Addressing cyber liability for your franchise system

From 2018 to 2024, the number of cyber events doubled, according to the Federal Bureau of Investigation. High-profile incidents involving  AT&T and Match Group  represent just a few of the many cyber incidents reported each day.

Franchise systems face a distinct risk profile. Their distributed network model often includes dozens or hundreds of independently managed locations connected through shared technology, multiple vendors, and coordinated payment systems. This structure creates multiple potential entry points for cybercriminals compared with more centralized enterprises.

The result can be greater exposure to cyberattacks, particularly ransomware. According to the FBI’s Internet Crime Complaint Center, ransomware complaints in the United States remained high in 2025, with more than 3,600 incidents reported and losses exceeding $32 million. Ransomware is likely to remain a significant cost driver for U.S. organizations in the years ahead.

Franchise systems may also lack the unified response protocols and coordinated defense strategies used by larger enterprises. Understanding why franchises face unique cyber vulnerabilities—and implementing five critical practices—can help transform cyber liability from an individual franchisee concern into a coordinated, system-wide defense.

Franchise systems can be attractive targets for cybercriminals because they often rely on shared technology, multiple vendors, and connected operations across many locations. When a cyber incident occurs, the impact can extend beyond a single franchisee to affect customers, franchisees, and franchisors across the system.

A cyber incident is a brand issue, not just an individual franchisee issue.

As a franchisor, you may be considering whether to address cyber liability as an insurance requirement for your franchisees. Should they be required to carry cyber insurance? If so, what limits should apply? These are important risk management questions, but the broader question is: What happens if a cyber incident occurs within your franchise system?

A ransomware attack, for example, could disrupt the ability to share client data, process payments, or conduct business.

What makes cyber insurance different from many other franchisee coverages is that the response—and who coordinates it—can significantly affect the outcome.

The first hours and days after a cyber incident are critical. During this period, the organization must determine how the event occurred and coordinate an effective response, including forensic IT support, legal services, notifications, public relations, and efforts to get franchisees back up and running.

Franchise system cyber liability considerations

Cyber threats to franchise systems continue to grow. Factors contributing to cyber claims within franchise brands include:

• Increased frequency and severity of ransomware attacks
• Vulnerabilities involving multiple vendors and suppliers
• Social engineering fraud
• Inconsistent IT and data security practices across the franchise network

Historically, many franchisors have addressed cyber exposure by recommending that franchisees carry cyber insurance. In some cases, coverage was recommended but not required as part of the franchise disclosure document (FDD) insurance process.

Cyber insurance can provide access to resources that help organizations respond to cyber threats, including loss mitigation guidance. It may be one part of an overall risk management strategy.

When assessing cybersecurity and insurance coverage across your franchise system, consider the following five practices: 

1. View the risk as a franchise-wide issue

Regardless of how many franchisees are affected, a cyber incident can impact your brand and require a coordinated response.

Unlike other insurance coverages, such as general liability and workers' compensation, which are typically written at the individual franchisee level, cyber insurance should be evaluated across the franchise system. Consistency in coverage, limits, and claims handling can help support a more coordinated response if an incident occurs.

2. Review IT security and privacy controls throughout your franchise system

Franchisors should assess whether security and privacy controls are consistent across the franchisee network. Some franchisors establish specific requirements for operations and security system integration, while others allow franchisees more flexibility.

Franchisors and franchisees should understand how these differences affect their daily operations. Inconsistent controls can complicate incident response, risk mitigation, and preparedness.

3. Protect your supply chain by preparing for cyber events

Many franchisors serve as a critical link in the delivery of goods and services to franchisees. If a cyber incident disrupted that supply chain, what contingencies would help minimize business income loss and reputational harm for the franchisor and franchisees?

Preparation is key. Consider how critical operations, such as product delivery and payment processing, would continue during an incident.

A contingency plan should include an audit component to help assess compliance with applicable security frameworks and coordination requirements.

4. Recognize that an external breach can affect the entire franchise system

Breaches involving third-party vendors and suppliers are a common source of cybersecurity incidents. Review contract language with key suppliers and vendors to address security and privacy risks, as well as potential disruptions.

Areas to review may include:

• Indemnification provisions
• Audit provisions
• Cyber insurance requirements
• Notification and reporting timelines
• Breach response and coordination requirements
  

5. Establish a business continuity and disaster recovery plan

Time is critical after a breach, and a prearranged response plan can help support a more effective response. For a franchise system, it is important to establish a business continuity plan in case a cyber incident prevents multiple franchisees from accessing point-of-sale or other client information systems.

Consider creating a communications plan with defined roles and responsibilities. This can help ensure that franchisees, strategic partners, and the public receive timely communications from the appropriate members of the leadership team.

It is more important than ever for franchisors and franchisees to understand and address cyber risk. Cyber insurance is one part of the solution, but it should be considered alongside data security measures, vendor controls, incident response planning, and business continuity planning across the franchise system.

Reach out to the Marsh Agency Franchise team and the Cyber Resiliency Network for guidance on cyber liability and its potential impact on your franchise system.