Yes. Cyber insurance can cover business interruption for an online shop. Check triggers, waiting periods and named suppliers in your policy.
Business Interruption for E‑commerce: UK e‑commerce businesses can get cover for cyber business interruption. Policies vary on what counts as an insured event and on limits.
Why cover varies for online shops
Insurance products differ because insurers define the insured event in different ways. The wording decides if a website outage or payment failure is a claimable loss.
Common BI triggers to check
Look for wording that mentions system outage, denial of service or unauthorised access to sales systems. If the policy only mentions physical loss, the cloud outage may not be covered.
The Insurance Act 2015 affects disclosures and claim settlement, and insurers expect timely and honest answers when a claim arises.
Keep a simple evidence folder ready at all times.
How waiting and indemnity periods change outcomes
A waiting period of 24 to 72 hours can stop a payout for short outages. If the outage lasts less than the waiting period, there is no pay‑out.
Indemnity periods commonly range from 30 up to 12 months. A short indemnity period can miss recovery losses during a busy season.
What most guides miss about marketplaces
Most guides assume online sales sit on the merchant's platform and ignore marketplace data gaps. Marketplace order reports often sit outside web analytics.
The error most frequent here is relying only on the web store log. Sellers must collect marketplace transaction exports and gateway reports.
Keep a simple evidence folder ready at all times.
Estimated cost: For a micro online shop, basic cyber BI add‑on premiums typically range from £300 to £1,200 per year; for small SMEs prices vary by turnover and controls. Typical waiting periods in policies are 24, 48 or 72 hours, while common indemnity periods range from 30 to 12 months.
When an insurer asks for marketplace exports or server logs after downtime, they expect specific field data. Generic sales reports often do not prove causation.
For Shopify or BigCommerce, exports should include order id, created_at timestamp, payment status and total_price. Also include currency, SKUs, shipping, tax, discounts, refunds and fulfilment status.
For Amazon seller accounts, give transaction type, settlement id, order id and fee breakdown. For gateways such as Stripe or PayPal, include decline logs, settlement batches and error codes.
Keep a simple evidence folder ready at all times.
Attach server logs showing request timestamps and HTTP status codes for the same windows. File names like 2025-03-18_shopify_orders.csv help reconciliation for forensic review.
How insurers define an interruption
Insurers pay only when an insured peril, as the policy defines it, causes the interruption. Understanding the trigger definition is the single most important step to a claimable loss.
Site outage versus DDoS and ransomware
A site outage can be a host failure, config error or cloud fault. A site outage can stop orders even with stock and marketing intact.
A DDoS attack aims to make a service unreachable by flooding traffic. A ransomware event can stop ordering systems if encryption blocks checkout or fulfilment software.
Dependent or contingent BI wording
Dependent business interruption covers loss from failures at named third parties such as payment gateways. Insurers differ on whether they cover marketplaces, cloud hosts or fulfilment partners by default.
What most policies omit is clear language naming platforms like Shopify or Amazon as covered suppliers. Missing names often block marketplace claims.
Keep a simple evidence folder ready at all times.
Outage to payout: 5 steps
1
Preserve evidence: logs, screenshots, gateway reports, marketplace exports.
2
Notify your broker: include timeline and initial loss estimate.
3
Forensic review: server and payment logs prove causation.
4
Financial calculation: lost orders, commissions, saved costs.
5
Settlement: insurer reviews causal link and pays under policy terms.
Note: infographic shows typical process; timing varies by complexity.
Keep a simple evidence folder ready at all times.
Calculating lost orders and profit
The insured sum should reflect lost gross profit from lost orders and lower conversion. Policies often use a gross profit formula rather than turnover replacement.
A clear calculation and contemporaneous data shorten disputes and speed payment. Present data that matches the outage windows.
Lost gross profit = (Average daily orders × Average order value × Gross profit margin × Days offline) minus saved variable costs. Use the same calendar period year‑on‑year to reflect seasonality.
Adjust for marketplace commissions and refunds to avoid overstating loss. Keep each calculation line simple and sourced.
Worked numeric example
Example: 120 orders per day at £45 AOV, 35% gross profit, three‑day outage. Lost revenue = 120 × £45 × 3 = £16,200.
Adjust for 15% marketplace commission = £13,770 net. Lost gross profit ≈ £13,770 × 0.35 = £4,820 approximate.
Conversion‑rate losses and traffic drops
Traffic losses reduce orders in a way not obvious from order logs alone. Model traffic and conversion rate to estimate orders lost during an outage.
This model helps when analytics show visits fell to zero and marketplace sales also dropped. Use acquired data to support the estimate.
Keep a simple evidence folder ready at all times.
Preparing a BI claim: evidence list
Insurers expect contemporaneous records proving causation and financial impact. Start collecting logs and reports immediately after the event.
Present a short timeline and the full financial calculation to your broker or insurer. A clear package speeds assessment.
Technical evidence to keep
Export web server logs, cloud provider incident reports, and host status pages with timestamps. Collect payment gateway reports showing decline rates, chargebacks and time windows.
Get forensic snapshots before any system change to prevent evidence loss. Avoid changing systems until a snapshot exists.
Financial evidence to present
Export order and refund reports from platform and marketplaces for the same period in prior years. Provide a reconciliation showing saved costs such as reduced card fees or fulfilment savings.
Attach a short director's statement confirming incident start and end times. Keep statements factual and dated.
Sample claim timeline and file names
Filename examples: 2024-05-12_outage_timeline.pdf, 2024-05-12_stripe_declines.csv, 2024-05-12_amazon_orders.xlsx. A clear timeline should list events by hour with source references.
An insurer will often ask for a forensic report and may appoint their own expert. Early engagement helps the process.
Keep a simple evidence folder ready at all times.
Policy wording: clauses to seek or avoid
A claim will often succeed or fail on a few lines of policy text. Seek affirmative cover for named cloud hosts, marketplaces and payment providers.
Avoid policies that exclude losses from third‑party platforms unless the policy names them explicitly. Ambiguity often leads to denial.
Favourable clause wording
Examples to seek: "Loss arising from unauthorised access, denial of service, or cloud provider outage affecting the insured's online sales platform." Also ask for: "Contingent business interruption caused by failure of named payment gateway providers or fulfilment partners." Named supplier wording removes ambiguity.
Red flag clause wording
Watch for: "Loss resulting from failure of third‑party internet service providers is excluded." Such wording often blocks marketplace claims. Also avoid policies that only trigger on physical damage to tangible property.
Blanket sublimits for marketplace losses are common and reduce payouts for those losses. Check any sublimit and test it against your peak sales.
| Favourable clause |
Red flag wording |
| "Contingent BI includes named payment gateways, cloud hosts and fulfilment partners." |
"Loss caused by failure of third‑party internet services is excluded." |
| "BI triggered by denial of service or unauthorised access to insured systems." |
"BI cover applies only to direct physical damage to tangible property." |
| "Indemnity basis: gross profit on historic turnover with seasonality adjustment." |
"Marketplace losses subject to sublimit of £5,000." |
How to negotiate wording
Show evidence of controls such as PCI DSS or Cyber Essentials to reduce insurer concern. Ask the broker to seek named supplier coverage for any platform that processes transactions for the business.
The most effective negotiation point is a short list of controls and a clear dependency map. Keep the map simple and factual.
Keep a simple evidence folder ready at all times.
When third parties break your chain
Many online shops rely on payment gateways, marketplaces and fulfilment partners. If those services fail, a robust policy will treat them as contingent suppliers.
Proof from the supplier often makes or breaks the claim. A supplier incident report aligns events and shows causation.
Payment gateway outages
Export decline reports from PayPal, Stripe or your merchant acquirer with timestamps. Show increased decline rates, failed settlements and customer complaints during the outage window.
Insurers will want to see whether the gateway admitted an outage on its status page. A supplier status post is strong evidence.
Fulfilment and cloud host failures
Get the fulfilment partner's incident report and evidence of delayed shipments and refunds. Collect cloud provider maintenance or outage bulletins that match the incident times.
If a supplier is named in the policy, the path to settlement is much clearer. Named suppliers reduce debate about causation.
Keep a simple evidence folder ready at all times.
Opinion: Adding contingent supplier cover and a short waiting period usually pays off, but only if the shop keeps tidy transaction and marketplace logs. Without those logs a wider indemnity period is still useless because causation cannot be proved. Ask the broker for named‑supplier wording and keep hourly order and payment exports during trading hours to prove loss fast.
Timelines, costs and negotiation tips
Expect simple claims to take weeks and complex claims to take months when forensic work is needed. Saved costs and sublimits often reduce the final settlement from the initial estimate.
Presenting a clear calculation and timeline reduces quantum disputes and speeds payment. Early engagement with the broker also helps.
Waiting and indemnity period impacts
A 24‑hour waiting period removes pay‑outs for outages shorter than a day. Indemnity periods of 30 days may not cover restoration after a large ransomware event.
Negotiate a waiting period that matches likely recovery times for cloud hosts. Ask cloud providers about typical recovery times.
Benchmarks for premiums and sublimits
Small online shops see cyber BI add‑ons typically from £300 to £1,200 per year, depending on turnover and controls. Sublimits for marketplace losses often sit between £5,000 and £50,000 for low‑cost products.
Presenting controls and a clean claims history helps secure better pricing and limits. Use these benchmarks to test broker offers.
If uncertainty remains, ask the broker for a policy wording review and attach your last 12 months of hourly order exports. This action focuses renewal talks and shows gaps to insurers.
Keep a simple evidence folder ready at all times.
Benchmarks help set expectations when negotiating limits, waiting periods and premiums. Typical market observations:
- micro online shops (annual online revenue under £250k) often see cyber BI add‑on premiums from c. £250–£800 pa with common sublimits for marketplace losses of £5k–£25k
- small traders (£250k–£1m online revenue) may face premiums c. £800–£2,500 pa and sublimits from £25k–£100k
- medium merchants (£1m–£10m) often negotiate bespoke rates from £2,500 upwards with sublimits and indemnity periods tailored to volume (sublimits £50k–£500k depending on product margin)
Premium and limit movement depends on controls, chosen waiting period (24/48/72 hours) and whether contingent BI and DDoS or ransomware BI are included. Use these benchmarks to judge whether a longer indemnity period merits the extra premium.
Frequently asked questions
What is business interruption insurance for an online shop?
Business interruption cover replaces lost gross profit when an insured event interrupts online sales according to the policy wording. It usually applies on a gross profit basis and requires proof of causation.
Does a payment gateway failure count as an interruption?
It can if the policy includes contingent business interruption for named payment gateways or a third‑party cover section. Ask for the gateway to be named in the wording.
How to calculate lost orders from marketplaces
Use marketplace order exports and commission rates, apply your gross profit margin and adjust for refunds and saved costs. Marketplaces keep seller reports that prove revenue and commission percentages.
Can short outages be insured effectively?
Short outages can be insured only if the waiting period is less than the outage length. A 24‑hour waiting period insures longer outages but not very short ones.
How long before an insurer pays a BI claim?
Simple claims with clear causation and full evidence can settle within weeks. Complex claims with forensics, third‑party disputes or regulatory issues can take several months.
Keep a simple evidence folder ready at all times.
Your next steps
Check wordings in the business interruption and cyber sections now for any mention of systems, denial of service, named suppliers and waiting periods. Export the last 12 months of hourly order and payment logs and save them as immutable files for any claim.
When renewing ask the broker to provide sample clause wording that names your payment gateway and platform. Compare at least two market offers.
Not relevant when online sales are a very small part of total turnover, when a platform SLA provides compensation that fully covers losses, or when the main business risk is physical premises interruption rather than cyber outages.
If a claim is likely, contact the broker and insurer immediately with the timeline, forensic contact details and the financial calculation above. Early notification protects cover under the Insurance Act 2015 and helps secure an insurer appointed forensic team.
Will GDPR fines affect a claim?
GDPR fines sit under regulatory fines and are often excluded from first‑party BI cover unless the policy expressly includes regulatory costs. The ICO handles data breach fines and guidance is on its site for notification requirements: ICO.
