They spread malware, go shopping online under a false identity, or fish for passwords and payment details: cybercriminals are always on the hunt for victims. According to the Cybersecurity Monitor, a representative dark-figure study by Germany's Federal Office for Information Security (BSI) and the police, a good one in five people (22 percent) in Germany had already been a victim of internet crime by 2025. The consequences of an attack can be serious, so insurers offer dedicated cyber policies as protection.
Check existing policies first
If you're considering a cyber insurance policy, you should first check whether you're already sufficiently covered through other insurance. A good private liability policy should, in the view of the German consumer group Bund der Versicherten (BdV), cover so-called internet damages as comprehensively as possible. "It covers damage you cause to third parties through internet use," says BdV expert Julia Alice Böhne, for example if someone unintentionally forwards a virus by email or message and the recipient suffers damage as a result. Private liability insurance should also defend against unjustified claims.
According to Böhne, a good home contents policy should cover financial losses from online fraud, and ideally the coverage shouldn't be limited to a fixed list of fraud methods. Many modern policies cover financial losses at least from phishing in online banking, though usually only up to a certain maximum amount. Coverage for data recovery costs after an insured event, such as a lightning strike, is also often included, again typically capped at a percentage of the coverage amount or a fixed sum. Depending on the contract, legal expense insurance may also cover disputes related to internet crime, according to the consumer center of Rhineland-Palatinate.
Who needs cyber insurance, and who doesn't
Existing liability, home contents, or legal expense policies often already cover many cyber risks or can be specifically extended. "Only once such a review and extension still leaves a relevant, existentially threatening protection gap does taking out a dedicated private cyber policy become an option," Böhne says. "Cyber insurance is particularly suited to people who manage a lot of assets online or make intensive use of digital services," says Lukas Spohr of the German IT industry association Bitkom. But people with less IT knowledge could benefit too, especially if they need fast support and professional help managing the fallout in an emergency.
What a cyber insurance policy covers
According to Böhne, there's no standardized product or market standard, and no model terms from the German Insurance Association exist either. The range of coverage in private cyber protection plans therefore varies widely. Comprehensive plans provide coverage for first-party cyber damages and often also include cyber liability and cyber legal expense coverage, sometimes as optional add-on modules.
Possible benefits for first-party cyber damages include losses from account, data, or identity misuse, data recovery after cyberattacks, losses from online purchases when ordered goods aren't delivered, and handling of damage claims plus legal advice. With cyber liability coverage, the insurer covers legitimate damage claims if a third party is harmed by a cyberattack on your systems, for example due to a data protection breach. Cyber legal expense coverage typically includes phone-based legal advice as well as help with cease-and-desist letters over alleged copyright infringement, for instance from illegal downloads.
Private and business policies differ, including on cost
"Cyber insurance is generally split between policies for private customers and policies for businesses or industrial clients," Spohr says. Definitions of risks, limits, and exclusions vary by product. "In the private sector, cyber policies often cost in the low double digits of euros per year," Spohr says, with comparison portals citing around 50 euros a year as a rough benchmark, depending on coverage scope and provider. For tax purposes, the cost is generally not deductible for private individuals, since it counts as a private living expense.
But how much do insurers actually pay out when it matters? "Insurers often work with an agreed coverage amount per year or per claim and manage particularly risk-prone components through so-called sublimits," Spohr explains. These caps on specific cost categories reduce the risk for the insurance company, since cyber risks are diverse and hard to assess: damage can appear with a delay, and the size of follow-on costs, such as ransom demands or account damage, is often unpredictable. A deductible is also common, to reduce the risk of misuse by the policyholder. Typical coverage amounts in the private sector range between 10,000 and 50,000 euros, depending on the module and insured risk.