Contractors rarely think of themselves as data companies, yet most move large sums through email and cloud platforms every week. This guide explains how attacks actually reach a contracting business, which policy each loss belongs to, and what California requires once employee or customer data is exposed.
✓Payment-Diversion Fraud
✓Ransomware in the Office
✓Cyber vs. GL vs. Crime
Reviewed by David Gleason, Principal — October 11, 2026
CaliforniaGeneral information only, not legal advice — illustrative scenarios and coverage, subject to change without notice. Content may be out of date or contain errors, and requirements vary by city, county, state, agency, project, contract, carrier and policy, among other factors; verifying what applies to your own situation is your responsibility. Full disclaimer
Prefer to send everything at once? Complete a streamlined submission — just needs your review. Especially worth it if your business does $2M+ in annual sales — it can meaningfully speed up carrier turnaround.
Interactive coverage guide
Build a coverage stack around how the business actually operates.
Start with the preselected industry or trade, then adjust the operational questions. The commonly considered stack updates live. Keep the coverages you want GIB to evaluate, remove ones you do not want included in your quote request, and add other available lines before continuing.
Common Starting Coverages
General LiabilityThird-party injury and property damage
What it is
General Liability commonly addresses covered third-party bodily injury, property damage and certain personal or advertising injury claims, subject to the policy.
Why businesses like yours commonly carry it
Businesses commonly use it as a starting liability policy and to satisfy customer, landlord or contract requirements.
Possible coverage gap
General Liability is not intended to replace policies for employee injuries, business vehicles, owned property, cyber events or professional errors.
Cyber Liability & Data BreachCyber events, data and system interruption
What it is
Cyber insurance may address certain first-party and third-party losses from covered data breaches, cyberattacks, ransomware and system interruption, depending on the policy.
Why businesses like yours commonly carry it
Contractors move progress payments, subcontractor invoices and payroll electronically, and payment-change fraud aims at exactly that flow.
Possible coverage gap
General Liability generally should not be assumed to address data breach response, ransomware or network interruption.
Educational guidance only. Results are not a coverage recommendation, quote, binder, policy interpretation, or guarantee of coverage. Actual needs, availability, forms, limits, exclusions and requirements vary. A licensed insurance professional should review the complete risk and issued policy terms.
Verified Google reviews
What our cyber insurance clients say about us
5.0 / 5from 7 Google reviews
Reviews reflect individual client experiences and are not a guarantee of coverage, pricing or results.
91 Enterprise LLC
March 24, 2026
We are using Gleason insurance for our commercial auto policy and GL policy. David is the best insurance broker I've worked with — very honest, responsive, and knowledgeable. Highly recommend.
Fito Plumbers
February 20, 2026
We have been working with David at Gleason Insurance Brokers for 8+ years. David always goes above and beyond to make sure we have the appropriate coverages. He explains everything in detail and makes sure we feel confident and understand all of our policies. He is always available and responds right away!
Barry Stay
February 17, 2026
David provides great service and I highly recommend him for your insurance needs.
How cyber attacks actually reach a contracting business
For a California contractor, the costliest cyber event is seldom a stolen customer database. It is far more often a single redirected payment, a hijacked payroll account or a ransomware outage that stops estimating, project management and billing at once while crews keep working in the field.
The national numbers point the same way. The FBI's Internet Crime Complaint Center received 859,532 complaints in 2024 with reported losses of $16.6 billion, and business email compromise alone accounted for about $2.77 billion. California led every state, with 96,265 complaints and about $2.54 billion in reported losses.
The biggest loss is usually one diverted payment, not a data dump
Ransomware can stop the office while field crews keep working
Business email compromise drew about $2.77 billion in 2024 losses
California led the nation in reported cybercrime complaints and losses
Payment-diversion fraud: progress payments, invoices and payroll
Construction accounting teams receive bank-change notices, invoices and pay applications from dozens of companies. An attacker who compromises a supplier's or subcontractor's mailbox can wait for a real invoice, then reply inside the genuine thread with new bank details. The request looks routine because, apart from the account number, it is.
Payroll is the second target. A message that appears to come from an employee asks HR to change a direct-deposit account, or a compromised executive mailbox requests W-2 data. The FBI's guidance on business email compromise is to confirm any change in account information through a separate channel, and federal guidance for small businesses adds that the confirming phone number should not come from the message itself.
Attackers reply inside real invoice threads with new bank details
Direct-deposit changes and W-2 requests target payroll
Confirm account changes through a separate, known channel
Never use a phone number supplied in the suspicious message
Ransomware and the project office
Estimating, scheduling, submittals, accounting and document control increasingly live on connected servers or cloud platforms. When ransomware encrypts them, the cost is lost bids, delayed pay applications and the expense of restoring systems, even if no jobsite is touched.
The Cybersecurity and Infrastructure Security Agency publishes a #StopRansomware guide with prevention and response checklists, and the U.S. Treasury's Office of Foreign Assets Control has advised that the government strongly discourages paying ransom demands and that payments can carry sanctions risk. A cyber policy's extortion coverage, where included, is written with those constraints in mind.
Ransomware can stall bids and pay applications without a jobsite loss
Restoration costs add to the lost productivity
CISA publishes free prevention and response checklists
Federal guidance discourages ransom payments and flags sanctions risk
Phones, tablets and jobsite logins
Superintendents, project managers and foremen sign in to email, plans and accounting from phones and tablets on jobsite and public networks. A lost device or a reused password can become the entry point, which is why underwriters ask about multi-factor authentication, device management and how quickly a departing employee's access is removed.
Shared logins to owner portals, supplier accounts and project platforms are another common gap. When several people use one credential, no one can tell which session was compromised, and removing access means changing it for everyone.
Field devices on public networks are real entry points
Multi-factor authentication and device management limit the damage
Remove a departing employee's access the day they leave
Shared portal logins make compromises harder to trace
What cyber, general liability and crime insurance each cover
General liability is written for bodily injury and property damage, and many current forms exclude or narrowly limit electronic data. Cyber insurance is where breach response, ransomware, business interruption from a network outage and liability to others for a data incident are typically found. Commercial crime insurance addresses employee theft and certain computer and funds-transfer fraud.
Payment fraud is where these overlap. Depending on the forms, a tricked employee's transfer may fall under a cyber policy's social-engineering coverage, a crime policy's fraudulent-instruction coverage, both or neither, so the two should be read together. Our explainer on wire fraud under cyber and crime policies walks through the differences.
General liability: injury and property damage, often excluding data
Cyber: breach response, ransomware, interruption, data liability
Crime: employee theft and certain computer or transfer fraud
Payment fraud can sit in cyber, crime, both or neither
California rules that apply once contractor data is exposed
Contractors hold Social Security numbers, bank details and driver's license numbers for employees, and often personal information for homeowner clients. Under California Civil Code section 1798.82, as amended by SB 446 effective January 1, 2026, affected California residents must be notified within 30 calendar days of discovering a breach, subject to limited delays, and a sample notice must go to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are involved.
Larger contractors may also meet the California Consumer Privacy Act's thresholds, which the California Privacy Protection Agency adjusted for inflation in 2025 (including annual revenue above $26,625,000). For those businesses, consumers can seek statutory damages of $107 to $799 per consumer per incident after certain breaches, or actual damages if greater. These are legal duties a cyber policy does not satisfy, but breach-response coverage can help pay for meeting them.
Notice to California residents within 30 calendar days (SB 446)
Sample notice to the Attorney General when over 500 residents are affected
CCPA statutory damages adjusted to $107–$799 per consumer per incident
Insurance funds the response; it does not replace the legal duty
Two illustrative contractor incidents
A project accountant receives a legitimate-looking request to change bank instructions days before a large progress payment, sent from a subcontractor's compromised mailbox inside a real thread. In a separate pattern, estimating and shared project files are encrypted days before a major bid, producing restoration costs and lost productivity on top of the missed opportunity.
This example is illustrative, not a report of an actual case or a promise of how any real claim would resolve — real outcomes depend on the specific policy, the facts involved, and the carrier's own review. For a situation that's actually happened or is happening, talk to your broker, a licensed attorney, or the relevant regulatory authority directly.
Subcontractor impersonation aimed at a large progress payment
Ransomware timed near a bid deadline
Each loss touches different coverage parts
Illustrative only — real claims depend on the policy and the facts
When you are ready to price coverage
This page explains the risk. When you are ready to compare policies, our construction cyber liability insurance quote page covers what underwriters ask, how contractors choose limits and retentions, and the checklist that gets comparable quotes back. You can also call 844-978-7283.
Underwriting questions, limits and retentions on the quote page
A construction quote checklist to gather before calling
Several carriers compared on structure, not only price
Call 844-978-7283 to start
Frequently asked questions
9 questions — start typing to filter
Is cyber insurance different from the cyber coverage on my GL policy?
Usually, yes. Many general liability forms exclude data incidents, and where a small cyber or data-compromise endorsement is attached it is often a low sublimit aimed at notification costs, not a diverted progress payment or a shut-down project office. A standalone cyber policy is where meaningful limits and incident response are typically found.
Does a small contracting business really have cyber exposure?
The exposure on a small construction business is rarely its customer list — it is the money. A diverted progress payment, a spoofed supplier invoice or a payroll redirect can take a significant sum out of a company with only a handful of employees. That money, more than any customer list, is what cybersecurity insurance for a small business in the trades should be priced against.
Does cyber insurance cover a fake subcontractor bank-change email?
It may, if the policy includes social-engineering or fraudulent-instruction coverage and the loss fits that wording. Sublimits, any callback condition and how a separate crime policy is worded all matter.
Can ransomware shut down a contractor even if field crews keep working?
Yes. Accounting, estimating, payroll, submittals, scheduling and project documents can be unavailable even while physical work continues, and the lost bids and delayed billing are part of the cost.
Should a contractor carry crime insurance as well as cyber?
It can be valuable where employee theft, computer fraud or funds-transfer risk is material. Crime and cyber policies overlap on payment fraud, so they should be coordinated rather than assumed to cover the same loss.
What does California require after contractor data is breached?
Under Civil Code section 1798.82, as amended by SB 446 effective January 1, 2026, affected California residents generally must be notified within 30 calendar days of discovery, and a sample notice goes to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are involved.
Are project-management platforms covered if they go down?
Some cyber policies include dependent business-interruption coverage for outages at certain technology vendors. Whether a particular platform and event qualify depends on the policy wording and any waiting period.
Which controls reduce a contractor's cyber risk the most?
Multi-factor authentication on email and remote access, separated and tested backups, endpoint protection, a callback procedure for payment changes, dual approval on large transfers and regular phishing training are among the controls underwriters ask about most.
How is this page different from the construction cyber quote page?
This page explains how cyber attacks reach contractors and which policy each loss belongs to. The construction cyber liability insurance quote page covers underwriting questions, limits, retentions and a checklist for requesting quotes.
Official resources
Verify current licensing, regulatory and program requirements directly with the responsible agency — this is general information, not legal advice, requirements change without notice, and what is summarized here may be out of date or contain errors. Confirming what applies to your own city, project, contract and policy is your responsibility.
