Cyber insurance for restaurants pays for the fallout when card data, customer information or the systems that run service are compromised: breach forensics, customer notification, PCI assessments passed down by your card processor, ransomware response and the income you lose while the POS or online ordering is down. Funds-transfer and social-engineering fraud usually need their own insuring agreement or a separate crime policy.
This guide is for owners of independent restaurants, cafés, bars, franchise units and delivery-only kitchens that take cards, run online ordering, or keep a loyalty or gift card program. If you already carry a restaurant business owners policy, read the section on endorsements versus standalone policies before assuming the cyber box is checked. US Restaurant Insure is the restaurant insurance site of Provident Financial Group, an independent agency that compares cyber forms from multiple carriers.
Where does a restaurant’s cyber exposure actually come from?
A typical dining room now runs on a cloud POS, pay-at-table handhelds, a kitchen display system, an online ordering site, two or three delivery tablets, a reservation tool, a loyalty app, a payroll portal and a guest Wi-Fi network that often shares hardware with everything else. Every login is a door. Few attacks target a restaurant by name; bots test reused passwords against merchant portals, scanners look for remote-access tools a POS vendor left open, and phishing emails land in the manager’s inbox mid-shift. The most sensitive file is often not card data at all but the payroll folder, with employee Social Security numbers and direct-deposit details.
POS and card data breaches: PCI DSS assessments and card-brand fines
Merchants that accept cards agree, through their merchant agreement, to follow the Payment Card Industry Data Security Standard (PCI DSS), maintained by the PCI Security Standards Council. When card data is stolen from a merchant environment, the card brands can require an investigation by a PCI Forensic Investigator and levy fines and assessments against the acquiring bank to recover fraud losses and card reissuance costs. The acquirer then passes those charges to you.
A typical sequence: malware lands on a back-office PC sitting on the same flat network as the terminals and captures card data for weeks. Nobody notices until the processor calls because fraud analysis flagged your location as a common point of purchase. Now you are paying for a forensic investigation you did not choose, reconfiguring terminals, notifying customers where required and waiting on an assessment letter.
Because those assessments arise from a contract rather than a bodily injury or property damage claim, general liability will not respond, and not every cyber form does either. Look for an insuring agreement that names PCI fines, penalties and assessments, check its sublimit, and read how it treats fines “where insurable by law.” Counterfeit-card chargebacks are a separate issue, covered in our page on whether restaurant insurance covers credit card fraud.
Online ordering, delivery-app account takeover and gift card fraud
- Delivery-platform account takeover. An attacker uses a password the manager reused elsewhere, logs into your merchant portal and changes the payout bank account. Two weeks of deposits vanish before anyone reconciles. See what delivery apps require from restaurants for the insurance side of those platform agreements.
- Online ordering and loyalty accounts. Credential-stuffing bots log into customer accounts on your ordering site, place orders with saved cards or drain loyalty points, leaving you with refunds and possibly notification duties.
- Gift card fraud. Bots guess card numbers and PINs, check balances and spend them online; customers arrive with empty cards and you honor them. Many cyber policies treat stolen value as a crime-type loss rather than a breach.
Forensics, legal advice, customer notification and account restoration usually fit inside a cyber policy. The money that actually left your account is a different category.
Why social engineering and funds-transfer fraud often need separate coverage
The bookkeeper receives an email that looks exactly like your produce distributor’s, asking that invoices be paid to a new bank account, and pays three before the real distributor calls about the past-due balance. Or a text that appears to come from the owner asks a shift lead to buy gift cards for a “staff bonus.” Nobody hacked anything; an employee was tricked into sending money voluntarily.
Some cyber policies include a social engineering or funds-transfer fraud insuring agreement, usually sublimited well below the main limit; others exclude it. The traditional home for these losses is a commercial crime policy covering employee theft, forgery, computer fraud and, by endorsement, social engineering. Many carriers require a callback procedure: verifying any payment-instruction change by phone using a number already on file. Our comparison of cyber versus crime insurance for restaurants shows where each policy stops.
Ransomware and business interruption when the POS goes dark
It is Friday at seven, the POS and kitchen display lock up, and a ransom note appears in the office. You switch to handwritten tickets and cash, or you close. A cyber policy can pay for the incident-response firm, ransom negotiation and, where lawful and approved by the insurer, an extortion payment, followed by data restoration and on some forms replacement of hardware left unusable.
The piece owners underestimate is cyber business interruption: lost net income and extra expense while systems are restored, after a waiting period measured in hours. That is different from the business interruption coverage on your property policy, which generally requires direct physical loss such as a fire; a locked POS is not physical damage. See business interruption vs. extra expense for how those two pieces differ. Also ask about dependent business interruption: if your cloud POS or ordering vendor goes down, you lose sales even though your own network was fine. Some forms cover dependent outages only when a security failure caused them, others include ordinary system failures.
How breach notification laws apply to restaurants
Every state has a data breach notification law. In general terms, they require a business to notify affected individuals when certain personal information, such as a name combined with a card number and access code, a Social Security number or a driver’s license number, is accessed without authorization. Many also require notice to the attorney general or another regulator and set deadlines. The rules generally follow where the affected person lives, so a restaurant in a tourist market can face several states’ requirements from one incident. That is why a good cyber policy includes a breach coach, a privacy attorney who decides whether notice is required and coordinates the forensic firm. Call the policy hotline first.
First-party vs. third-party cyber coverage at a glance
| Coverage part | Type | Restaurant example |
|---|---|---|
| Incident response and forensics | First-party | Investigator traces how malware reached the terminals |
| Notification and credit monitoring | First-party | Letters to loyalty members whose data was exposed |
| Data restoration | First-party | Rebuilding menus, recipe costing and reservation history |
| Cyber extortion | First-party | Ransom negotiation after the POS is encrypted |
| Business interruption and extra expense | First-party | Income lost during a weekend of cash-only service |
| Dependent business interruption | First-party | Ordering vendor outage halts takeout sales |
| Funds transfer / social engineering | First-party, often sublimited or via crime | Invoice paid to a fake vendor account |
| Privacy liability and defense | Third-party | Customers sue after card data is stolen |
| PCI fines and assessments | Third-party (contractual) | Processor passes card-brand assessments to you |
| Regulatory defense and penalties | Third-party | Attorney general inquiry after a breach |
| Media liability | Third-party | Claim over a photo used on your website |
BOP cyber endorsement or standalone cyber policy?
Many restaurant BOPs offer a data compromise or cyber endorsement. It is convenient, but usually narrower: often breach response only, with low sublimits shared across the year, little third-party liability, and PCI assessments, ransomware, cyber business interruption, dependent outages and social engineering excluded or tightly capped. A standalone policy generally offers separate insuring agreements, higher available limits, a pre-approved panel of breach coaches and forensic firms, and more control over waiting periods and retentions. A single-location café on a hosted POS may be comfortable with a well-written endorsement. A multi-unit group, a franchise location whose agreement specifies cyber limits, a ghost kitchen that lives on online orders, or any restaurant with an active loyalty program is usually better served by a standalone form.
Coverage checklist for a restaurant cyber program
- Breach response with a breach coach — the first 48 hours decide how expensive a POS breach becomes.
- PCI fines, penalties and assessments — card-brand assessments are contractual and fall outside general liability.
- Cyber extortion and data restoration — ransomware on a POS stops service, not just email.
- Cyber business interruption with a short waiting period — a weekend dinner outage is the loss a restaurant feels most.
- Dependent business interruption — for outages at the POS, ordering or delivery platforms your sales depend on.
- Social engineering and funds-transfer fraud — in the cyber policy or a crime policy, with callback procedures in place.
- Privacy and regulatory liability — for customer lawsuits and regulator inquiries after exposure of personal data.
- Media liability — for menus, photos and social posts that draw a copyright or trademark claim.
What underwriters ask and what moves your cyber price
- Is multifactor authentication (MFA) on email, remote access, POS administration, payroll and banking?
- Are backups offline or immutable, and has a restore been tested?
- Do terminals use point-to-point encryption (P2PE), tokenization and chip reading?
- Is guest Wi-Fi separated from the POS and office network, and how is the POS vendor’s remote access controlled?
- How many customer and employee records do you hold, and do you store card data yourself?
- Do you verify vendor or payroll bank changes by phone before paying?
- Any prior incidents, chargeback problems or PCI compliance findings?
Carriers also weigh revenue, number of locations, the share of sales from online ordering, loyalty database size, and the limits, retention and optional coverages you choose. The most practical ways to improve terms: MFA everywhere it is offered, P2PE terminals through your processor, separated networks, an offline backup and a written callback rule every manager follows. More ideas are in how to lower restaurant insurance premiums.
How quoting restaurant cyber works with an independent agency
You complete one application with Provident Financial Group plus a short cyber questionnaire. We send it to multiple carriers that write restaurant cyber and lay the options side by side, comparing sublimits, waiting periods, dependent outage wording, PCI and social engineering terms as well as price, so you can see what you qualify for. Once bound, we issue certificates of insurance for any landlord or franchisor that asks for proof of cyber coverage. Call (866) 964-6660 to talk it through. All coverage is subject to underwriting and policy terms.
Frequently asked questions
Does my restaurant BOP already include cyber coverage?
A base BOP is not a cyber policy. Check the declarations for a named cyber or data compromise endorsement and its sublimit, and assume ransomware, PCI assessments and funds-transfer fraud are not covered unless the wording says so.
Will cyber insurance pay if an employee sends money to a fake vendor?
Only if the policy includes a social engineering or funds-transfer fraud insuring agreement, which is often sublimited and may require callback verification. Otherwise that loss belongs under a crime policy with a social engineering endorsement.
Are PCI assessments covered if my POS is hosted in the cloud?
Your merchant agreement still makes you responsible for card data in your environment, so an assessment can reach you. A cyber policy with a PCI fines and assessments insuring agreement is what responds, subject to its sublimit.
Does cyber insurance cover an outage at my online ordering or POS vendor?
Only with dependent business interruption, and the trigger varies. Some forms require a security breach at the vendor; others also cover system failures.
Do I need cyber coverage if I only take cards through a hosted terminal and a delivery app?
Your card exposure may be smaller, but employee payroll data, email and merchant-portal logins can still be compromised. Many small restaurants start with an endorsement and move to a standalone policy as online sales grow.
Want to see how different carriers handle PCI, ransomware and social engineering for your restaurant? Get Multiple Quotes within minutes.