Cyber Insurance for Senior Living: The Limit Is Not the Risk

$6.64 million.

That is the average cost of a healthcare data breach in the most recent IBM study, covering 602 organizations breached between March 2025 and February 2026. It is down from $7.42 million the year before, and it is still the highest average of any industry in the study. The average breach in the United States, across all industries, cost $11.5 million.

A senior living operator is not a hospital system, and your breach will probably not cost the healthcare average. That is not the point. The point is the distance between that cost curve and the limit most operators actually carry, which is often $1 million, bought years ago, on a policy nobody has stress tested since.

Cyber is the one line in the program where the loss starts before anyone knows it happened, the clock runs in days, and the coverage can turn on whether an answer on last year’s application was exactly true. This article walks through the cost data, a real senior living settlement, and the audit to run before renewal.

You hold more records than you think

Start with what an attacker actually gets in a senior living breach. It is not one database. It is the stack a community runs on every day:

• Resident health records, assessments, medication and care documentation
• Social Security numbers, bank and payment details for residents and guarantors
• Family and responsible party contact and financial information
• Employee payroll, benefits, background check, and credentialing files
• Applicant files for people who never moved in and never worked a shift

That mix is why senior living prices like healthcare, not like ordinary real estate. One published broker cost guide puts typical cyber premium for assisted living and senior care at $3,500 to $15,000 a year, similar to a mid size healthcare practice, precisely because operators hold regulated health records and family financial information together. A second broker’s published quote examples show how fast that changes with scale: an assisted living operation in Wisconsin at $60 million in revenue was quoted $47,000 for a $3 million limit with a $25,000 deductible. Those are broker observations, not a benchmark study, and the article treats them that way. Use them only to see the shape: premium is manageable. The incident is not.

What the incident record actually shows

Reported facts, separated from our analysis.

Federal breach data is moving the wrong way on count. An analysis of the HHS Office for Civil Rights breach portal counted a record 772 large healthcare breaches, meaning 500 or more people, in 2025. Hacking and other IT incidents accounted for more than 80 percent of large healthcare breaches that year. OCR has separately reported that ransomware attacks against healthcare rose 278 percent between 2018 and 2023.

The senior living version of that record now has a price tag with a community operator’s name on it. In June 2023, Kisco Senior Living had a network incident in which files containing names and Social Security numbers were acquired without authorization. Notice went out in April 2024 to 26,663 people. The class action that followed has a $1.8 million non-reversionary settlement fund, granted preliminary approval on September 17, 2026. The fund pays documented ordinary losses up to $1,000, documented extraordinary losses up to $10,000, a $250 statutory payment for qualifying California residents, and three years of credit monitoring, and it also has to cover notice, administration, and attorneys’ fees. Claims are due January 19, 2027, and the final approval hearing is March 18, 2027. Kisco denies the claims and denies doing anything wrong.

Do the simple arithmetic, labeled as arithmetic. $1.8 million divided by 26,663 people is $67.51 per notified person, and that is for the settlement fund alone, before Kisco’s own forensic, legal, notification, and downtime costs, and before any regulator takes an interest. A settlement fund is not the total cost of a breach. It is the visible part of it.

A settlement fund is not the total cost of a breach. It is the visible part of it.

The vendor is part of your building now

The largest healthcare breach in U.S. history did not start inside a hospital. It started at a vendor.

On February 12, 2024, criminals used compromised credentials to access a Change Healthcare Citrix remote access portal that did not have multifactor authentication. They moved through the systems for nine days, stole data, and then deployed ransomware on February 21. UnitedHealth’s chief executive confirmed the missing multifactor authentication in testimony to Congress on May 1, 2024, and said the decision to pay a ransom was his. Press reports put that payment at about $22 million. The number of people affected was later filed with OCR at about 192.7 million.

Your scale is different. Your structure is not. The portal data shows business associates were involved in 43 percent of large healthcare breaches in the first half of 2026, up from an average of 20 percent between 2009 and 2017. In a senior living portfolio, the business associate list is the operating list: the electronic health record, payroll and HR, billing, pharmacy interfaces, nurse call and wander systems, the IT provider with remote access to every community. If a vendor’s login is the way in, your incident response, your notification duty, and your reputation are still yours. Under the HIPAA Breach Notification Rule, affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and a breach of 500 or more people also requires notice to HHS and to prominent media in the affected state. State breach laws can run faster. You cannot outsource that clock.

The application is now part of the policy

The second trap is quieter, and it is entirely in the operator’s control.

Since the market hardened in 2021 and 2022, a cyber application has stopped being a formality. It is a detailed controls questionnaire, and the answers are attestations the carrier can test after a claim. Carriers writing healthcare risks now typically require, at a minimum:

1. Multifactor authentication on email, remote access, and privileged accounts, with no convenience exceptions quietly left open
2. Endpoint detection and response on servers and workstations, actually monitored, not just installed
3. Backups that ransomware cannot reach: encrypted, with at least one copy offline, air gapped, or immutable, and restoration tested on a schedule
4. A documented incident response plan that has been tested, with named decision makers and outside counsel and forensics identified in advance
5. Patching, training, and vendor oversight that can be shown with records, not described from memory

In 2022, Travelers sued International Control Services after a ransomware attack, alleging the company’s signed application and multifactor authentication attestation said MFA protected administrative and privileged access, when MFA in fact covered only its firewall and not its servers or remote access. Within weeks the parties agreed to rescission and the court declared the $1 million policy void from its inception. No coverage for that claim, or any other. Treat the carrier’s statements in that case as allegations the insured chose not to contest, which is exactly why the lesson holds: the fight never reached the merits of the attack. It ended at the application.

Read your own application the way that carrier read theirs. Every yes needs a dated record behind it: an MFA enforcement report by account, an EDR coverage report by endpoint, a backup restoration test with a date and a result. A disclosed exception, with a compensating control, is a negotiation at renewal. An undisclosed exception is a rescission argument after a loss.

Size the limit against the remainder, not the premium

Here is the math an operator should run before binding, not after an incident. The table is illustrative. It assumes the limit shown is the only limit available, before any retention, sublimit, or defense cost treatment in your own form. Your form controls your result.

If an incident costs	A $1,000,000 limit leaves you	A $3,000,000 limit leaves you	A $5,000,000 limit leaves you
$250,000	$0	$0	$0
$500,000	$0	$0	$0
$1,800,000 (the Kisco settlement fund alone)	$800,000	$0	$0
$3,000,000	$2,000,000	$0	$0
$6,640,000 (IBM 2026 healthcare average)	$5,640,000	$3,640,000	$1,640,000

Three questions decide whether even this table is optimistic for your program.

What sits inside the limit?

Breach response, forensics, legal, notification, call center, credit monitoring, regulatory defense, business interruption, and cyber extortion do not all draw on the same bucket in every form. Some are sublimited. A $1 million limit with a small extortion or notification sublimit is not a $1 million answer to the incident you are most likely to have.

What is the retention, and is there a waiting period?

Business interruption in cyber is often measured in hours before dollars. A community that cannot access care documentation, medication records, or its phone and nurse call systems does not experience downtime as an accounting entry. Know the hours you carry before coverage responds.

Does the panel control the response?

Most cyber policies require the carrier’s approved forensic, legal, and notification vendors, and require consent before a ransom is paid or even negotiated. That is usually a benefit in a crisis, but only if your team knows the rule before the crisis. A well meaning manager who hires a local IT firm and starts wiping servers can create a coverage problem and destroy the evidence in the same afternoon.

The 45 minute audit before you bind

You do not need a security firm to find the obvious gaps. You need the policy, the application, and 45 minutes.

1. Count your records honestly. Current and former residents, employees, applicants, and guarantors, across every system and vendor. That count, not your bed count, is the notification exposure.
2. Pull last year’s application and verify every yes. MFA, EDR, backups, training, incident response. For each answer, name the report or record that proves it today, not the day it was signed.
3. Test one backup restoration. Pick a critical system, restore it to a test environment, and write down how long it took. An untested backup is a hope, and underwriters price it that way.
4. List every vendor with remote access or resident data. Confirm a signed business associate agreement where one is required, MFA on the vendor’s access, and a named contact for a 2 a.m. incident.
5. Read the sublimits and the panel rules. Extortion, notification, regulatory, and business interruption sublimits, the retention, the waiting period, and who you are allowed to call first.
6. Run the table above with your limit. Use $1.8 million and $3 million as the test incidents. If the remainder is a number your balance sheet cannot absorb without pain, the limit is wrong, and it is cheaper to fix that conversation now than after a claim.
7. Write the first 24 hours down. Who decides, who calls the carrier, who calls counsel, what staff do when systems go down, and how care is documented on paper until they return. Put it where a night manager can find it.

A cyber policy is not bought for the day the firewall holds. It is bought for the day a vendor login, a phished password, or one portal without a second factor lets someone in anyway. On that day, three things decide the outcome: whether the controls you attested to were real, whether the limit matches the remainder your balance sheet can carry, and whether your team knew the first call to make.

Check all three before renewal. The 60 day clock will not wait for you to check them after.

Sources: IBM, Cost of a Data Breach Report 2026; HIPAA Journal, Healthcare Data Breach Statistics, updated October 15, 2026; Kisco Senior Living data breach settlement, Gois v. Kisco Senior Living, LLC, No. 3:24-cv-00751, S.D. Cal.; Change Healthcare ransomware attack, February 2024; Travelers v. International Control Services, C.D. Ill., filed July 6, 2022; HIPAA Breach Notification Rule, 45 CFR 164.400 to 414.