Cyber Liability Insurance for Churches: Protecting Donor Data

Churches collect and store a significant amount of sensitive information — donor names and addresses, giving records, bank account details for online giving, children’s ministry registration forms, counseling intake records, and staff payroll data. Yet many congregations assume they are too small or too nonprofit-focused to be targets for cybercriminals. That assumption is increasingly dangerous.

Why Churches Are Targeted by Cybercriminals

Nonprofit organizations, including churches, are attractive targets for several reasons. They often have less sophisticated cybersecurity infrastructure than for-profit businesses. Their staff and volunteers may not receive regular security training. And they frequently hold payment card data and bank routing numbers through online giving platforms.

Common cyber threats facing churches include:

• Phishing attacks: Fraudulent emails designed to trick staff or volunteers into revealing login credentials or transferring funds
• Ransomware: Malicious software that encrypts your files and demands payment to restore access — threatening everything from your donor database to financial records
• Business email compromise (BEC): Scammers impersonating a pastor or executive pastor to request wire transfers or gift cards
• Data breaches: Unauthorized access to your church’s donor or member records, which can trigger notification obligations and reputational harm

What Is Cyber Liability Insurance?

Cyber liability insurance is a policy designed to help organizations recover from the financial consequences of a cyberattack or data breach. For churches, it typically provides two types of protection:

First-party coverage pays for costs your church incurs directly, including:

• Forensic investigation to determine how the breach occurred
• Notification costs to inform affected donors or members
• Credit monitoring services for affected individuals
• Data restoration expenses
• Business interruption losses if your systems are down
• Ransomware payments and negotiation support

Third-party coverage protects your church if donors, members, or others sue you after their data is compromised. It covers legal defense costs, settlements, and regulatory fines related to data privacy laws.

Do State and Federal Privacy Laws Apply to Churches?

Many church leaders are not aware that data privacy regulations can apply to nonprofit and religious organizations. Depending on your state and the nature of the data you collect, your church may have legal obligations to notify individuals affected by a data breach and to maintain certain security standards for personally identifiable information. California’s CCPA, for example, can apply to nonprofits meeting certain thresholds.

A cyber liability policy can help cover the legal costs of determining your obligations and complying with them after a breach occurs.

How Much Does Cyber Liability Insurance Cost for a Church?

Premiums vary based on factors including the size of your congregation, the volume of online giving transactions, the types of data you collect, and your existing cybersecurity practices. Many small to mid-size churches can obtain meaningful cyber coverage for a few hundred to a few thousand dollars per year — a modest expense relative to the potential cost of a breach, which can easily reach tens of thousands of dollars.

Practical Steps to Reduce Your Church’s Cyber Risk

Insurance is one layer of protection, but reducing your risk in the first place is equally important. Consider these steps:

• Use multi-factor authentication (MFA) on all church email accounts and financial systems
• Train staff and volunteers to recognize phishing emails
• Establish a verification protocol before any wire transfer or unusual financial request is processed
• Back up your data regularly and store backups offline or in a separate cloud environment
• Work with your online giving platform to understand what security protections are in place for donor payment data

Is Cyber Coverage Included in a Standard Church Insurance Package?

Most standard church property and liability policies do not include meaningful cyber coverage. Some may include a small sublimit — often $10,000 to $25,000 — but this is rarely sufficient to cover the full cost of a breach response. A standalone cyber liability policy or a church package that specifically includes robust cyber coverage is the better option for congregations that collect donor or member data online.

Protecting Your Congregation’s Trust

Donors trust your church with their financial information because they believe in your mission. A data breach doesn’t just cost money — it erodes that trust. Cyber liability insurance, combined with good security practices, helps ensure your church can respond quickly and transparently if an incident occurs. Contact our team to discuss cyber coverage options designed for churches and faith-based organizations.