Homeowners insurance does not cover identity theft in any meaningful way, and it does not cover a hacked router, a hijacked IP camera, or money wired away after a convincing phone call. Your standard policy insures physical property. Almost every carrier excludes electronic data outright, and the small print treats stolen money as something you handed over voluntarily.
That gap matters more in 2026 than it did five years ago. The FBI logged 1,008,597 cybercrime complaints in 2025 and $20.877 billion in reported losses — a 26% jump in a single year. Meanwhile Forescout's 2026 device research put the humble home router at the top of the riskiest-device list, averaging 32 known vulnerabilities per unit.
So the question splits in two. First, what is actually exposed on your connection right now. Second, who pays when someone walks through that exposure. This guide answers both, names the carriers that sell real coverage, shows the sublimits that quietly gut claims, and separates insurance from the monitoring services that market themselves as the same thing.
Last spring I scanned a family's home connection after they lost $9,400 to a fake bank callback. Port 8000 was answering on their public address — an NVR the installer had exposed years earlier through UPnP. The breach and the wire fraud were unrelated, but the pattern was the same: nobody had ever looked. Their homeowners insurance paid nothing on the money, and the credit-card sublimit came to $500.
Since then I read policy wording the way I read firmware notes. The honest caveat is that I am a threat researcher, not a licensed agent, and endorsement language varies by state filing — two neighbours with the same carrier can hold different terms. What I can tell you is which questions to ask, and that carriers price a personal cyber endorsement low enough that most households skip it only because nobody explained what the base policy leaves out.
Quick Answer: Homeowners Insurance and Identity Theft
Standard homeowners insurance does not cover identity theft losses, ransomware, or funds stolen through online fraud, because policies exclude electronic data and treat authorised transfers as voluntary. A personal cyber or identity theft endorsement closes most of that gap for a modest annual premium. Start by finding what your connection already exposes with a full scan of what your connection reveals.
What Does Homeowners Insurance Actually Cover After a Cyberattack?
Does homeowners insurance cover identity theft? Not in any practical sense. A standard homeowners policy covers tangible loss: fire, theft, storms, and liability when someone gets hurt on your property. It does not cover money moved out of your bank account, ransomware on a family laptop, or the hours and fees involved in reclaiming a stolen identity. Most policy forms exclude electronic data as a category, and the one cyber-adjacent benefit they do include — unauthorised credit card use — usually caps out around $500 to $1,000.
That exclusion is not an oversight. Homeowners forms were written around perils that damage physical things, and an insurer can inspect a burnt kitchen in a way it cannot inspect a drained checking account. Endorsement — an amendment that adds or changes coverage on an existing policy — is the mechanism carriers use to bolt newer risks onto old forms without rewriting them.
The scale of the gap is what changed. According to the FBI's 2025 Internet Crime Report, published in April 2026, cyber-enabled fraud alone accounted for 452,868 complaints and $17.697 billion in losses — roughly 85% of every dollar reported lost that year. Very little of that is insurable under a base homeowners form.
| Loss Scenario | Standard Homeowners Policy | Endorsement Needed |
|---|---|---|
| Laptop physically stolen from the house | Covered — personal property, minus deductible | No |
| Ransomware encrypts family photos | Not covered — electronic data excluded | Yes |
| Money wired after a spoofed bank call | Not covered — treated as voluntary transfer | Yes |
| Identity restoration fees and lost wages | Rarely — token sublimit at best | Yes |
| Fraudulent charges on a stolen card | Partial — typically capped near $500 | Yes, for real limits |
| IP camera conscripted into a botnet | Not covered — no physical damage | Yes, for device cleanup |
Does Renters Insurance Work the Same Way?
Renters insurance follows the identical logic. It protects your belongings and your liability, and it stops at the same boundary homeowners insurance does — no identity theft cover, no ransomware, no stolen funds. The useful difference is that several carriers, State Farm among them, sell the same cyber and identity endorsement on renters policies as on homeowners policies. If you rent, ask for it by name rather than assuming the product does not apply to you.
Condo policies sit in the same category. The building's master policy handles structure; your unit policy handles contents and liability; neither one contemplates a compromised network. As of August 2026, no mass-market residential form in the US treats a home network breach as a covered peril on its own.
Read that middle column again and one thing stands out: everything an attacker can reach through your network sits outside the policy. Which raises the obvious follow-up — how does a cheap camera on your wall turn into a five-figure loss in the first place?
How Does a Hacked Router or IP Camera Become a Financial Loss?
A compromised router or camera rarely costs you money directly. It costs you money through what it enables. An attacker who owns the gateway sits between every device and the internet, can redirect DNS queries to a lookalike banking page, harvest session cookies, and watch which services your household uses. The camera itself is usually just the easiest door — cheap firmware, default credentials, and a port someone opened years ago and forgot.
The exposure numbers are not subtle. Forescout's 2026 Riskiest Connected Devices research, published in March 2026, ranked routers as the single riskiest IT device category, averaging 32 vulnerabilities per router or switch. In the same month, the U.S. Department of Justice disrupted four IoT botnets that had enrolled more than three million devices worldwide — mostly IP cameras, DVRs, home routers, and smart home controllers.
The Two Doors Attackers Actually Use
Most home compromises come through one of two openings, and both are things you can check yourself in about five minutes.
- → Deliberate exposure. Somebody enabled remote viewing. That works by opening a path from the public internet straight to a device on your LAN — often automatically, via UPnP, without anyone approving it.
- → Default credentials. The original Mirai botnet spread using 62 username and password pairs. Ten years on, admin/admin still works on a large installed base, because a camera lives 7 to 10 years and a router 5 to 8.
- → Unpatched firmware. Attackers still exploit Netgear CVEs first disclosed in 2016 and 2018, right through 2025 and into 2026, because those units never received an update.
The part that surprises people
Nokia's 2025 Threat Intelligence Report tracked a fivefold rise in malicious IoT botnet activity, with compromised devices climbing from roughly 200,000 to about one million and accounting for more than 40% of all DDoS traffic. Nokia also notes that residential proxy networks now span more than 100 million hijacked home devices — meaning someone else's fraud can be routed through your address, which is a reputation problem long before it becomes an insurance problem.
If you have a camera on the network, start by confirming what it actually is and where it sits — you can locate a Wi-Fi camera's address on your own network before worrying about the outside world. Then check the outside world, because that is the view an attacker gets. Running a scan to see which ports your public address is answering on takes under a minute and settles the question definitively.
Once you know what is exposed, the financial question becomes concrete rather than theoretical. That is where the insurance product nobody sold you comes in.
What Is Personal Cyber Insurance and What Does the Endorsement Cover?
Personal cyber insurance — a first-party coverage that reimburses a household for its own losses after a cyber incident — attaches to a homeowners or renters policy as an endorsement, or stands alone as its own policy. It typically pays for cyberattack recovery on personal devices, cyber extortion and ransomware, online fraud and funds transfer loss, identity restoration expenses, and in a growing number of products, cyberbullying costs such as tutoring, counselling, and legal fees.
Think of it as three buckets. The first reimburses money you lost. The second pays specialists to fix the mess — data recovery, device cleanup, home network restoration. The third covers professional fees you would otherwise fund yourself, including legal costs and lost wages while you sit on the phone with credit bureaus.
What It Does Not Do
Personal cyber insurance sits on top of homeowners insurance rather than replacing any part of it, and it never prevents an attack. It also does not cover business activity. If a side business, a rental LLC, or an online shop runs through your home network, a personal policy will deny the claim and point you at a commercial form — and commercial pricing is a different conversation entirely, which is why it helps to know what business cyber policies cost by industry before you assume the personal one stretches.
Ask this before you buy
As of August 2026, Chubb's own survey work found that more than half of respondents believed they would need less than $150,000 to recover from a cyber incident. Costs climb fast once several accounts, devices, and family members are involved. Ask your agent for the per-line sublimits, not the aggregate — the aggregate is marketing copy.
Coverage scope is only half the decision. The other half is the number on the invoice, and that number is far smaller than most households guess.
How Much Does a Personal Cyber Insurance Endorsement Cost in 2026?
Published 2026 figures put a personal cyber endorsement at roughly $25 to $75 per year when bolted onto an existing homeowners policy, and $150 to $500 per year for a standalone policy carrying $100,000 to $250,000 of coverage. Other market surveys quote personal cyber at $25 to $100 per month, with basic plans starting near $12 monthly for $25,000 of cover. Both figures circulate widely, and the spread is not a typo.
Here is why the two ranges disagree. Endorsement pricing rides on a policy that already exists, so the carrier is adding a narrow slice of risk to an account it already underwrites. Vendors sell standalone consumer products direct, absorb their own acquisition cost, and usually bundle monitoring services into the monthly figure. Comparing them like for like is the mistake — one is an add-on line item, the other is a subscription product.
For scale, the National Association of Insurance Commissioners puts average US homeowners insurance near $1,428 per year as of 2026. A $50 endorsement is roughly 3.5% on top of a bill you already pay. That ratio, more than any threat statistic, is the argument agents use.
What Actually Moves the Premium
Four things drive the number your agent quotes. The aggregate limit you select matters most, followed by the deductible you accept per occurrence. Household size counts, because coverage usually extends to everyone resident at the address. Finally, your state's filing determines which coverage lines the carrier may even offer, which is why identical households in Texas and New York get different paperwork for the same product.
One thing that does not move the premium much: your actual security posture. Personal cyber underwriting stays broad-brush, with no questionnaire about patching or password managers. That asymmetry works in your favour on price and against you on claims, since carriers recover their margin through sublimits rather than through screening.
Start with the endorsement if
Your current carrier offers one, you want the cheapest meaningful coverage, and your exposure is ordinary household risk — a few devices, normal banking, no business activity on the network.
Go standalone if
Your carrier offers nothing, you need an aggregate above $250,000, you want wider social-engineering limits, or you want a 24/7 incident hotline staffed by people who handle these weekly.
Price sorted, the next question is who actually writes this cover in the US market — and their limits differ far more than their premiums do.
Which Insurers Offer Personal Cyber Coverage and What Are Their Limits?
A small group of US carriers sell personal cyber coverage today, and they split into two tiers. Mass-market home insurers such as State Farm, Safeco, Nationwide, Mercury, and The Hanover attach modest endorsements to standard policies. High-value home specialists — Chubb, AIG, PURE, Travelers, and Cincinnati — write substantially larger limits aimed at households with more to lose. Availability varies by state filing, so your agent's answer beats any list.
| Carrier | Product | Notable Detail |
|---|---|---|
| State Farm | Cyber Event, Identity Restoration and Fraud Loss | Add-on to home or renters; modest combined limit |
| Safeco | Cyber Protection endorsement | Online fraud, attack, bullying, extortion; adds credit and dark web monitoring |
| The Hanover | Personal cyber add-on | Limits up to $100,000; credit monitoring after a claim |
| Mercury | Home Cyber Protection | $25,000 or $50,000 limit; $500 deductible per occurrence |
| Nationwide | Identity theft protection | Includes device cleanup and home network restoration |
| Chubb, AIG, PURE | High-value home cyber endorsement | Filed around $250,000 of personal cyber threat cover; $1M available on some tiers |
| NFP | DigitalShield standalone policy | Limits from $25,000; bullying, identity theft, ransomware bundled |
One detail worth flagging from the current market: Cincinnati Insurance offers up to $1 million of protection on certain Executive and Capstone tiers, while a mass-market endorsement may cap the same peril at $15,000. Same product category. Sixty-fold difference in payout.
Limits are the headline, though, and headlines are exactly where personal cyber claims go wrong.
Why Do Personal Cyber Claims Get Denied?
Claims fail for three predictable reasons: the sublimit was far below the aggregate, the insurer classed the loss as a voluntary transfer, or business activity touched the incident. Sublimit — a cap that applies to one specific coverage line inside a broader policy limit — is the biggest one. A policy advertising $100,000 of protection may pay only $10,000 for social engineering and $25,000 for ransomware, and the deductible sits separate from your homeowners deductible.
| Coverage Line | Typical Sublimit on a $100,000 Policy | Where Claims Break Down |
|---|---|---|
| Social engineering / funds transfer | Around $10,000 | Insurer argues you authorised the transfer |
| Ransomware and extortion | Around $25,000 | Negotiation and IT fees count inside the sublimit |
| Data and photo restoration | $10,000 to $25,000 | Personal files only — business files excluded |
| Identity restoration expenses | $15,000 to $25,000 | Pays fees and lost wages, not the stolen funds |
| Deductible | $500 to $2,500 per occurrence | Applies separately from the homeowners deductible |
The Evidence Insurers Expect
Most personal cyber claims involve social engineering, which means the policyholder pressed the button. Proving that the attacker deceived you rather than that you acted carelessly is the whole game, and the file you build in the first 48 hours decides it. Insurers generally expect a bank reversal attempt within hours, an FBI IC3 filing, and a local police report before they adjudicate.
Document the sequence: the phishing message or call, what you did, the moment you realised, and every notification you sent. Gaps in that timeline reduce recovery. Reducing your attack surface afterwards matters too, and the practical steps to harden your connection against opportunistic attackers double as evidence of reasonable care.
There is one more confusion worth clearing up, because two very different products carry nearly identical marketing language.
Is Identity Theft Insurance the Same as Identity Theft Protection?
No. Identity theft insurance reimburses costs after the fact and pays out under a policy. Identity theft protection is a monitoring subscription that watches credit files and breach dumps and alerts you. One is a financial backstop with a claims process and a regulator behind it; the other is an early warning system with a support line. Products bundle both, which is exactly why buyers assume they are one thing.
Insurance gives you
Reimbursement of documented expenses, lost wages, legal fees, and in some products the stolen funds themselves. It arrives after a loss, through a claim, subject to sublimits and a deductible.
Monitoring gives you
Alerts when your data surfaces, three-bureau credit visibility, and restoration specialists who make calls on your behalf. It reduces how long a theft runs undetected. It pays nothing.
If you can only fund one, the answer depends on your balance sheet. A household with significant liquid assets should buy the insurance first, because the loss it prevents is large and sudden. A household living close to the line usually gets more value from monitoring, since catching a fraudulent account in week one costs far less to unwind than catching it in month nine. Buying both is common and, at endorsement pricing, rarely the expensive decision people expect.
Neither replaces the free federal option. The FTC's official identity theft reporting and recovery service generates the affidavit that banks and creditors ask for, and it costs nothing. Filing there strengthens an insurance claim rather than competing with it.
Coverage and monitoring both work better on a network that is not already leaking. So before you call an agent, spend ten minutes closing the doors.
How Do You Secure the Home Network Before You Insure It?
Securing a home network before buying coverage does two things: it removes the exposures an attacker would find first, and it demonstrates reasonable care if you ever file. The work is unglamorous — check what the public internet can reach, close what should not be open, replace default credentials, patch firmware, and segment the devices you cannot trust. Bitdefender and NETGEAR telemetry puts the average household at roughly 29 attack attempts per day, so this is maintenance, not paranoia.
Five-Step Home Network Audit
1 Look at yourself from outside
Scan your public address for open services. Anything answering on 80, 443, 554, 8000, 8080 or 37777 is a camera, NVR, or router panel facing the open internet. Confirm the result rather than guessing.
2 Turn off UPnP on the router
UPnP lets any device on the LAN open a port to the internet without asking. Disable it, then re-add only the forwards you deliberately need. This single change closes most accidental exposure.
3 Replace every default credential
Router admin, camera accounts, NVR web logins, and any smart hub. Mirai-family malware still runs on a short list of factory passwords, and it finds new hosts within minutes of exposure.
4 Patch firmware, then check the end-of-life date
Update everything, then find out whether the vendor still ships updates at all. A vendor past end-of-life will never patch that device again, whatever the update screen claims.
5 Segment and re-test
Put cameras and smart devices on a guest or IoT SSID so a compromise cannot reach laptops and phones. Then repeat step one and confirm what changed. Also check what your browser reveals beyond the IP, since fingerprinting survives most network fixes.
When I run this audit for people, step two closes the most doors and step five surprises them the most. A household will tighten the router perfectly, then discover their browser still hands out a stable fingerprint that ties every session together regardless.
Finish the audit, keep a dated note of what you changed, and take that note to the insurance conversation. It is the difference between buying a policy blind and buying one that matches what you actually own.
The Short Version
So, does homeowners insurance cover identity theft, ransomware, or funds lost to online fraud? Not without an endorsement. The base policy insures physical property and excludes electronic data, which leaves the entire modern threat surface uninsured unless you add an endorsement. Those endorsements are cheap relative to the premium you already pay, and available from State Farm, Safeco, Mercury, The Hanover, Nationwide, and the high-value specialists.
Buy on sublimits rather than aggregate limits. Confirm whether any business activity runs through your home network, because that single fact voids most personal cyber claims. Keep identity monitoring and identity insurance separate in your head — one shortens detection time, the other reimburses.
Before you call an agent, look at your own exposure. Understanding how attackers forge and abuse trust at the IP layer makes the policy language far easier to read and keeps the risk in proportion. Then run the scan. Ten minutes of evidence beats an hour of speculation, and you will walk into the conversation knowing exactly which perils apply to your household.
See What Your Home Network Exposes
Insurance pays after the loss. A scan tells you what is open right now — every port, every leak, every device answering the public internet. Free, instant, no account.