Under a tent, by the beach
In the spring of 1997, at the Risk and Insurance Management Society conference in Honolulu, Steven Haase, who had spent more than two years urging insurers to cover digital risk, pitched his idea to some twenty people gathered under a tent near the shore. The trade still has a nickname for the scene: "Breach on the Beach" (Insurance Journal, 2022, NordProtect).
The resulting policy, Internet Security Liability, was underwritten by AIG. Accounts differ on how broad it was; the most common one describes a third-party liability policy, a "hacker policy", designed for the first online retailers that stored their customers' data (Insurance Journal, 2014, Federal Reserve Bank of Chicago). It sold poorly: few companies knew they were exposed, and the year 2000 bug had everyone's attention.
The law that made the market
On September 25, 2002 the governor of California signed SB 1386, in force from July 1, 2003: any business holding computerized personal data on California residents had to notify them when that data was compromised, wherever its servers sat. It was the first law of its kind in the United States (Paul Hastings, California State University, Bakersfield).
The statute changed the nature of the loss. Before it, a data leak could stay quiet; after it, a leak was sure to cost money: letters to customers, call centers, investigators, lawyers. Those costs, certain and measurable, became the core of the cyber policy, and the market began to grow. First-party covers, notification, crisis management, and later extortion, grew out of it.
What it teaches
Cyber insurance was not born from the hacker, who already existed, but from a public decision that put a price on the leak. The same thing is happening again with the European data protection regulation, incident reporting duties and bans on paying certain ransoms: each time, a lawmaker moves what the contract has to pay. From its first day, cyber risk has been a regulatory risk, and therefore a political one.
This page tells a story; it says nothing about what anyone should insure today.