar days | 10 business days | Yes | High |
| New Mexico(NM) | Reasonable time (no specific number) | Reasonable time (no specific number) | Promptly (no specific number) | Yes | Medium |
| New York(NY) | 15 business days | 15 business days | 5 business days | Yes | High |
| North Carolina(NC) | 30 calendar days | Reasonable time (no specific number) | 60 calendar days | Yes | Medium |
| North Dakota(ND) | Reasonable time (no specific number) | Reasonable time (no specific number) | Promptly (no specific number) | Yes | Medium |
| Ohio(OH) | 15 calendar days | 21 calendar days | 10 calendar days | Yes | High |
| Oklahoma(OK) | 30 calendar days | 60 calendar days | No specific statutory or regulatory requirement found | Yes | Medium |
| Oregon(OR) | 30 calendar days | 30 calendar days | No specific statutory or regulatory requirement found | Yes | High |
| Pennsylvania(PA) | 10 business days | 15 business days | No specific statutory or regulatory requirement found | Yes | High |
| Rhode Island(RI) | 15 calendar days | 21 calendar days | 30 calendar days | Yes | High |
| South Carolina(SC) | Promptly (no specific number) | Promptly (no specific number) | 90 calendar days | Yes | Medium |
| South Dakota(SD) | C30 (SDCL § 58-33-67(1)); PROMPTLY (SDCL § 58-12-34(2)); C15 to provide forms (SDCL § 58-12-34(13)) | REASONABLE (SDCL § 58-12-34(7)) | PROMPTLY (SDCL § 58-12-34(4)) | Yes | Medium |
| Tennessee(TN) | 30 calendar days | 60 calendar days | 30 calendar days | Yes | Medium |
| Texas(TX) | C15 (B15 presumed reasonably prompt under 28 TAC § 21.203(2)) | B15 (extendable to C45 with notice) | 5 business days | Yes | High |
| Utah(UT) | 15 calendar days | 30 calendar days | 30 calendar days | Yes | High |
| Vermont(VT) | 10 business days | 15 business days | B10 (C60 for fire insurance) | Yes | High |
| Virginia(VA) | 15 calendar days | C15 (extendable with notice) | Promptly (no specific number) | Yes | High |
| Washington(WA) | 10 business days | 15 business days | 15 business days | Yes | High |
| West Virginia(WV) | 15 business days | 10 business days | 15 business days | Yes | High |
| Wisconsin(WI) | 10 calendar days | Reasonable time (no specific number) | 30 calendar days | Yes | High |
| Wyoming(WY) | Promptly (no specific number) | 45 calendar days | 45 calendar days | Yes | Medium |
Cyber Liability Case Law
Recent and frequently cited cyber liability decisions across the 50 states. State abbreviation appears after each case name — follow through to a jurisdiction page for the full list.
- Case Law
Pinto v. Farmers Insurance Exchange (CA)
61 Cal. App. 5th 676 (2021)
Bad FaithDuty to DefendAutoCommercial AutoCyberGeneral LiabilityInland / Ocean MarineProfessional LiabilityClarified the third-party failure-to-settle standard. Rejecting a strict liability approach, the court held that failing to accept a reasonable settlement demand within limits is not bad faith per se. The plaintiff must explicitly prove that the insurer's failure to settle was unreasonable under the circumstances .
- Case Law
Summit Insurance Company v. Stricklett (RI)
199 A.3d 523 (2019)
Bad FaithCyberHomeownersexplicitly held that the duty of good faith does not run to a third-party claimant absent a formal assignment of rights from the insured .
- Case Law
Wilson v. 21st Century Ins. Co (CA)
42 Cal. 4th 713 (2007)
Bad FaithAutoCommercial PropertyCyberHomeownersInland / Ocean MarineProfessional LiabilityWorkers' CompClarified and limited the "genuine dispute doctrine." The court held that a dispute is not "genuine" (and thus cannot defeat a bad faith claim as a matter of law) unless the insurer's position is maintained in good faith and on reasonable grounds.
- Case Law
McKinley v. Guaranty National Ins. Co (ID)
159 P.3d 884 (2007)
Bad FaithStatus UpdatesCommercial PropertyCyberGeneral Liabilitythe Idaho Supreme Court expanded on what this communication duty entails proactively. The court held that an insurer must make a diligent effort to investigate and subsequently "communicate the results of such investigation to the insured" . In McKinley, the insurer received early settlement overtures from the claimant a month before a formal policy limits demand was made.
- Case Law
Schumacher v. State Farm Fire & Casualty Co (NV)
467 F. Supp. 2d 1090 (2006)
Bad FaithCyber. A mere disagreement in the value of a case, following a fair and reasonable investigation, is not sufficient grounds to establish bad faith .
- Case Law
Albert H. Wohlers & Co. v. Bartgis (NV)
969 P.2d 949 (1998)
Bad FaithCommercial PropertyCyberestablished that an insurer cannot use self-created ambiguities to claim a dispute is fairly debatable . Sierra Health and Life Ins. Co. v. Eskew (2024) recently reaffirmed that a belief that a claim is fairly debatable is a defense, but its validity is up to the jury .
Show 6 more cases
- Case LawStatus UpdatesAutoCommercial AutoCommercial PropertyCyberGeneral LiabilityInland / Ocean Marine
the appellate court clarified that while an insurer may not misrepresent facts or fail to clarify an insured's obvious misunderstanding, "it does not have an ongoing duty to keep the insured informed of his or her rights once those rights have been clearly set forth in the policy," unless the insurer is engaging in conduct designed to mislead .
- Case Law
Reynolds v. Shelter Mut. Ins. Co., 313 Ark. 145 (AR)
852 S.W.2d 799 (1993)
Status UpdatesCyberGeneral LiabilityHeld that an insurance company waiting three months to investigate a claim, or failing to act promptly, does not rise to the level of malicious or oppressive conduct required for a bad faith claim. Current Status: Good law; frequently cited to dismiss bad faith claims based on communication delays or lack of investigation. - Moffit v. State Farm Mut. Auto. Ins. Co., 14 F.4th 874 (8th Cir.
- Case Law
Seifert v. Farmers Union Mut. Ins. Co (ND)
497 N.W.2d 694 (1993)
Bad FaithCyber(discussing Corwin Chrysler-Plymouth). URL: https://law.justia.com/cases/north-dakota/supreme-court/1993/920109-3.html
- Case LawStatus UpdatesAutoCommercial AutoCommercial PropertyCyberGeneral LiabilityInland / Ocean Marine
The duty of good faith does not permit an insurer to passively assume that its insured is aware of their rights under the policy. The insurer must take affirmative steps to ensure the insured is informed of their remedial rights (such as arbitration or peer review) when a claim is denied or disputed . - Current Status: Good law; landmark California Supreme Court decision. - Davis v.
- Case Law
San Diego Navy Federal Credit Union v. Cumis Insurance Society, Inc (ID)
162 Cal. App. 3d 358 (1984)
Duty to DefendReservation of RightsAutoCommercial AutoCommercial PropertyCyberGeneral LiabilityHomeownersInland / Ocean MarineProfessional LiabilityWorkers' Comp162 Cal.App.3d 358, the California Court of Appeal recognized that when an insurer defends under a reservation of rights, the defense attorney retained by the insurer is placed in an impossible ethical position: the attorney's fees are paid by the insurer, but the attorney owes a fiduciary duty to the insured .
- Case Law
Aetna Cas. & Sur. Co. v. Broadway Arms Corp., 281 Ark. 128 (AR)
664 S.W.2d 463 (1984)
Closing LettersStatus UpdatesCyberGeneral LiabilityEstablished the standard for first-party bad faith in Arkansas.
Historical court cases are for reference only and may be superseded, distinguished, or abrogated.
Applicable Letter Templates
- Coverage Investigationcoverage investigation
- FNOL / Intakeacknowledgment
- Coverage Investigationstatus
- Denial / Closurefull denial
- Denial / Closurepartial denial
- Payment & Settlementpayment
- Coverage Investigationcoverage investigation
- Coverage Investigationreservation of rights
