New Hampshire
Cyber Insurance

Ransomware attacks against New Hampshire businesses have grown more targeted and more expensive. Attackers research their victims, understand their revenue, and set ransom demands accordingly. A $50,000 demand against a small manufacturer isn't random: it's calculated to be painful enough to motivate payment but low enough to seem cheaper than the alternative.

Coverage for Ransom Payments and Negotiations

Most cyber policies cover ransom payments, but the mechanics matter. Carriers typically require that you use their approved negotiation team, often staffed by former law enforcement professionals who specialize in communicating with threat actors. Going rogue and paying directly without insurer involvement can void your coverage entirely.

One critical nuance: OFAC (Office of Foreign Assets Control) sanctions compliance. If the attacker group is on a sanctions list, paying the ransom could expose your business to federal penalties regardless of what your insurance policy says. A good policy includes pre-payment sanctions screening and legal guidance to protect you from inadvertently violating federal law. This is an area where working with an experienced agency like Avery Insurance, which has spent over 125 years advocating for clients, makes a material difference in policy selection.

Business Interruption and Data Restoration Costs



The ransom payment itself is often the smaller expense. Business interruption losses: the revenue you lose while systems are down: frequently dwarf the ransom demand. A Portsmouth hospitality business that loses its reservation system during peak summer season could hemorrhage $20,000 or more per day. A Manchester logistics company that can't dispatch trucks faces similar cascading losses.

Cyber business interruption coverage typically includes a waiting period (often 8 to 12 hours) before coverage kicks in, then pays for lost net income and extra expenses incurred to maintain operations. Data restoration coverage pays for the cost of rebuilding databases, reconfiguring systems, and recovering files from backups. If your backups were also compromised, which sophisticated attackers specifically target, restoration costs can be staggering.

Factors Influencing Premium Costs and Deductibles

Cyber insurance premiums in New Hampshire vary widely based on several factors:

• Industry sector (healthcare and financial services pay more)
• Annual revenue and number of records stored
• Existing security controls (MFA, endpoint detection, backup protocols)
• Claims history
• Policy limits and retention (deductible) amounts

A typical NH business with $5 million to $20 million in revenue can expect premiums ranging from $3,000 to $15,000 annually for $1 million in coverage. Businesses with strong security postures and no prior claims land at the lower end. Those in high-risk sectors or with weak controls pay significantly more, or face declination altogether.

Implementing Minimum Security Controls for Insurability

Carriers have tightened underwriting requirements dramatically since 2023. Most now require, at minimum:

• Multi-factor authentication on all remote access and email
• Endpoint detection and response (EDR) on all devices
• Regular, tested offline backups
• Employee security awareness training
• A documented incident response plan



Failing to meet these requirements doesn't just increase your premium: it can make your business uninsurable. The Avery Insurance team works with clients to identify gaps before the application process, connecting them with trusted IT security partners across New Hampshire who can help implement the required controls.

Cyber risk isn't theoretical for New Hampshire businesses: it's a present, measurable threat that demands a specific insurance response. The right policy covers data breach notification costs, ransomware recovery, business interruption, and the legal and reputational fallout that follows an incident. The wrong policy, or no policy at all, leaves your business exposed to costs that can reach seven figures.

Start by assessing your actual exposure: how much sensitive data you hold, what your daily revenue loss would look like during a system outage, and whether your current security controls meet insurer requirements. Then talk to an agency that understands both the coverage and the threat. Avery Insurance Agency's consultative approach is built for exactly this kind of risk analysis, helping NH businesses uncover vulnerabilities and build protection that actually holds up when tested. Reach out for a cyber risk assessment before your next renewal.

Does my general liability policy cover cyber incidents? Almost certainly not. Standard GL and BOP policies either exclude cyber events entirely or provide only minimal, inadequate sublimits. You need a standalone cyber policy.

How quickly does cyber insurance respond after a breach? Most carriers activate their incident response teams within 2 to 4 hours of notification. The faster you report, the faster containment begins.

Are ransomware payments actually legal? Generally yes, but payments to sanctioned entities can violate federal law. Your insurer's negotiation team handles OFAC screening before any payment is authorized.

What's the average cost of a data breach for a small NH business? Estimates vary, but businesses with fewer than 500 employees typically face total breach costs between $120,000 and $500,000, including response, notification, legal fees, and lost business.

Do I need cyber insurance if I outsource my IT to a managed service provider? Yes. MSP contracts typically limit their liability, and a breach originating through your provider still triggers your notification obligations and business losses.