An online store earns money only while the checkout works. If an attacker takes the site down in your busiest week, or hides code that copies card details, the loss starts within hours.
Cyber insurance for e-commerce and retail pays for the response, the lost sales and the claims that follow. Underwriters judge how you take payments, how much customer data you hold and how fast you could trade again.
Why insurers look closely at retail and e-commerce
Retailers handle card payments, and card data carries its own rules under the PCI DSS standard. A breach can bring card brand fines and assessments on top of the usual response costs.
Most stores also run on other companies' services: a store platform, a payment gateway, plugins and a delivery partner. Each one is a door into your business. Sales often peak in a few weeks each year, so a short outage at the wrong time hurts.
For example, a fashion retailer with four shops and one online store takes card payments in person and online. The underwriter will ask about both channels, and about who can change the website code.
The cyber risks underwriters see in retail and e-commerce
- Web skimming. Criminals add hidden code to the checkout page and copy every card number typed in.
- Account takeover. Attackers use stolen passwords from other sites to log in to customer accounts and spend stored credit.
- Ransomware on stock or point-of-sale systems. Shops cannot take payments, and the warehouse cannot pick orders.
- Fake websites. A copycat site uses your brand, takes customer payments and ships nothing.
- Goods sent to a criminal. A fake email from a trusted trade customer asks you to ship a large order to a new address.
- Platform outages. Your store platform or payment provider goes down on a sale day.
What underwriters usually ask retail and e-commerce businesses
- Do you store, process or transmit card data, and what is your PCI DSS status and merchant level? Your attestation of compliance or self-assessment questionnaire answers this.
- How many customer records do you hold? A data inventory gives the number.
- Is MFA on for every user, including the store admin, email and payment dashboards? A console screenshot is the evidence.
- How do you secure the website? A recent vulnerability scan and a record of plugin updates help here.
- Do you apply critical and high patches within one month? A patch report answers it.
- Which hosted providers do you depend on? List the platform, payment gateway and hosting.
- Do you watch for websites that impersonate you? A monitoring record or takedown log shows you do.
- Can you restore the store and the order database from backups? A dated restore test from the last six months is what many forms ask for.
Cover that matters most for retail and e-commerce
- Business interruption. Lost income while the store is down, after the waiting period. For example, agree an indemnity period that covers a full peak season, and keep sales records ready to prove the loss.
- PCI fines, penalties and assessments. Many wordings cover card brand fines and assessments after a card breach. Chargebacks are often excluded, so check your wording.
- Privacy breach management and liability. Notifying customers, identity monitoring and claims for failing to protect their data.
- Customer payment fraud and corporate identity theft. Some wordings reimburse customers who paid a fake site posing as you, and pay to take that site down.
- Physical goods fraud. Cover for goods sent to the wrong party after social engineering. It usually pays the cost price of the goods.
- Dependent business interruption. Income lost when a platform you rely on fails. Some wordings exclude failures of payment platforms or wider internet infrastructure, so ask your broker how yours reads.
Our guide to cyber insurance exclusions explains the chargeback and infrastructure exclusions in more detail.
How PrismX helps retail and e-commerce businesses get insurance ready
- Discover records your channels, systems, customer data and suppliers, from the store platform to the payment gateway.
- Assess checks each control and shows how your answers look on the insurer's question set, including the card data questions.
- Improve turns gaps into actions with owners and dates, for example "update checkout plugins, owner: web lead, due Friday".
- Verify runs checks from outside, such as your website and email setup, and gives each uploaded document an AI check and advisor verification. Expiry stays visible: a patch attestation counts for three months.
- Submission pack: PrismX builds a signed pack with a sha256 fingerprint.
- During an incident: in the pilot, PrismX tracks the policy clocks.