For a webshop the checkout page is both your engine of turnover and the most attractive target: every hour it does not work is directly measurable loss.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
A webshop has no alternative channel. If the site is down through ransomware, a denial-of-service attack or a failed integration, there is no counter where customers can still pay. The loss of turnover is, moreover, unusually easy to prove, because you have the turnover per hour from the same weeks last year. That makes the conversation about business interruption cover more concrete than in most sectors.
There is also a customer file with addresses, order history and account details, and payment traffic runs through your payment service provider. The most dangerous attack is not the visible one: in skimming a piece of script is added to your checkout page that reads payment details as they are entered while the shop simply carries on running, sometimes for weeks before anyone notices.
If you mainly sell in a physical shop with a webshop alongside it, also look at the cyber insurance for shops; if your shop is built and maintained by an agency, the web agency version is relevant for that party.
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Skimming on your own checkout page stays invisible for a long time
An attacker who gets in through an outdated extension does not need to take your shop down: he adds code that reads payment and address details at checkout. Orders keep coming, you notice nothing, and the number of people affected grows by the day. Check the integrity of your checkout page and keep track of when you updated extensions. Insurers exclude loss arising from vulnerabilities for which a patch had been available for some time.
Downtime counts per hour, but only after the waiting period
Business interruption cover pays for lost turnover, but almost always only after a waiting period of a number of hours or a day. Many outages last exactly that long and then produce nothing. So discuss in advance what waiting period applies, how turnover is calculated during a seasonal peak and whether additional costs of getting back online sooner are reimbursed. Also ask whether failure at your hosting provider or payment service provider is included.
What a webshop specifically does not get paid for
Fraudulent orders using stolen payment details, chargebacks by the payment service provider and fines from the card schemes fall outside cyber cover. That is trading risk, not data loss. Stock stolen or not delivered belongs with your goods or transport insurance. And an administrative fine from the Autoriteit Persoonsgegevens (the Dutch data protection authority) is not insurable. What is covered is forensic investigation, recovery, notification costs and the claims of customers whose data has leaked.
Your integrations determine how far the outage reaches
A shop rarely stands alone: there is a stock system, a parcel carrier, an accounting link and often a sales channel on a marketplace. If one link drops out, orders keep coming in that you cannot fulfil, with complaints and cancellations as a result. Map out which links are business-critical and what manual fallback exists; that determines how much loss caused by downtime an incident actually produces.
What does your premium depend on?
Annual online turnover. Turnover per hour is the basis of calculation for business interruption cover when the shop is down.
Number of customer accounts and order history. How many addresses and order details you keep determines the scale of the duty to report after a breach.
How the payment process is set up. Paying through a hosted environment at your payment service provider limits what can be intercepted on your own page.
Platform and how current your extensions are. Outdated webshop software with many added modules is the most common way in.
Seasonal peaks. An outage in a peak week costs many times an average day; insurers take that into account in the cover.
Dependence on hosting and integrations. An outage at your hosting provider, payment service provider or carrier stops your sales without you being hit yourself.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Our shop was down for a day. Does the insurance pay the turnover we lost?
Only if the cause is a covered security incident and the outage lasted longer than the waiting period in the policy. An ordinary fault at your host is usually covered only if you included that extension. When an incident occurs, keep your turnover figures for comparable days. The loss is calculated on that basis and not on an estimate made afterwards.
Someone ordered using stolen credit card details. Is that covered?
No. Fraudulent orders and chargebacks are trading risk and fall outside cyber insurance. That covers loss arising from a security incident in your own environment: investigation, recovery, downtime and liability after a data breach. For payment fraud on the sales side, the arrangements with your payment service provider are decisive, together with the checks you build into the ordering process.
We use a hosted payment page. Does that reduce our risk?
Yes, considerably, because card details then do not pass through your own environment. The risk does not disappear: address, account and order details still sit with you and an attacker can still redirect visitors to a copied page. Insurers do reward this set-up in their assessment. State exactly how your checkout process works in the application.
Do we have to inform customers if payment details have been read?
As a rule, yes. With payment and identity details the risk to those concerned is high, and then the GDPR requires a message to the customer as well as the report to the regulator. The costs of that process fall under the notification costs cover. The condition is that you reported the incident to the insurer in good time, as Article 7:941 of the Dutch Civil Code requires.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
