(833) 650-6844
Ask a pool service owner whether their business faces a cyber risk and most will say no. They are not a bank or a hospital. They clean pools, build pools, and fix equipment.
Then walk through what is actually stored on the office computer and in the route management app. Customer names, addresses, and phone numbers. Gate codes and alarm information. Credit card numbers on file for recurring billing. Bank details for direct deposit. Employee Social Security numbers and driver’s license copies. Notes about which customers travel and when their house sits empty.
That is a target. Not because a pool company is famous, but because it holds valuable information and, unlike a bank, usually has no dedicated IT staff protecting it.
Attackers are not selecting victims by size or prestige. They scan for weak points, and small service businesses check almost every box: shared passwords, no multi-factor authentication, an owner who handles everything including email, employees using personal phones and laptops, and cloud software that was set up once and never reviewed.
The attacks that land hardest on businesses like yours are ordinary ones.
Ransomware locks your scheduling, routing, billing, and customer records. Every truck still runs, but nobody knows where to go or what to charge, and your billing stops until you recover.
Business email compromise is the quiet one. Someone gains access to your email, watches for a while, then sends a message that looks exactly like you. It might redirect a customer’s payment to a new account, or instruct your bookkeeper to make a wire transfer. Losses here can be substantial and are often uninsured under standard property policies.
Payment fraud and card data exposure follow from storing card information for recurring route billing, whether directly or through a vendor.
Phishing targeting employees remains the most common entry point, and it does not require anyone to be careless so much as busy.
Even a modest breach creates obligations. Every state has a data breach notification law, and if customer personal information is exposed you generally must notify the affected individuals, sometimes within a defined timeframe, and in some cases notify the state attorney general. California has some of the most demanding requirements in the country, and a business does not have to be large to be subject to them.
The costs that follow are real and immediate: forensic investigation to determine what was accessed, legal review of your notification obligations, the notifications themselves, credit monitoring for affected customers, and potential regulatory exposure. For a business running on route revenue, those costs arrive long before any insurance conversation is resolved.
There is also the exposure most pool companies never think about: you hold physical access information. Gate codes, alarm details, and knowledge of when homes are unoccupied. A breach of that data is a different kind of harm to your customers, and a different kind of reputational problem for you.
This is the practical issue. A standard general liability policy covers bodily injury and property damage. Data is generally not treated as tangible property, and most GL forms carry explicit exclusions for electronic data and for the access to or disclosure of confidential information. A commercial property policy covers physical damage to your equipment, not the loss of the information on it, and not the income you lose while systems are down from a cyber event rather than a fire.
Some businesses have a small amount of data coverage bundled into a package policy. It is usually far below what a real incident costs.
Cyber liability coverage is what responds to this exposure. Depending on the policy it can cover breach response costs including forensics and notification, first-party recovery costs and lost income from a system shutdown, ransomware and extortion, funds transfer fraud and social engineering losses, and third-party liability if customers or partners bring claims.
Two coverage notes worth raising with your broker. Social engineering and funds transfer fraud are frequently sublimited or offered only by endorsement, even though they are among the most common losses for small businesses. And crime coverage and cyber coverage handle different parts of the problem, so which policy responds to a fraudulent transfer depends on how the loss occurred and how both policies are written.
Turn on multi-factor authentication everywhere, starting with email, your route management software, and your bank. This single step blocks the majority of account takeovers.
Stop sharing logins. Individual accounts for every employee, removed the day someone leaves.
Verify payment changes by phone. Any request to change bank details, from a vendor, employee, or anyone claiming to be you, gets confirmed by calling a known number rather than replying to the email.
Back up your data, keep a copy offline or otherwise separate, and confirm the backup actually restores. An untested backup is a guess.
Limit what you store. If you do not need to keep a card number or a copy of a driver’s license, do not.
Train the crew on phishing. Fifteen minutes and a few real examples goes a long way.
Keep software and devices updated, including the phones your techs use in the field.
Your customer list, your billing system, and your schedule are the operating core of the business, and they now live on a screen. If you want help understanding whether your current policies would respond to a breach or a fraudulent transfer, the California Pool Association is here to help members sort it out. Reach out anytime.