Wisconsin Data Breach Notification Laws (Statute 134.98)

Wis. Stat. § 134.98 requires any entity that maintains personal information of Wisconsin residents to notify affected individuals within a "reasonable time" after discovering a breach. The statute does not define a hard deadline in days, which creates ambiguity that can work against you during regulatory scrutiny. Personal information under the statute includes Social Security numbers, driver's license numbers, financial account numbers, and DNA profiles, among other categories. If your business holds any of these data types for employees, customers, or patients, you are subject to the notification requirement. Failure to comply can result in enforcement action by the Wisconsin Department of Agriculture, Trade and Consumer Protection, and affected individuals retain the right to pursue civil remedies. A cyber policy form that includes regulatory defense and notification cost coverage directly addresses this exposure.

First-Party vs. Third-Party Liability Coverage

First-party coverage pays for your own losses: forensic investigation, data restoration, business interruption, and ransom payments. Third-party coverage responds when someone else sues you or a regulator comes calling. Most standalone cyber policies include both, but the sublimits and retentions vary dramatically between carriers. A $1 million aggregate with a $250,000 sublimit on ransomware, for example, may leave you significantly underinsured if an extortion demand exceeds that cap. Understanding how the insuring agreements are structured, not just the total limit on the declarations page, is where the real work happens.

Ransomware and Cyber Extortion Protection

Ransomware demands against mid-market companies have increased in both frequency and severity. A cyber extortion insuring agreement typically covers the ransom payment itself, the cost of a negotiation firm, and the forensic work needed to determine whether decryption is viable. The catch is that many policy forms impose a co-insurance requirement on ransom payments, meaning you bear a percentage of the demand. Others exclude payments to sanctioned entities, which can void coverage entirely if the threat actor is on an OFAC list. Review the extortion clause carefully before binding.

Data Breach Response and Forensic Investigation

Breach response coverage pays for the immediate aftermath: hiring a forensic firm to identify the attack vector, engaging breach counsel, notifying affected individuals, and providing credit monitoring. Under Wisconsin's notification statute, these costs accrue quickly. A single breach involving 10,000 records can generate $500,000 or more in notification and monitoring expenses alone. The forensic investigation also determines whether the breach triggers notification obligations under other states' laws if you hold data on residents outside Wisconsin.

Business Interruption and Digital Asset Restoration

If a cyber event takes your systems offline, business interruption coverage replaces lost income during the restoration period. Most policy forms impose a waiting period, typically 8 to 12 hours, before coverage begins. Digital asset restoration covers the cost of rebuilding or recovering corrupted data, software, and system configurations. For manufacturers running ERP systems or healthcare providers dependent on electronic health records, even a 24-hour outage can mean significant revenue loss and patient safety concerns.

Manufacturing: Protecting Supply Chains and IP

Manufacturing has become the most targeted industry for cyberattacks, accounting for 25% of all attacks in 2025 due to vulnerabilities in operational technology and interconnected supply chains. Wisconsin manufacturers running CNC machines, SCADA systems, or IoT-connected production lines face exposure that a generic cyber policy may not address. Look for policy forms that cover "computer systems" broadly enough to include operational technology, not just traditional IT infrastructure. Intellectual property theft, particularly trade secrets related to proprietary manufacturing processes, is another risk that may require a separate insuring agreement or endorsement.

Healthcare: HIPAA Compliance and Patient Data

Wisconsin healthcare providers operate under both state breach-notification requirements and federal HIPAA regulations. A cyber event involving protected health information triggers dual reporting obligations: to affected patients, to the U.S. Department of Health and Human Services, and potentially to state regulators. The regulatory defense costs alone can exceed $200,000 in a mid-sized breach. Your policy form should explicitly cover HIPAA regulatory proceedings and include a retroactive date that predates your current policy period, since breaches are often discovered months after the initial intrusion.

Professional Services: Errors, Omissions, and Client Confidentiality

Accounting firms, law practices, and consulting companies hold sensitive client data that makes them prime targets for ransomware and social engineering attacks. A breach at a professional services firm often triggers third-party liability from clients whose data was exposed. The intersection of cyber liability and professional liability (E&O) creates a coverage gap if the two policies are not coordinated. An agency like Bloc Cyber, which places both cyber and technology E&O as a core practice, can review how the two forms interact so you are not left with a gap between them.

A basic cyber add-on to a BOP or general liability policy may appear adequate on the surface. The sublimits, however, are usually too low to cover a real claim. A standalone policy provides dedicated limits and broader insuring agreements that respond to the full scope of a cyber event.

Does Wisconsin law require businesses to carry cyber insurance? No. Wisconsin does not mandate cyber insurance. However, Wis. Stat. § 134.98 creates financial obligations following a breach that are difficult to absorb without coverage.

What is the average cost of a cyber policy for a Wisconsin mid-market company? Premiums vary based on revenue, industry, data volume, and security posture. A manufacturer with $20 million in revenue might see annual premiums between $5,000 and $25,000 for a $1 million limit. The cyber insurance market has seen steady premium growth through 2026, driven by increasing claim frequency.

Are ransomware payments covered under a standard cyber policy? Many standalone forms include cyber extortion coverage, but sublimits, co-insurance provisions, and OFAC exclusions can limit the payout. Read the extortion insuring agreement before assuming you are protected.

Do I need cyber insurance if I already have a technology E&O policy? Yes. Technology E&O covers claims arising from your professional services or technology products. Cyber liability covers the breach itself, the response costs, and the regulatory fallout. The two policies address different exposures.

What triggers notification under Wisconsin's breach statute? Unauthorized acquisition of personal information that includes a name combined with a Social Security number, driver's license number, financial account number, or similar identifier. The statute requires notification within a "reasonable time."

Wisconsin's "reasonable time" standard for breach notification is deliberately flexible, but that flexibility is a double-edged sword. Regulators and courts interpret reasonableness based on the complexity of the breach and the steps taken to investigate it. A policy form with a breach response services panel, including pre-approved forensic firms and breach counsel, can compress your response timeline significantly. This matters because delays in notification increase both regulatory scrutiny and litigation exposure.

Cyber underwriters evaluate your security posture before quoting. Multi-factor authentication on email and remote access, endpoint detection and response tools, encrypted backups stored offline, and employee phishing training are now baseline requirements for most carriers. If you lack MFA on email, many underwriters will decline the risk outright. Wisconsin businesses in sectors with higher rates of cyber incidents among vulnerable populations face additional scrutiny on data handling practices.

Every cyber policy contains exclusions that define the boundary of coverage. Common exclusions include unencrypted portable devices, failure to maintain minimum security standards, prior known incidents, and infrastructure failures not caused by a cyber event. The "failure to maintain" exclusion is particularly dangerous because it gives the carrier a basis to deny a claim if your security fell below the standard described in your application. Bloc Cyber's practice of reviewing the policy form at the insuring-agreement and endorsement level before binding exists specifically to flag these exclusions so you understand what the form will and will not do.

Some carriers offer premium credits or lower retentions for businesses that maintain a written incident response plan. A plan that designates roles, establishes communication protocols, and identifies pre-approved vendors can reduce your out-of-pocket costs during a claim. Wisconsin's disaster and emergency response infrastructure provides a framework for physical events, but cyber incidents require a separate, dedicated response plan. Your cyber policy may even include access to a breach coach or incident response hotline as part of the coverage.

If your company operates across state lines, each state's breach-notification statute may apply depending on where the affected individuals reside. Wisconsin's statute is one of more than 50 state and territorial notification laws. A breach involving records of residents in Wisconsin, Illinois, Minnesota, and Michigan triggers four separate notification obligations, each with its own timeline and content requirements. A cyber policy with multi-state regulatory defense coverage and an agency with state-by-state fluency in notification triggers is not optional for businesses with cross-border operations: it is a structural requirement of the coverage.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.