Policies can be taken out to include actual financial loss and stolen funds, incident response, lost business income, extortion, and even "reputational repair" -- a common factor when a company is viewed poorly for either becoming a victim of or responding badly to a data breach. 

https://www.zdnet.com/article/coalition-raises-175-million-to-boost-cyber-insurance-offerings/