I hear it from business owners all over the Bay Area, from law firms in downtown Oakland to property managers in San Francisco: "We've got cyber insurance, so we're covered."
It's said the same way you'd say "we have fire insurance," as if the policy itself were a firewall.
It isn't. Insurance pays (some of) the bill after something goes wrong. It doesn't stop the attacker, it doesn't keep your team working, and in California it doesn't make your legal obligations go away. Here's what actually happens when ransomware hits a California business, and what should sit alongside that policy.
Ransomware isn't a "big company" problem here
Bay Area organizations with real budgets and real IT teams have been hit:
City of Oakland (2023): The Play ransomware group shut down city systems for weeks. Oakland declared a local state of emergency, attackers leaked data on roughly 13,000 current and former employees after the city refused to pay, and the city then faced data breach lawsuits.¹
San Francisco 49ers (2022): The BlackByte gang hit the team's corporate network the weekend of the Super Bowl. Personal information for about 20,000 people was exposed.²
UCSF (2020): The NetWalker gang encrypted servers at the UCSF School of Medicine. The university paid $1.14 million to get its data back.³
If it can happen to a city government, an NFL franchise and one of the country's top medical schools, a 40-person accounting firm in Walnut Creek isn't flying under the radar. Smaller firms are often the easier target.
What you picture vs. what actually happens
Most people imagine that when they call their insurer, an elite response team shows up and starts restoring everything. That's not how it works.
You lose control of the process. Once you file a claim, the carrier is running the show. You'll typically choose a breach attorney and a forensics firm from the carrier's pre-approved panel, often companies you've never heard of, while your business is down and the clock is running.
Recovery doesn't start right away. The forensics team has to get access, figure out how the attackers got in and determine whether data was stolen. That commonly takes days before rebuilding even begins. Every one of those days, your staff can't work and your clients are waiting.
The fine print: sub-limits
You bought a $2 million policy. Feels like plenty. But have you read the sub-limits?
Many policies cap specific categories, like ransomware or extortion payments, business interruption, data restoration or regulatory defense, at a fraction of the headline number. A policy that looks like $2 million on the declarations page can pay out far less in a real ransomware event. Most owners find out mid-crisis.
Pull your policy this week and look for the words "sub-limit," "aggregate" and "retention." If you don't understand what you're reading, ask your broker to walk you through a ransomware scenario line by line.
California adds its own costs
This is where California businesses carry more risk than companies in most other states.
30-day breach notification. As of January 1, 2026, California law (SB 446) requires businesses to notify affected California residents within 30 calendar days of discovering a breach. If more than 500 Californians are affected, you also have to send a sample notice to the Attorney General.⁴ That's a tight deadline when you're still in forensics.
CCPA lawsuits. If a breach of unencrypted personal information results from a failure to maintain "reasonable security," California consumers can sue for statutory damages of $107 to $799 per consumer, per incident (or actual damages, if higher).⁵ Do the math on a client or employee list of 5,000 people. That exposure can dwarf your policy limits, and "reasonable security" is exactly what attorneys will scrutinize.
What happens after you file
Carriers check your application. Did you say you had multi-factor authentication on every account? Did you actually? Was endpoint detection and response on every machine? If there's a gap between what you represented and what was in place, the carrier has grounds to reduce or deny the claim. After a breach there's almost always a gap, because the attackers got in somewhere.
Renewal gets painful. After a ransomware claim, expect much higher premiums, tougher questionnaires, or a non-renewal that sends you shopping in a hard market. And many of your client contracts and leases require you to carry cyber coverage.
The spreadsheet math that falls apart
I see the logic all the time: "Insurance costs less than a full security program, so we'll take the risk and let the policy pay if something happens."
That assumes the policy pays its full limit (sub-limits say otherwise), that you keep the same policy and premium after a claim (you won't), and that the total cost fits inside the limits once you add forensics, legal, notification, CCPA exposure, lost billable hours, new hardware and reputational damage. It rarely does.
Insurance is step one, not the whole plan
I'm not telling you to cancel your cyber insurance. You need it. But it's like car insurance: you still wear a seatbelt and still have airbags. The policy is for when everything else fails.
For a Bay Area business with 20 to 100 employees, a real security posture includes:
Endpoint detection and response (EDR) on every device, with a 24/7 security operations center watching it. Attacks don't wait for business hours.
Multi-factor authentication everywhere: email, cloud apps, VPN, admin accounts. Hardware keys for your most sensitive accounts.
Tested backups. Not "we set it up three years ago." Restores that are actually tested, with documented recovery times.
Phishing simulations & awareness training for every employee, since a click is still the most common way in.
Fast offboarding. When someone leaves, their access should be shut off the same day, everywhere.
A written incident response plan, including who calls your carrier, your attorney and your clients, and how you'll meet California's 30-day notification clock.
These are also the controls cyber insurance carriers ask about on their applications. Having them in place, and documented, protects your premiums and your claim.
The question to ask instead
The question isn't "do we have enough insurance?" It's "what are we doing to make sure we never have to use it?"
At Tech Plus Consulting, we help Oakland, San Francisco and East Bay businesses answer both. We regularly help clients work through cyber insurance applications and audits: we review the carrier's list of required controls, put them in place, and write the policies and documentation to back them up.
If you're not sure where you stand, we offer a free IT security scorecard. It shows you where the gaps are, in plain language, before an attacker or an insurance adjuster finds them.
Tech Plus Consulting is a managed IT and cybersecurity provider based in Oakland, California, serving businesses across the San Francisco Bay Area. Help desk: (510) 764-1959 · New business: info@techplusconsulting.com · 2744 E. 11th St, Suite H7, Oakland, CA 94601
Sources
GovInfoSecurity, "After Ransomware Attack, Oakland Faces Data Breach Lawsuit," 2023. https://www.govinfosecurity.com/after-ransomware-attack-oakland-faces-data-breach-lawsuit-a-22208
Security Magazine, "San Francisco 49ers data breach affects 20K individuals," 2022. https://www.securitymagazine.com/articles/98292-san-francisco-49ers-data-breach-affects-20k-individuals
Insurance Journal, "U. of California, San Francisco, Paid $1.14M After Ransomware Attack," June 2020. https://www.insurancejournal.com/news/west/2020/06/29/573793.htm
Troutman Pepper, "California Amends Breach Notification Statute," Oct. 2025. https://www.troutmanprivacy.com/2025/10/california-amends-breach-notification-statute/
California Privacy Protection Agency, "2025 Increases for CCPA Fines and Penalties" (Civ. Code § 1798.150). https://cppa.ca.gov/announcements/2024/20241217.html
This article is general information, not legal advice. Talk to your attorney and insurance broker about your specific policy and obligations.
