"Who would want my data, I'm just a one-person business?" That exact mindset is precisely what makes freelancers and small businesses one of the most attractive targets for cybercriminals. Hackers don't go after the biggest prize, they go after the easiest one.
The mistake: "I'm too small to be a target"
Most cyberattacks today run fully automated. Bots scan the internet around the clock for outdated software, weak passwords, and open security gaps, completely indifferent to whether they hit a large corporation or a one-person practice. That's exactly what makes small businesses a preferred target: they rarely have a dedicated IT security team, yet handle just as much sensitive client and payment data as large companies.
Why general and professional liability aren't enough
Many freelancers assume that public liability or professional indemnity insurance already covers them. That's only partly true: those policies respond to damage caused to third parties, not to the costs a business incurs itself from a cyberattack. As I explained in the Freelancer Liability Trap, gaps often exist between individual policies, and that's exactly where a standalone cyber policy steps in.
- Business interruption: If your systems are down for days after a ransomware attack, general liability won't pay for lost income.
- Ransom payments: If you pay to unlock an encryption, that's not a typical liability claim.
- GDPR fines: If a data breach exposes client data, notification duties and fines apply regardless of the underlying IT damage.
- IT forensics: Tracing the source of an attack and cleaning up systems can cost several thousand euros, even without any third party being harmed.
Did you know?
Under GDPR, you generally must report a data breach to the relevant supervisory authority within 72 hours, regardless of your business size. Missing that deadline risks additional fines on top of the breach itself.
The 4 building blocks of a solid cyber policy
- First-party damage: Costs for data recovery, system cleanup, and lost income during downtime.
- Third-party liability: Liability towards clients or partners if their data is affected by the attack.
- Crisis management: Access to IT forensics, specialized lawyers, and PR consultants, often via a 24/7 hotline.
- Ransom payments: Cover for extortion demands in a ransomware case, including advice on whether and how to pay.
Why prevention alone isn't enough
An up-to-date antivirus and regular backups matter, but they don't stop every attack. As your fiduciary representative, I compare cyber tariffs customized to the size and risk profile of your business, so you're not paying for components you don't actually need as a freelancer. You'll find full details on coverage, limits, and common questions on the cyber insurance overview page.
Checklist: Are you protected against cyber risk?
- Is business interruption from a system outage covered?
- Are IT forensics and crisis management included when it matters?
- Does the policy respond to GDPR breaches (legal defense, notification obligations, and compensation claims) after a data breach?
- Do you know whether your general liability explicitly excludes cyber damage?