Cyber insurance · Jupiter, FL · FL, NY, NJ & PA
A ransomware invoice is not a property claim. A spoofed wire is not a slip-and-fall. Cyber is its own policy, and the wording decides what it pays.
If a hurricane takes the roof, the property policy is built for that fight. If ransomware locks the point-of-sale system, or someone in the office wires payroll to a fake vendor, that same policy usually will not even open the file.
A commercial property or businessowners policy is built for direct physical loss. A screen that will not unlock is not a burned kitchen. Courts have said software does not suffer “physical damage” in the way that form requires, and the cyber exclusions added to property and general liability policies since the early 2020s were written to end the argument. The ransom note, the forensic bill, the extra payroll to rebuild a server, and the weeks of lost receipts sit on a cyber form, if you have one.
Jupiter Coverage is an independent agency based in Jupiter, Florida, licensed in Florida, New York, New Jersey, and Pennsylvania. Commercial accounts in all four states are handled from the one office at 1106 W Indiantown Rd, Suite 3. We review cyber alongside the rest of the commercial file, because it is generally not covered by a property or general liability form.
Forms differ, so the wording matters more than the label. These are the parts we read first.
The everyday file: a spoofed owner email, a changed vendor invoice, a redirected payroll or rent ACH. One large cyber insurer’s 2026 claims report said business email compromise and funds-transfer fraud were 58 percent of the incidents it saw. Many forms treat a voluntary transfer as a fraud loss and point to the crime policy, so the social-engineering line and its sublimit should be read, not assumed.
The same report said the average first ransom demand in 2025 was just over $1 million, and most businesses in those files refused to pay. Refusing the invoice does not reopen the dining room or the job trailer, which is why business interruption matters.
Another cyber insurer’s claims data showed claims that included business interruption were three times worse than claims that did not. Ask how long the waiting period is, and whether a vendor or cloud outage (contingent business interruption) is covered or carved out.
Forensics, outside counsel, and notification letters are first-party cyber costs. They are not a property claim.
A lot of business packages sell “cyber” as an endorsement on the businessowners policy. AM Best’s 2025 figures, written up in July 2026, put the average premium on those endorsements at $151, against $2,287 for a primary cyber policy. Those are two different products.
Silent coverage, a small endorsement, and a primary policy with a real social-engineering limit are three different programs. Know which one you have before the controller hits send. We can review the form you already have, or shop a standalone cyber quote.
Under section 501.171, Florida Statutes, a covered business that has a breach of personal information has to notify each affected person in Florida as soon as it can, and no later than 30 days after it determines a breach happened or has reason to believe one did. If 500 or more Floridians are involved, the Attorney General gets the same notice. If more than 1,000 people must be notified at once, the credit bureaus do too.
“Personal information” is wider than a card file. It includes a name plus a Social Security number, driver license, account number with the password, medical or health-insurance information, biometric data, or a username plus password that opens an online account. If a third-party vendor, such as an MSP, a biller, or a payroll firm, has a breach of your people’s information, it has ten days to tell you. You still own the notices.
Restaurants that take cards at the table and online, car washes with memberships and pay stations, gas stations with skimmer and point-of-sale exposure, contractors moving large wires, property managers handling rent and tenant files, and offices that hold medical or employee records. The questions are the same: how money moves, what data you hold, which vendors hold it, and how long you could run without your systems.
Your current policies, including any cyber endorsement; how wires and ACH changes are approved; who your IT or MSP vendor is; whether multifactor authentication is on email and remote access; and how backups are kept and tested.
Whether the form you have covers social engineering and business interruption, at what sublimit and retention, and whether a standalone cyber policy belongs on the proposal.
Confirm you have a standalone cyber policy, not just an endorsement. Ask whether social engineering, funds-transfer fraud, and business email compromise are on the form, at what sublimit and retention, and whether a callback or other verification step is required before a wire. Turn on multifactor authentication on email and remote access, take the VPN and remote desktop off the public internet if they do not need to be there, and test a restore from a backup an attacker cannot also encrypt. Write down who you call in the first four hours. More background is in our Coverage Desk note, A ransomware invoice is not a property claim.
Attackers are not always picking you; they are picking the box you already own. One cyber insurer said 73 percent of its 2025 ransomware claims started on a VPN, and Verizon said breaches with a third party in the chain reached 48 percent of its 2026 dataset. The billing vendor, the reservations platform, the payroll company, and the MSP who owns the firewall and the backups are all part of your exposure. The vendor’s contract almost never picks this up the way you think it does, which is why contingent business interruption and the notice obligations above belong in the review.
Use the cyber liability quote request and we will call. Or call (561) 529-4949, Monday–Friday, 8:00 AM – 5:00 PM. Jupiter Coverage Corp, 1106 W Indiantown Rd, Suite 3, Jupiter, FL 33458. This page does not quote a price or bind coverage.
