Does our HOA need cyber insurance, and how should the board buy it?

By OurHOA · General information · Revised November 1, 2026

Does an HOA need cyber insurance? What a cyber policy pays for, the wire fraud gap between cyber and crime coverage, and the questions to ask before the board buys.

Part of the HOA board handbook: vendors, projects and upkeep.

The short answer

If the association holds owners' bank or card details, Social Security numbers from vendor W-9s, or portal logins, or if anyone on the board can send money by email instruction, price a cyber policy at the next renewal. No Texas, Florida or Colorado statute requires an HOA to carry it, and most declarations don't mention it, so this is a business decision for the board. The application alone works as a free security checkup. Buy it with one fact in mind. A cyber policy and a crime policy pay for different losses, and the most common disaster in a small association, a treasurer tricked into wiring dues to a fake vendor account, can fall between them. This is general education, not legal or insurance advice. Coverage depends on the policy wording, and your state law and governing documents may add requirements.

What a 40-home association has to lose

Small boards tend to assume hackers go after banks and hospitals. The FBI's Internet Crime Complaint Center counted 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion, and those schemes work on anyone who pays invoices from an inbox. A volunteer treasurer working from a personal Gmail account fits the profile well. Now list what sits in the association's files. ACH authorization forms carry bank account and routing numbers. Sole-proprietor vendors send W-9s with Social Security numbers. Pool pass and gate remote records often include copies of driver's licenses. Florida's records statute, section 720.303(5), keeps Social Security numbers, driver license numbers, credit card numbers, email addresses and phone numbers out of owner inspection, which tells you the legislature sees them as sensitive. Lose that data and the state breach notice laws apply. Texas Business and Commerce Code section 521.053 gives you 60 days to notify each affected person. Florida section 501.171 and Colorado section 6-1-716 give you 30. The penalties for getting notice wrong are real money for a small budget. Texas section 521.151(a-1) allows a civil penalty of up to $100 per person owed notice for each day of failure, capped at $250,000 per breach. Florida section 501.171(9) allows $1,000 a day for the first 30 days, then $50,000 for each 30-day period up to 180 days, and up to $500,000 after that.

What a cyber policy pays for

The Federal Trade Commission's small business guidance splits cyber coverage into two halves, and the split is a useful way to read a quote. First-party coverage pays the association's own costs. That means a lawyer to decide whether notice is required, a forensic firm to find out what was taken, mailing and call center costs for the notices, restoring lost data, crisis communications, extortion demands, and income lost while systems are down. A board can't decide whether 300 people need a letter until someone tells it what left the building. Third-party coverage pays when someone else makes a claim against the association: owners whose data was exposed, a regulator's inquiry, settlements and defense costs. The FTC also suggests looking for a duty to defend, coverage for attacks on data held by your vendors, coverage for attacks anywhere in the world, and a breach hotline that answers at all hours. The vendor point matters most for an HOA, because owner data usually lives in a payment portal or a manager's system, not on a board laptop. Whether fines and penalties are covered depends on the policy and on state law, so ask the agent to show you the wording rather than taking a yes on the phone.

The gap between cyber and crime coverage

Here is where boards get burned. Data stolen is a cyber loss. Money stolen is usually a crime loss, and many associations already carry a crime or fidelity policy because the declaration or a lender requires one. Those policies were written for an employee or director who steals. When a treasurer is fooled by a fake email and sends the payment, some crime policies treat that as a voluntary transfer and pay nothing unless a social engineering endorsement was added. Some cyber policies add a funds transfer or social engineering section, often with a much lower limit than the rest of the policy. Don't try to sort this out from the marketing sheets. Send your agent three short scenarios and ask, in writing, which policy pays each one, up to what limit and after what deductible: 1. A director's email is taken over, and the intruder emails owners new payment instructions. Twelve owners pay $350 each to the wrong account. 2. The landscaper's email is taken over, and the treasurer receives a convincing request to change the vendor's bank account. The association pays a $9,800 invoice to the new account. 3. The payment portal reports that someone accessed owner bank details, and the association must investigate and send notices. If the answer to scenario 2 is "neither," you have found the hole. Close it with an endorsement on whichever policy will take it, and keep the bank controls in our guide on protecting HOA bank accounts from fraud, because no insurer pays as well as a callback rule that stops the payment.

Getting quotes and filling out the application

Start 90 days before the package policy renews and ask the same agent first, since some carriers sell a small cyber endorsement that can be added to the policy you already have. Ask for a standalone quote too, and compare the two. The application will ask what you do to prevent a loss. Answer it truthfully, because a false answer on an application can be grounds to deny a claim. Expect questions like these: - Is two-step sign-in turned on for email, banking and the payment portal? The Cybersecurity and Infrastructure Security Agency recommends it on every account that offers it. - Who can approve a payment, and is a phone call required before changing a vendor's bank details? - How many records with personal information does the association hold, and where are they stored? - Are files backed up somewhere a ransomware attack can't reach? - Which vendors hold owner data? If you answer "no" to two-step sign-in, fix that before you submit. It costs nothing, and CISA says people who use it are significantly less likely to get hacked, because a stolen password alone no longer opens the account. Count your records honestly too. The notice cost scales with the number of people, not the number of homes.

Questions to ask about any quote

Put the quotes side by side and get answers to these before the vote: - What is the total limit, and which parts carry a smaller sublimit? Look hard at social engineering, ransomware and regulatory fines. - What is the retention, the deductible you pay before coverage starts? - Does the policy cover a breach at the management company, payment portal or accounting service? Some policies cover only your own systems. - Does it cover acts by directors and volunteers using personal devices and personal email? Small associations run on both. - Must you use the insurer's panel of lawyers and forensic firms? If so, keep that list with the policy and don't hire your own firm first. - How soon must you report an incident? Some policies require notice within days. - Is there a retroactive date that excludes an intrusion that started before the policy began? If you have a manager, ask for proof of its own cyber coverage too, and don't count on it to pay the association's notice costs.

A motion, an owner note and a timeline

A sample motion: "Move to purchase cyber liability coverage from [carrier] through [agent] with a limit of $[amount], a retention of $[amount] and a social engineering limit of $[amount], at an annual premium of $[amount], effective [date], and to direct the treasurer to file the policy, the insurer's breach hotline number and the panel vendor list with the association's records." A paragraph for the owner newsletter: "The board has added cyber insurance to the association's coverage. It pays for investigating and responding to a data breach. The association will never ask you by email or text to send dues to a new account. If you get a message like that, call [phone] before you pay." A timeline that fits a normal renewal: - Day 90 before renewal: turn on two-step sign-in, list where owner data lives, send the agent the scenarios. - Day 60: application submitted, quotes requested on both an endorsement and a standalone policy. - Day 30: comparison sheet to the board, vote at the regular meeting. - Renewal date: coverage bound. Put the hotline number in the board binder and the treasurer's phone. - Within the first month: a 20-minute board drill using scenario 1. Who calls the bank, who calls the hotline, who drafts the owner email.

Mistakes boards make

Assuming the crime policy covers wire fraud. Get the three scenarios answered in writing. Calling a lawyer or forensic firm on your own after an incident. If the policy requires panel vendors or consent first, those bills may not be paid. Call the hotline first. Our guide on responding to a data breach of owner information covers the notice steps that follow. Guessing on the application. A "yes" to two-step sign-in that turns out to be false hands the insurer a reason to deny. Buying the policy and keeping the data anyway. Every old ACH form and driver's license copy you shred is one less record to notify about.

Sources

These guides are general education for HOA boards and residents, not legal, tax, or financial advice. Rules vary by state and by your community's governing documents - check with a professional for your situation.

More on dues & money

Or browse all hoa dues, fees & money guides.