Modern risk landscape: cyber, fraud and management liability

In short. Within ten years the risk profile of companies has changed fundamentally. Loss is no longer mainly physical: it consists of data becoming unavailable, payments made to the wrong account and the claims that follow. A single incident can trigger cyber, crime and D&O risk at the same time. Classic property and liability insurance was not built for this, and an insurance programme assembled from separately purchased policies often leaves precisely the most expensive part of the loss uncovered.¹

For underwriters and claims handlers, this chapter explains the loss patterns behind Estonian cyber, crime and D&O notifications and the legal points on which coverage positions are later tested.

1. Why traditional insurance is no longer enough

Property and liability insurance took shape at a time when risks were more clearly delimited. Property insurance focused on the destruction of or damage to a thing (fire, water damage, theft), and liability insurance on classic liability cases such as injury to a third party's health or damage to its property. The description of the insured event and the related exclusions still reflect that logic.

Today's typical loss looks different.

• The loss is not physical. The deletion of data, the encryption of systems or the loss of access may not qualify as "destruction of or damage to a thing" within the meaning of property insurance. International case law has decided this question sometimes for the policyholder and sometimes for the insurer; each time the outcome turned on the wording of the policy (see the case collection).
• Fraud is not a technical failure. If an employee enters a payment order personally because he or she has been persuaded that the supplier's bank account has changed, the payment itself is not a "hack" of the company's payment system, even where the scheme began with a compromised e-mail account. Whether such a loss is covered depends on the wording of the computer fraud cover.
• The loss has several layers. A single event can give rise to business interruption, contractual claims, supervisory proceedings, a fine and reputational harm. Each layer may fall under a different insurance contract or remain uncovered.
• Risk travels along the supply chain. An attack on an IT service provider can cause loss to a customer that was not the target of the attack and whose own systems were in order.

In practice this means four simple propositions: property insurance does not as a rule cover cyber loss, general liability insurance does not as a rule cover a data breach, crime insurance does not automatically cover every social engineering scheme, and D&O insurance covers neither the company's own technical loss nor its direct financial loss. Where an insurance programme has not been deliberately designed, the loss remains uncovered not because there was no insurance but because the insurance was wrongly structured.

Estonian insurance contract law gives the policyholder substantial protection: the statutory presumption is that the insurer bears the costs arising from the insured event, and limitations of cover must be clear.² The Supreme Court (Riigikohus) has repeatedly stressed that a limitation hidden in standard terms may not become part of the contract and that an unclear standard term is interpreted against its author.³ This protection helps in a dispute but does not replace the existence of cover: where the insured event itself is defined narrowly and clearly, interpretation does not create cover that the contract does not contain.

2. Digitalisation and dependence on IT

Almost all of a company's core functions (accounting, invoicing, customer communication, supply chain management, production planning) run digitally. Even a short outage can mean a significant business interruption. The company depends not only on its own systems but also on cloud service providers, software platforms and managed IT service providers. The risk can therefore materialise outside the company's direct control.

Two conclusions follow for insurance.

First, classic business interruption insurance is as a rule tied to physical property damage: the interruption must result from the destruction of or damage to insured property. A system outage without physical damage falls outside such cover unless the policy provides otherwise. Under Estonian law, lost profit is covered in indemnity insurance only if this has been separately agreed (Law of Obligations Act (võlaõigusseadus, VÕS) § 476 lg 4), which is why business interruption cover must always be agreed expressly.⁴

Second, contingent business interruption (tarneahela katkestus) is a separate cover that has to be negotiated on its own terms: whether only named service providers or all IT service providers are covered, whether cloud services are included, and what waiting period applies before cover attaches.

3. The evolution of fraud: social engineering and invoice fraud

Fraud has moved from technical attacks to the manipulation of human behaviour. The two most common schemes are the following.

• Invoice fraud (arvepettus, payment diversion): the attacker monitors the correspondence of the company or of a supplier and, at the right moment, sends notice of a change of bank account. The Information System Authority (Riigi Infosüsteemi Amet, RIA) describes the scheme in exactly these terms: the fake invoice differs from the genuine one mainly in the bank account details, and the criminals have often broken into the partner's or the company's e-mail beforehand.⁵
• CEO fraud (fake president fraud): a finance employee receives an urgent and confidential instruction, purportedly from an executive, to make a transfer for a "strategic transaction".

In both schemes the payment order is in the end entered and approved by the company's own employee. That does not mean that no system is broken into: invoice fraud often begins with the compromise of the company's or its partner's e-mail account, as RIA notes, and only ends with an authorised payment. This is precisely why coverage disputes arise. The cyber insurer may argue that there was no attack on the system but human error; the crime insurer may argue that the loss was not "direct" or that it did not result from the use of a computer but from the employee's decision. US and Canadian case law is divided on this question (see the case collection). In criminal law such acts are fraud or computer-related fraud (Penal Code (karistusseadustik, KarS) § 209, § 213), but the insured event is determined by the insurance contract, not by the criminal-law classification.⁶

4. Growing management risk: NIS2, data protection and investors

The regulatory environment has made cybersecurity and risk management a matter for the management board.

Cybersecurity Act. The NIS2 Directive has been transposed in Estonia through amendments to the Cybersecurity Act (küberturvalisuse seadus, KüTS) that entered into force on 1 January 2026.⁷ An entity within the scope of the Act must designate at least one management board member who approves the security measures, oversees their implementation and is responsible for them, and who undergoes regular training; if no member is designated, these duties apply to all board members (KüTS § 6¹; the duty to designate does not apply where the board has a single member). For a cyber incident with a significant impact, an initial notification must be submitted to the Information System Authority within 24 hours at the latest and an incident notification within 72 hours at the latest (KüTS § 8). For an essential entity, the fine for a breach can reach EUR 10 million or 2% of the worldwide annual turnover, whichever is higher, and for an important entity EUR 7 million or 1.4% (KüTS § 18², § 18³).⁸

Data protection. A personal data breach must be notified to the Data Protection Inspectorate (Andmekaitse Inspektsioon) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals (General Data Protection Regulation (GDPR) art 33(1)); a processor notifies the controller without undue delay (art 33(2)).⁹

Company law. A management board member must perform his or her duties with the diligence of a prudent businessperson (korraliku ettevõtja hoolsus) and is liable for damage caused by a breach of duty; to be released, the member must prove that he or she acted with that diligence (Commercial Code (äriseadustik, ÄS) § 187, § 315).¹⁰ Judged with hindsight, the question is whether the risk was foreseeable and whether the board took reasonable measures. Shortcomings in cybersecurity are no longer treated as a merely technical problem but as a possible breach of the duty of care.

Investors and creditors. Where a company has disclosed information about its risks, investors may argue after an incident that the information was incomplete or misleading. In international practice, data breaches have on several occasions been followed by securities and derivative actions against executives (see the case collection).

5. The risk chain: how one event moves between three lines of insurance

A typical chain of events may look like this:

1. the attacker takes over a finance employee's e-mail account (cyber risk);
2. through the account, a forged payment instruction is sent to a partner or to the company's own accounting department, and money is transferred to the attacker's account (crime risk);
3. the investigation reveals that customer data also leaked from the account; the supervisory authority and the customers must be notified (cyber risk, regulatory risk);
4. customers and partners present claims, and the company's business is disrupted (liability and business interruption risk);
5. the shareholders, and later perhaps the bankruptcy trustee, ask why there was no multi-factor authentication and no payment control (D&O risk).

In such a situation cyber insurance (forensics, restoration, notification, liability for the data breach), crime insurance (the fraudulent payment instruction) and D&O insurance (the claim against the executives) may all respond at once. At the same time, the questions that form the core of coverage disputes arise: which policy covers which part of the loss, whether the loss was direct or indirect, whether the employee's act breaks the chain of causation, whether the board complied with its duty of care and whether a possible state background to the attack triggers the war exclusion (see war exclusions and cyber insurance).

The relationship between the three lines is set out in the chapter cyber, crime and D&O insurance: interplay and boundaries, and the chain is illustrated by the practice-based scenarios of the Estonian original (Riskistsenaariumid, in Estonian).

6. Multi-layered loss and three questions for the board

It is useful to think through a multi-layered loss via the three dimensions of information security, because they make technical risk understandable to the board and later help to allocate the loss between lines of insurance:

• availability: whether systems and data are available when needed (ransomware, denial of service, cloud outage; mainly cyber insurance and business interruption);
• integrity: whether data and payment orders are correct and unaltered (fraudulent payment, forged invoice, manipulated general ledger; mainly crime insurance);
• confidentiality: whether only authorised persons have access to data (data breach, insider data theft; cyber insurance and liability to third parties).

Behind all three dimensions lies the question whether management was organised with due care. That is the D&O layer, which is often activated only months or years later.

7. What this means for the insured company

1. Insurance must be bought by scenario, not by line of business. For each significant scenario, ask which policy covers it, with what limit and sub-limit, and which exclusions may apply.
2. Risk management and insurance are one system. Insurers increasingly assess the company's actual level of security and its internal controls. If the information given in the proposal does not correspond to reality, the insurer may withdraw from the contract (taganemine) on the conditions laid down by law (VÕS § 441, § 442).¹¹
3. Documentation is protection. The reasons for the board's decisions, risk analyses and insurance choices are later the main evidence that the board acted with due care.
4. Crisis readiness is part of the cover. Timely notification, mitigation of the loss and preservation of evidence are obligations arising from the law and the contract (VÕS § 448, § 488).¹²

Related pages

• Kindlustusvajaduse kaardistamine (mapping insurance needs, in Estonian)
• Integrated insurance programmes
• Cyber, crime and D&O insurance: interplay and boundaries
• Cyber claims in Estonia
• Crime and fidelity claims in Estonia
• D&O claims in Estonia

References