Cyber liability claims are growing, making practitioners and insurance carriers more vulnerable.
According to a recently published report by Gartner Group and Check Point Research (Rough Notes, September 2026), organizations are now experiencing twice the likelihood of a cyber claim incident in 2026 compared to 2021, boosting security expenditures by 24% to $240 billion in 2026.
The report identified three cyberattack trends:
- Ransom demands are increasing.
- Data theft drives ransomware severity more than encryption alone.
- Email compromise remains the gateway for financial losses.
These cyberattacks demand a more resilient, multilayered security defense.
Ransom Demands
Ransom demands are the costliest cyber threat. In 2025, they increased by 47% over 2024. However, 86% of victims refused to pay because they are becoming better prepared with data backups, recovery protocols, and cyber incident response plans.
We have seen prime targets among private medical group practices, such as cardiothoracic surgery, cardiovascular surgery, and thoracic surgery practices, with gross group revenues per individual ranging from $4 million to $11 million annually.
While small social work practices are not as frequent a target of ransomware attacks, all social workers, regardless of the size of their practice, are subject to potential civil damages and criminal penalties arising from federal HIPAA and HITECH requirements under 45 CFR Part 160.
In our opinion, the best approach is to purchase a cyber liability policy with a zero deductible and a coverage limit of $15,000 to $25,000, which is typically sufficient to cover HIPAA and HITECH liability arising from a third-party data breach.
Data Theft
Data theft paired with encryption has heightened dual-extortion tactics. An example is locking systems and stealing data, a process known as exfiltration. These tactics account for 70% of all ransomware claims.
Data theft creates legal, operational, and reputational damage. VPNs (virtual private networks) with exposed login panels were the entry points for theft in 59% of ransomware claims.
To prevent and mitigate risk exposure, move toward a zero-trust network architecture and proactive risk management, together with a cyber liability insurance policy.
Email Door
Email accounts for most financial losses, primarily from funds transfers. These incidents typically involve a compromised inbox, fake payment instructions that appear legitimate, and convincing messages prompting action.
Business email compromise accounts for 52% of funds transfer fraud.
Practices need to implement authentication software and application controls for their email systems, identity management, and financial management processes. Employees and practice owners who manage funds and have payment authority need training in email risk management protocols.
PRO TIP
Create a layered security defense to guard against cyberattacks. While purchasing a cyber liability insurance policy is crucial, it is a passive model. The insurance policy only responds after damage or loss has occurred.
Move toward a proactive model based on preparedness to prevent and mitigate cyber damage and pair it with a rapid-response playbook.
Because of the seriousness of federal HIPAA and HITECH requirements under 45 CFR Part 160, it is important to repeat the following information from an earlier Tip of the Month.
Third-Party Breach: This type of incident occurs when a digital service provider or a furniture mover handling your files exposes your patient records to a data breach.
Professional liability policies generally do not cover this type of claim without an endorsement or the purchase of a separate policy, which may require a substantial additional premium.
Other cyber liability insurance claims may require an attorney for your legal defense at an hourly rate of $250 to $850, plus an advance retainer of $5,000 to $10,000.
The Preferra Cyber Liability insurance policy protects you with comprehensive coverage at a lower cost than other insurance carriers. Depending on the policy limit, the annual premium is approximately $100 for $12,000 in coverage. Preferra recommends a $25,000 Cyber Liability policy limit for less than an additional $100 in annual premium.
Let’s take a closer look at third-party breaches.
45 CFR Part 160 (General Administrative Requirements) and Part 164 (Security and Privacy), which are part of the HIPAA and HITECH regulatory framework, establishing serious civil and criminal penalties arising from breaches of third-party client records.
Here is a list of the expenses and liabilities associated with these requirements that the Preferra Cyber Liability policy covers:
- Pays legal defense costs arising from your client’s claim, as well as legal defense costs for civil actions brought by federal and state authorities.
- Pays the costs of notifying each affected client in your practice in writing, by mail through the U.S. Postal Service, as required by applicable law.
- Pays the cost of a one-year subscription to identity theft protection for clients who were victims of the breach.
- Pays the cost of covered civil fines and penalties.
- Pays the cost of an auditor to investigate the breach, including a forensic investigation of system security.
- Pays the cost of system restoration.
- Pays costs arising from advertising injury in connection with the breach.
A recent literature search indicates that third-party breaches, also referred to as supply chain risks, account for 35% of incidents, exposing more than 10 million client records annually.
While these individual cases are not as large as major breaches involving financial institutions and credit card issuers, they can be significant enough to bankrupt your practice.
