Every card swipe, online order and reservation puts guest data into a restaurant's systems, and a point-of-sale outage on a Friday night stops revenue as surely as a kitchen fire. This page covers the cyber exposures of California restaurants, bars, taprooms and breweries, and what a policy can do about them.
✓Card Data & PCI
✓POS & Ordering Outages
✓Payroll & Vendor Fraud
Reviewed by David Gleason, Principal — October 11, 2026
CaliforniaGeneral information only, not legal advice — illustrative scenarios and coverage, subject to change without notice. Content may be out of date or contain errors, and requirements vary by city, county, state, agency, project, contract, carrier and policy, among other factors; verifying what applies to your own situation is your responsibility. Full disclaimer
Prefer to send everything at once? Complete a streamlined submission — just needs your review. Especially worth it if your business does $2M+ in annual sales — it can meaningfully speed up carrier turnaround.
Interactive coverage guide
Build a coverage stack around how the business actually operates.
Start with the preselected industry or trade, then adjust the operational questions. The commonly considered stack updates live. Keep the coverages you want GIB to evaluate, remove ones you do not want included in your quote request, and add other available lines before continuing.
Common Starting Coverages
General LiabilityThird-party injury and property damage
What it is
General Liability commonly addresses covered third-party bodily injury, property damage and certain personal or advertising injury claims, subject to the policy.
Why businesses like yours commonly carry it
Businesses commonly use it as a starting liability policy and to satisfy customer, landlord or contract requirements.
Possible coverage gap
General Liability is not intended to replace policies for employee injuries, business vehicles, owned property, cyber events or professional errors.
Business Owners Policy / Commercial PackageLiability and property components evaluated together
What it is
A Business Owners Policy commonly combines liability and property coverages for eligible businesses. A Commercial Package Policy may combine multiple commercial coverage parts depending on the account and carrier.
Why businesses like yours commonly carry it
Businesses with premises, contents, inventory or other property exposures may ask GIB to evaluate whether liability and property components can be packaged where appropriate.
Possible coverage gap
Eligibility, included coverages and package structure vary by carrier. Commercial Property may also be written separately rather than as part of a package.
Cyber Liability & Data BreachCyber events, data and system interruption
What it is
Cyber insurance may address certain first-party and third-party losses from covered data breaches, cyberattacks, ransomware and system interruption, depending on the policy.
Why businesses like yours commonly carry it
Card payments, online ordering and reservations put customer data and point-of-sale uptime at the center of a restaurant's cyber exposure.
Possible coverage gap
General Liability generally should not be assumed to address data breach response, ransomware or network interruption.
Educational guidance only. Results are not a coverage recommendation, quote, binder, policy interpretation, or guarantee of coverage. Actual needs, availability, forms, limits, exclusions and requirements vary. A licensed insurance professional should review the complete risk and issued policy terms.
Verified Google reviews
What our cyber insurance clients say about us
5.0 / 5from 7 Google reviews
Reviews reflect individual client experiences and are not a guarantee of coverage, pricing or results.
91 Enterprise LLC
March 24, 2026
We are using Gleason insurance for our commercial auto policy and GL policy. David is the best insurance broker I've worked with — very honest, responsive, and knowledgeable. Highly recommend.
Fito Plumbers
February 20, 2026
We have been working with David at Gleason Insurance Brokers for 8+ years. David always goes above and beyond to make sure we have the appropriate coverages. He explains everything in detail and makes sure we feel confident and understand all of our policies. He is always available and responds right away!
Barry Stay
February 17, 2026
David provides great service and I highly recommend him for your insurance needs.
Why restaurants, bars and breweries are targeted
Hospitality businesses process a high volume of card payments, often across several terminals, tablets and online channels. Staff turnover is high, logins are frequently shared, guest Wi-Fi may sit beside business systems, and much of the technology belongs to outside vendors: the point-of-sale provider, online-ordering and delivery platforms, reservation systems and payroll apps.
Each of those creates a way in. Malware on a POS system can capture card data for weeks, a hijacked manager account can redirect payroll, and a vendor outage can take ordering offline without any attack on the restaurant itself.
High card volume across terminals, tablets and online channels
Shared logins and high turnover weaken access control
Much of the technology is run by outside vendors
POS malware, payroll redirects and vendor outages are common paths
What a restaurant cyber policy can cover
A cyber policy for a restaurant group can pay for forensic investigation after a suspected card compromise, legal advice and guest notification, restoring systems, and income lost while a network outage keeps the POS or ordering down, after a waiting period. Some policies also address card-brand assessments and related costs arising from a payment-card breach, where the form specifically includes them.
Payment fraud is the other common loss: a fake vendor invoice, a payroll account changed by someone posing as an employee, or a manager's email used to request a transfer. Social-engineering coverage for those events is often sublimited and may carry a verification condition.
Forensics, legal advice and guest notification after a card compromise
Income lost during a covered POS or ordering outage
Card-brand assessments only where the form includes them
Social-engineering losses, often with a lower sublimit
Card data and PCI DSS: what applies to a restaurant
Any business that accepts payment cards agrees, through its merchant agreement, to follow the Payment Card Industry Data Security Standard. The current version is PCI DSS v4.0.1, and the standard's future-dated version 4 requirements became effective on March 31, 2025. The PCI Security Standards Council publishes small-merchant guides, checklists and a self-check tool for businesses without a cybersecurity team.
Insurance does not satisfy PCI obligations, and a merchant that falls short can face costs under its agreement after a breach. What a cyber policy can do, where the wording reaches it, is help pay for the investigation and some of the consequences. Using point-of-sale systems that encrypt card data at the terminal, keeping guest Wi-Fi separate and changing default passwords reduce both the exposure and the underwriting questions.
Merchant agreements require following PCI DSS
PCI DSS v4.0.1 is current; future-dated requirements took effect March 31, 2025
Free small-merchant guides from the PCI Security Standards Council
Insurance can help fund a response; it does not satisfy PCI
Point-of-sale, online ordering and delivery platforms
Restaurants depend on technology they do not control. When a POS provider, online-ordering platform or payment processor goes down, orders stop at every location using it. Some cyber policies include dependent business-interruption coverage for outages at certain technology vendors, but whether a particular provider and event qualify depends on the definitions and the waiting period.
Third-party platforms also hold guest data on the restaurant's behalf. Vendor contracts often place responsibility for a breach on the merchant, so it is worth knowing what each contract says before deciding how much coverage to carry.
A vendor outage can stop orders at every location
Dependent business interruption may address some vendor outages
Definitions and waiting periods decide what qualifies
Vendor contracts can shift breach responsibility to the restaurant
California rules after a guest or employee data breach
Restaurants hold guest card and contact data and employee Social Security numbers, bank details and identification. Under California Civil Code section 1798.82, as amended by SB 446 effective January 1, 2026, affected California residents must be notified within 30 calendar days of discovering a breach, subject to limited delays, and a sample notice goes to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are involved.
Larger restaurant groups may also meet the California Consumer Privacy Act's thresholds, which include annual revenue above $26,625,000 after the 2025 inflation adjustment. For those businesses, consumers can seek statutory damages of $107 to $799 per consumer per incident after certain breaches, or actual damages if greater.
Guest card data and employee records both trigger notice duties
Notify affected residents within 30 calendar days (SB 446)
Over 500 residents: sample notice to the Attorney General in 15 days
Larger groups may face CCPA statutory damages of $107–$799 per consumer
An illustrative taproom card compromise
A brewery taproom's card processor flags a pattern of fraud on cards used at its terminals. A forensic investigator finds malware on the POS system that has been capturing card data for several weeks, apparently installed through a remote-support login with a default password. The brewery needs the investigation, legal advice on guest and Attorney General notice, a cleaned and rebuilt POS, and income support while card payments are limited.
This example is illustrative, not a report of an actual case or a promise of how any real claim would resolve — real outcomes depend on the specific policy, the facts involved, and the carrier's own review. For a situation that's actually happened or is happening, talk to your broker, a licensed attorney, or the relevant regulatory authority directly.
The processor spots the fraud pattern first
Malware entered through a default remote-support password
Investigation, notice and a rebuilt POS follow
Illustrative only — real claims depend on the policy and the facts
Getting a restaurant or brewery cyber quote
Have the number of locations, annual card transaction volume, the POS provider and whether it encrypts card data at the terminal, the online-ordering, delivery and reservation platforms used, whether guest Wi-Fi is separated from business systems, where multi-factor authentication is used and how backups are kept.
We place cyber for California restaurants, bars, taprooms and breweries and coordinate it with the rest of the hospitality program, including restaurant and brewery insurance and liquor liability, the alcohol insurance a bar or taproom carries for serving guests. Call 844-978-7283 or request a quote with Cyber Liability selected.
Locations, card volume and POS provider
Online-ordering, delivery and reservation platforms
Guest Wi-Fi separation, multi-factor authentication and backups
Call 844-978-7283 or request a quote with Cyber Liability selected
Frequently asked questions
8 questions — start typing to filter
Do restaurants need cyber insurance if the POS vendor handles security?
The vendor's role varies by contract, and merchant agreements generally keep PCI obligations with the restaurant. Many card compromises begin at the location — a default password or an unpatched terminal — so the restaurant can carry the exposure even when a vendor runs the system.
Does cyber insurance cover a point-of-sale outage?
It may, if the outage results from a covered event on the restaurant's network, or from an outage at a covered technology vendor where the policy includes dependent business interruption, and lasts beyond the waiting period.
Does cyber insurance pay PCI fines and card-brand assessments?
Only where the policy specifically includes payment-card coverage, and then within its limits and conditions. Insurance does not satisfy PCI DSS obligations themselves.
What PCI DSS version applies to restaurants now?
PCI DSS v4.0.1 is the current version, and the standard's future-dated version 4 requirements became effective on March 31, 2025. The PCI Security Standards Council publishes free small-merchant guides.
Is payroll fraud covered under a restaurant cyber policy?
A payroll account changed by someone posing as an employee may fall under social-engineering or fraudulent-instruction coverage, if included. Those lines are often sublimited and may require a verification step.
What does California require after a guest card data breach?
Affected California residents generally must be notified within 30 calendar days of discovery under Civil Code section 1798.82 as amended by SB 446, and a sample notice goes to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are involved.
Are breweries and taprooms treated differently from restaurants?
The exposures are similar — card payments, POS systems, online sales and payroll — though breweries that sell online or distribute may add e-commerce and wholesale customer data.
What information do I need for a restaurant cyber quote?
Number of locations, annual card transaction volume, the POS provider and whether it encrypts at the terminal, online-ordering and delivery platforms, guest Wi-Fi separation, multi-factor authentication and backup practices.
Official resources
Verify current licensing, regulatory and program requirements directly with the responsible agency — this is general information, not legal advice, requirements change without notice, and what is summarized here may be out of date or contain errors. Confirming what applies to your own city, project, contract and policy is your responsibility.
