You hold other people’s money and other people’s data.
Which makes a professional firm one of the most targeted businesses in Canada. The attack is rarely sophisticated. It is an email asking you to change payment details during your busiest week of the year.
Talk to a broker See what’s coveredCyber, professional liability and directors’ cover for advisory firms
Accountants, bookkeepers, tax preparers, law firms and advisors
Your current policies and your email security setup
Do accounting and professional firms need cyber insurance?
Yes, and more than most businesses. A professional firm holds client financial records, tax data, banking details and identity documents in one place, and moves money on client instructions. That combination is exactly what criminals look for. Cyber cover pays for the incident response, the forensic work, the legal advice on what you must disclose, notifying affected clients, and money lost to fraudulent transfers.
A breach at a professional firm is not only your loss. Clients whose financial records were exposed have their own claim, and the regulator has its own questions, both arriving in your busiest month.
It sits alongside your professional liability, not instead of it. One covers a mistake in your work; the other covers a breach of your systems.
Cover for firms that hold sensitive things.
Funds transfer fraud
Money sent on a convincing fake instruction. The most common loss a professional firm suffers.
Client data breach response
Notifying clients, legal advice, credit monitoring and dealing with regulators.
Ransomware
Getting your systems and your client files back, and the income lost while you cannot work.
Professional liability
Claims that your advice or your work caused a client a financial loss.
Directors & officers
For the partners or directors running the firm, including employment claims.
Regulatory and privacy
The costs that follow when personal information you held is exposed.
Three habits worth more than the policy.
Insurers now ask about all three, and every one of them is free. Adopt them whether or not you buy cover from anyone.
Call before you change a payment
Any change to bank details gets verified by phone on a number you already had. This alone stops the most common loss.
Two-factor on email
Almost every professional-firm breach begins with a compromised email account.
A backup you have restored
Held away from your main network, and actually tested. Untested backups fail exactly when needed.
Tax season is when this happens.
Not because criminals are clever. Because you are busy.
The pattern is consistent: high volume, unfamiliar clients, urgent requests, and staff working late. An email that would look wrong in July looks ordinary in April. That is the whole method.
So the useful time to arrange this is now, not in the middle of it, and the useful conversation is as much about the verification habit as it is about the policy. We will send you the insurer’s own security questions and go through them with you, free, whether you buy or not.
A situation we see.
In April, a staff member opens an attachment while working late. Client tax files and banking details are exposed. The cost is not the computers. It is the forensics, the legal advice, and telling every client what happened.
Firms that hold client trust.
What professional firms ask us.
We are a small firm. Are we really a target?
Small firms are targeted precisely because their defences are lighter and they still hold valuable data and move client money. Most attacks are automated and indiscriminate.
Is money lost to a fake email covered?
Under a cyber policy with the right section, generally yes. Under a standard business policy, generally no. It is the clearest gap between the two.
Does our professional liability policy cover a data breach?
Usually not, or only narrowly. Professional liability responds to errors in your work; a breach of your systems is a different exposure needing cyber cover.
Our clients are starting to ask whether we carry cyber insurance. Why?
Because their own insurers and auditors increasingly require it of their advisors. Send us the requirement and we will make sure what we arrange satisfies it.
We use cloud accounting software. Is that not their responsibility?
Their platform is theirs. Your accounts, your client data and your payment instructions remain yours, and an attacker inside your email is inside your firm regardless of who hosts the software.
What should we do first if we think we have been breached?
Call us. If a cyber policy is in place there is an incident response team you are entitled to use, and engaging it early materially improves the outcome.
Not an accounting firm? consultants & professional services covers other advisory work.
Ask for the security questions.
We will send the insurer’s questionnaire and work through it with you. No obligation, and you end up safer either way. Send us your current policies and your email security setup.