Cyber Liability Isn’t Just for Tech Companies: The Digital Risk Facing Florida Janitorial Businesses

“Why would a hacker target a cleaning company?”

It sounds like a fair question.

After all, your company cleans buildings. You are not developing software or processing millions of online transactions.

However, think about what your company actually has.

Employee Social Security numbers.

Payroll records.

Bank information.

Customer contacts.

Email accounts.

Payment information.

Vendor logins.

Building access credentials.

Alarm codes.

Scheduling software.

That is why cyber insurance for Florida janitorial companies deserves a place in your insurance program.

Your company may sell cleaning services.

But it runs on data, passwords, email, banking, and software.

A Janitorial Company Is More Digital Than It Looks

The cleaning happens physically.

The business behind the cleaning is increasingly digital.

Think about the systems your company uses every day.

You may rely on:

• Payroll software
• Accounting systems
• Email
• Scheduling applications
• Timekeeping systems
• Online banking
• Electronic payments
• Customer portals
• HR platforms
• Cloud storage
• CRM software
• Building access applications

Now imagine losing access to those systems tomorrow morning.

Can employees access assignments, process payroll, communicate with crews, invoice customers, and access customer records?

A cyberattack does not have to shut down your cleaning equipment.

It only has to shut down the systems that tell your employees where to clean.

What Information Does Your Cleaning Company Actually Store?

You cannot protect information if you do not know you have it.

Start with a simple data inventory.

Employee Information

Your company may store:

• Social Security numbers
• Addresses
• Dates of birth
• Direct deposit information
• Tax documents
• Driver information
• Employment records
• Background screening information

That information can be valuable to criminals.

Customer Information

You may also have:

• Customer contacts
• Contracts
• Billing information
• Facility information
• Access instructions
• Alarm information
• Electronic credentials

Some of this information may also provide physical access to customer locations.

Business Information

Finally, consider your own company information.

You may store:

• Banking records
• Tax documents
• Vendor credentials
• Insurance information
• Financial reports
• Passwords
• Payment information

Make a list.

Then identify where the information is stored and who can access it.

You cannot protect data you don’t know you have.

Phishing Is Often the Front Door

Not every cyberattack starts with a sophisticated hacker breaking through a firewall.

Sometimes, it starts with an email.

An employee receives a message that appears to come from Microsoft.

“Your password expires today. Click here.”

The employee clicks.

The website looks legitimate, so the employee enters a username and password.

Now the criminal has the credentials.

From there, the attacker may gain access to email or other systems.

That can lead to:

• Email takeover
• Fraudulent invoices
• Password resets
• Customer impersonation
• Malware
• Additional credential theft

The criminal did not defeat your technology.

The employee unknowingly provided access.

Hackers do not always break into your network. Sometimes an employee opens the door for them.

Employee training can help reduce this risk.

A simple reporting process can also help.

Employees should know exactly what to do when something looks wrong.

Business Email Compromise Can Turn One Email Into a Financial Loss

Business email compromise can be especially dangerous.

Imagine one of your customers normally pays your janitorial company $25,000 each month.

A criminal gains access to an accounting employee’s email.

The criminal watches the conversation.

Then the attacker sends your customer a message.

“We recently changed banks. Please use the attached ACH instructions for your next payment.”

The message comes from your actual email account.

The customer sends the money.

Unfortunately, the bank account belongs to the criminal.

Now reverse the scenario.

A criminal compromises one of your vendor’s accounts.

Your employee receives an email asking your company to change the vendor’s banking information.

You make the change.

The next payment goes to the wrong account.

One email can create a significant loss.

A legitimate-looking email can create a very real financial loss.

That is why payment changes need verification outside the original email conversation.

Social Engineering and Cyber Insurance Are Not Automatically the Same Thing

This is where insurance becomes important.

Business owners often assume that if a computer or email was involved, cyber insurance must cover the loss.

Do not make that assumption.

Depending on the policy, fraudulent transfers may involve coverage such as:

• Social engineering
• Funds transfer fraud
• Computer fraud
• Crime coverage
• Cyber coverage
• Specific endorsements

The details matter.

Our previous discussion about janitorial bonds and crime insurance is relevant here.

Crime and cyber policies can address different exposures.

They can also contain different definitions, limits, deductibles, and conditions.

The fact that a computer was involved does not automatically mean the cyber policy pays the loss.

Ask your insurance professional how your program addresses fraudulent transfers and social engineering.

Then understand the procedures you must follow.

Ransomware Can Stop More Than Your Computers

Imagine arriving Monday morning and discovering that your systems are locked.

You cannot access email.

You cannot open your scheduling system.

Your customer list is unavailable.

Payroll information is inaccessible.

Employees begin calling supervisors.

“Where am I supposed to go today?”

The cleaning equipment still works.

The vehicles still start.

The office still has electricity.

But the business has a serious problem.

Ransomware can block access to critical systems and data.

The financial impact may extend far beyond restoring a computer.

It can disrupt your entire operation.

A cyberattack does not have to stop the cleaning. It only has to stop the systems that tell your employees where to clean.

Cybersecurity is also a business continuity issue.

Cyber Business Interruption Is Different From Property Business Income

In our article about hurricane insurance for Florida janitorial companies, we discussed business income after physical property damage.

Cyber business interruption is a different conversation.

A hurricane might damage your building and stop operations.

A cyberattack might stop operations while your building remains completely functional.

Depending on the cyber policy, business interruption coverage may help address qualifying income losses caused by a covered cyber event.

However, policies contain specific triggers.

They may also contain waiting periods, limits, and other conditions.

Ask what happens if:

• Ransomware disables your scheduling system
• Your network becomes unavailable
• A cyber event disrupts a critical vendor
• Employees cannot access operational data

The important distinction is simple.

A hurricane can shut down your building. Ransomware can shut down your business while the lights are still on.

Both deserve continuity planning.

Payroll Data Makes Janitorial Companies Attractive Targets

Janitorial companies can have large workforces.

As a result, payroll and HR systems may contain a significant amount of personal information.

For each employee, you may have:

• Social Security number
• Home address
• Date of birth
• Bank information
• Tax records
• Employment information

A criminal may use stolen information for identity theft or other fraud.

Your payroll system can also become a target.

Do not assume using an outside payroll company eliminates your exposure.

You may still have employee information stored in:

• Email
• Local files
• HR systems
• Accounting software
• Cloud storage

You also depend on the payroll provider to operate.

Outsourcing a function can change the exposure.

It does not necessarily eliminate it.

Direct Deposit Fraud Deserves Its Own Control

Here is another simple fraud scenario.

Payroll receives an email.

“Hey, I changed banks. Can you update my direct deposit before Friday?”

The email appears to come from an employee.

Payroll updates the account.

Friday arrives.

The employee calls.

“My paycheck never showed up.”

The employee never sent the email.

A criminal did.

This type of fraud does not require a complicated cyberattack.

It only requires someone to believe an email.

Create a verification procedure.

When an employee requests a banking change, verify the request using a known method outside the original message.

Do not simply reply to the email.

Never let one email be enough to change where someone’s paycheck goes.

A small procedural change can prevent a significant loss.

Your Customer’s Building Access Information Has Value

This is where cyber risk becomes especially important for janitorial companies.

Your company may have more than customer contact information.

You may have the digital keys to the building.

Cleaning companies often work after hours.

Employees may receive:

• Alarm codes
• Door codes
• Electronic badges
• Building access applications
• Lockbox information
• Electronic keys
• After-hours instructions

Now imagine an employee’s email account is compromised.

Inside the mailbox are messages containing customer addresses and access instructions.

The cyber event has now created a physical security issue.

That is very different from a typical stolen password.

For a janitorial company, a stolen password may unlock more than a computer.

Treat customer access information as sensitive data.

Limit who receives it.

Control how employees share it.

Remove access when employees no longer need it.

Cybersecurity and physical security can overlap.

Janitorial companies sit directly in that intersection.

Remove Digital Access When Employees Leave

Employee offboarding should involve more than collecting keys and uniforms.

When employment ends, review digital access.

Remove access to:

• Email
• Scheduling systems
• Payroll portals
• CRM platforms
• Customer portals
• Building access applications
• Cloud storage
• Shared systems
• Other company accounts

Also review passwords the employee knew.

This is especially important for customer credentials.

Our discussion of physical access in janitorial bonds and crime insurance applies digitally as well.

A former employee should not retain access simply because nobody remembered to turn it off.

An employee’s digital access should end when their employment ends.

Build that step into your termination checklist.

Shared Passwords Create Shared Problems

“What’s the password?”

“Cleaning123.”

“Who uses it?”

“Everybody.”

That is a problem.

Shared passwords make it difficult to know who accessed a system.

They are also harder to manage when an employee leaves.

One employee may write the password down.

Another may save it somewhere insecure.

Someone else may reuse it on another website.

Where practical, give employees unique accounts.

Use strong passwords.

Consider a reputable password manager for appropriate business use.

Most importantly, avoid using one password across several critical systems.

One compromised password should not unlock everything.

Multi-Factor Authentication Should Be a Baseline Control

A password provides one layer of security.

Multi-factor authentication, commonly called MFA, adds another.

For example, an employee enters a password.

The system then requires another form of verification.

That can make a stolen password less useful to a criminal.

Consider MFA for sensitive systems such as:

• Email
• Online banking
• Payroll
• Accounting
• Cloud storage
• Administrative accounts

MFA is not perfect.

No security control is.

However, it can add an important barrier when passwords are stolen.

A stolen password is much less useful when the criminal still needs another form of verification.

Cyber insurers may also ask about security controls during underwriting.

Answer those questions accurately.

Your application should reflect what your company actually does.

Backups Matter Only If You Can Restore Them

Backups are an important part of cyber recovery.

However, simply saying “we have backups” is not enough.

Ask:

• What information is backed up?
• How often?
• Who can access the backups?
• Are critical systems included?
• Can we restore the information?
• Have we tested the restoration process?

A ransomware event can become much worse if the company cannot recover important data.

Work with qualified technology professionals to build a backup strategy that fits your business.

Then test it.

A backup you have never tested is a hope, not a recovery plan.

The same backups may also help your company recover after a hurricane or other disaster.

Cybersecurity and disaster planning should support each other.

Third-Party Vendors Can Become Your Cyber Exposure

Your janitorial company probably relies on outside technology providers.

Examples may include:

• Payroll
• Accounting
• Scheduling
• Payment processing
• CRM
• Background screening
• HR software
• Cloud storage

Those vendors may hold your information.

They may also provide systems your business depends on every day.

What happens if one of them suffers a cyberattack?

Your network may be fine.

Your employees may still lose access to an important service.

Ask:

• What information do we share with this vendor?
• How important is the system?
• What happens if it becomes unavailable?
• How will the vendor notify us about a breach?
• Do we have an alternative process?
• How does our cyber insurance address dependent systems or vendors?

Outsourcing the software does not outsource the disruption.

Understand your dependencies.

What Does Cyber Insurance for Florida Janitorial Companies Actually Cover?

Cyber insurance can look complicated because it is not just one coverage.

A cyber event can create several different costs.

A policy may address some of them.

First-Party Cyber Costs

Depending on the policy, coverage may address qualifying costs involving:

• Incident response
• Digital forensics
• Data restoration
• Cyber extortion
• Ransomware
• Business interruption
• Breach notification
• Credit monitoring
• Crisis management

These are costs your own business may incur after an event.

Third-Party Cyber Liability

A cyber event can also affect other people.

Customers or employees may allege that your company failed to protect information.

Regulatory matters may also arise after certain incidents.

Cyber policies may provide coverage for certain third-party claims or regulatory matters, subject to policy terms.

The important point is this:

Cyber insurance is not one coverage. It is a collection of coverages responding to different parts of a cyber event.

Review the policy carefully.

Understand the limits.

Review sublimits.

Ask about exclusions.

Also understand which response professionals the insurer expects you to contact after an event.

Florida Data Breach Requirements Can Create Real Obligations

A cyberattack can create more than a technology problem.

It can create legal obligations.

Florida law addresses the protection of certain personal information and notification following qualifying breaches.

Whether a specific incident creates a notification or other legal obligation depends on the facts and applicable law.

Do not guess.

After a suspected breach, involve the appropriate professionals.

Depending on the cyber policy, the insurer may provide access to resources such as:

• Breach counsel
• Forensic professionals
• Notification services
• Credit monitoring
• Other incident-response specialists

Follow the policy’s reporting requirements.

This is another reason to understand the process before the event.

After a breach, knowing what happened is only the first question. The next question is what the law requires you to do about it.

Qualified legal counsel should address your company’s specific legal obligations.

General Liability Is Not a Substitute for Cyber Insurance

General liability is one of the foundational coverages for a cleaning company.

However, do not assume it replaces cyber insurance.

Our discussion of general liability insurance for Florida janitorial companies focused on exposures such as bodily injury and property damage.

Cyber events create different problems.

Compare these two losses.

A customer slips on a wet floor.

Now consider a hacker stealing customer information from your system.

Those are not the same exposure.

A stolen customer database is not the same exposure as a customer slipping on a wet floor.

Review cyber risk separately.

Cyber Requirements May Already Be in Your Customer Contracts

You may not be the only person thinking about your cyber exposure.

Your customers may be thinking about it too.

Larger organizations can include cybersecurity requirements in vendor contracts.

A contract may address:

• Cyber liability insurance
• Required limits
• Data protection
• Breach notification
• Security procedures
• Vendor requirements

This is another reason to review janitorial contract insurance requirements before signing an agreement.

Do not promise cybersecurity controls your company does not actually have.

Do not promise insurance limits before confirming the coverage.

Review the requirements first.

Then determine the cost and operational impact.

Build a Janitorial Cyber Risk-Control Process

Cybersecurity does not need to begin with a 100-page manual.

Start with a repeatable process.

Step 1: Identify

What systems do you use?

What information do you store?

Where is it?

Step 2: Restrict

Who actually needs access?

Do not give every employee access to every system.

Step 3: Authenticate

Use strong passwords.

Use MFA on appropriate sensitive systems.

Step 4: Verify

Verify:

• Banking changes
• Direct deposit changes
• Payment instructions
• Unusual financial requests

Do not rely on one email.

Step 5: Back Up

Identify critical information.

Back it up appropriately.

Then test your ability to restore it.

Step 6: Train

Teach employees to recognize:

• Phishing
• Suspicious links
• Fake login pages
• Fraudulent payment requests
• Unexpected MFA prompts

Keep training practical.

Step 7: Offboard

Remove access when employees leave.

Collect physical access devices.

Disable digital credentials.

Step 8: Insure

Review:

• Cyber liability
• Crime
• Social engineering
• Funds transfer fraud
• Cyber business interruption

Understand how these coverages work together.

Step 9: Respond

Create an incident-response plan.

Employees should know who to contact when something goes wrong.

The process is straightforward:

Identify. Restrict. Authenticate. Verify. Back Up. Train. Insure. Respond.

What Should Employees Do When Something Looks Wrong?

Employees do not need to become cybersecurity experts.

They need a simple process.

Maybe an employee receives:

• A suspicious email
• An unexpected MFA request
• New payment instructions
• A strange password reset
• A suspicious attachment
• An unusual message from management

Teach employees to stop.

Do not approve the request simply because it looks urgent.

Do not use contact information inside a suspicious message to verify it.

Instead, use a known contact method.

Then report the incident internally.

Speed helps the criminal. Verification helps the business.

Create a culture where employees feel comfortable reporting mistakes quickly.

The sooner your company knows about a potential problem, the sooner it can respond.

Florida Janitorial Cyber Risk Checklist

Use this checklist to start reviewing your company’s digital exposure.

Accounts

Review:

• Unique user accounts
• Strong passwords
• MFA
• Administrative access
• Former employee access

Remove unnecessary access.

Email

Review:

• Phishing training
• Suspicious-email reporting
• Payment-change procedures
• Password security
• MFA

Email deserves special attention because so much business communication happens there.

Payroll

Review:

• Direct deposit change procedures
• Employee information
• Payroll vendor access
• Verification procedures

Never let one email change where an employee’s paycheck goes.

Customer Security

Review:

• Alarm codes
• Electronic keys
• Door credentials
• Customer portals
• After-hours instructions
• Access applications

Treat customer access information as sensitive.

Data

Identify:

• What information you have
• Where it is stored
• Who can access it
• How it is backed up
• Whether restoration has been tested

Do not collect information without understanding where it goes.

Vendors

Review critical providers such as:

• Payroll
• Accounting
• Scheduling
• Payment processing
• Cloud storage
• HR systems

Know what happens if they become unavailable.

Insurance

Review:

• Cyber liability
• Crime
• Social engineering
• Funds transfer fraud
• Cyber business interruption
• Incident-response services

Do not assume one policy addresses every digital loss.

Your Cleaning Company Runs on More Than Mops and Vacuums

Your employees clean buildings.

But your business runs through technology.

Email tells people where to go.

Scheduling software organizes crews.

Payroll pays employees.

Banking moves money.

Customer portals provide information.

Building systems may provide access.

That creates digital exposure.

Know what data you have.

Control who can access it.

Use appropriate authentication.

Verify financial changes.

Train employees.

Protect your backups.

Review vendors.

Understand your cyber and crime insurance.

Build a response plan.

Most importantly, stop thinking cyber risk belongs only to technology companies.

You don’t have to be a technology company to have a technology problem.

And for a janitorial company, the stakes can extend beyond data.

A stolen password may unlock more than a computer.

Download the Florida Janitorial Cyber Risk Checklist

Your janitorial company may hold more valuable digital information than you realize.

Download our Florida Janitorial Cyber Risk Checklist to review email, payroll, banking, customer access credentials, employee accounts, vendors, backups, cyber insurance, crime coverage, and your incident-response plan before someone else finds the weakness first.

Use the checklist to review:

• Email security
• MFA
• Payroll
• Direct deposit changes
• Banking procedures
• Customer access credentials
• Employee offboarding
• Backups
• Vendors
• Cyber insurance
• Crime coverage
• Social engineering
• Funds transfer fraud
• Cyber business interruption
• Incident response

Then build your cyber program around a simple process:

Identify. Restrict. Authenticate. Verify. Back Up. Train. Insure. Respond.

Because the cleaning may happen inside your customer’s building.

But the systems that keep your company running are increasingly digital.

Frequently Asked Questions