Savannah Cyberattack: Workers’ Comp Myths in 2026

There’s a lot of bad info floating around about workers’ comp, and it gets even worse when something new happens, like a cyberattack on Savannah delivery drivers. When you’re dealing with the fallout of a digital attack, you need facts, not guesses.

Myth 1: Cyberattacks are not “workplace accidents” in the traditional sense, so workers’ comp doesn’t apply.

This is a common misconception, and it’s just flat-out wrong. The Georgia Workers’ Compensation Act, specifically O.C.G.A. Section 34-9-1(4), defines an “injury” as an injury by accident “arising out of and in the course of the employment.” Though people usually think “accidents” mean physical things like a slip or a fall, the law is much wider than that. A cyberattack can definitely lead to a real, compensable injury if it harms an employee while they’re doing their job. Imagine a delivery driver whose company-controlled navigation system gets compromised, sending them into a dangerous area where they get assaulted. Or what if the hack messes with the vehicle’s operational systems and causes a collision? Those are direct physical injuries that stem from a digital incident tied to their work. The whole case hinges on proving the causal link between the cyberattack and the injury. If the attack disrupts company operations so badly that an employee is physically or psychologically harmed while on the job, that injury “arises out of” the employment. For a delivery driver, the “in the course of” part is simple: they’re on the clock and driving their route. For example, if a company’s dispatch system in Savannah, maybe run from a data center near the Port of Savannah, gets hit by ransomware and this chaos directly causes a driver to have a heart attack behind the wheel, that could be a valid claim. The type of threat, whether it’s digital or physical, matters less than the fact that the injury is connected to the job.

Myth 2: If a third-party hacker caused the cyberattack, the employer isn’t liable for workers’ comp.

This myth wrongly shifts responsibility. Georgia’s workers’ comp is a no-fault system, which means that fault for the incident itself generally doesn’t determine who gets benefits. The employer’s liability for workers’ comp isn’t based on whether they were negligent or if some third party caused the injury. If the injury happened at work, the employer’s insurance is typically responsible. It’s just like if a delivery driver gets injured because another car runs a red light. The employer’s workers’ comp still covers their driver, even though a third party was at fault. The same logic applies to a cyberattack. An employer has to provide a reasonably safe work environment, and in 2026, that absolutely includes protecting the digital infrastructure that affects employee safety. The Georgia State Board of Workers’ Compensation (SBWC) is clear that employers must ensure a safe workplace, and that now includes digital safety for jobs that depend on technology. In fact, a U.S. Department of Labor (DOL) report on cybersecurity in the workplace confirms the changing face of job hazards, specifically calling out digital threats as a growing safety concern for workers in logistics and delivery services.

Myth 3: Psychological injuries from a cyberattack are not covered by workers’ comp.

This one’s tricky, but psychological injuries can be covered under Georgia workers’ compensation if they clear some high hurdles. To be compensable, a psychological injury generally must come from a physical injury or a catastrophic event, as outlined in O.C.G.A. Section 34-9-200.1. So, if a delivery driver suffers a physical injury in a car accident caused by a system malfunction from a hack, and then develops PTSD from the crash, the psychological injury could be covered because it’s tied to the physical one. People also often overlook the “catastrophic injury” designation. A cyberattack itself might not qualify, but the events it triggers could. For example, what if a hack on a delivery company’s fleet management system causes a widespread, chaotic breakdown leading to multiple serious accidents across Savannah’s road network? An event that massive could be considered catastrophic, opening the door for psychological injury claims even for drivers who weren’t physically hurt but were severely traumatized by the event. You have to be able to draw a straight line from the cyber incident, to a physical injury or a truly catastrophic work event, and then to the resulting psychological trauma. Frankly, insurance adjusters will fight you tooth and nail on these claims, so you’ll need precise medical documentation and legal help.

Myth 4: You have unlimited time to report a workers’ comp claim after a cyberattack incident.

Dead wrong. The clock is ticking from day one, and this is an area where a lot of claims die. O.C.G.A. Section 34-9-80 requires an employee to give notice of an injury to their employer within 30 days of the accident. And yes, the “accident” is the event that hurt you, even if it was a cyberattack. For a delivery driver in Savannah, if their injury happens on a specific date because of a hack, that 30-day clock starts ticking immediately. Beyond that, there’s a statute of limitations for filing a formal claim (a Form WC-14) with the Georgia State Board of Workers’ Compensation (SBWC). You generally have one year from the date of the accident to file that form. If you don’t, you could lose your right to benefits for good. People make critical mistakes here all the time. They assume that because the company knows about the big cyberattack, they automatically know about *their* specific injury. That’s a dangerous assumption. Document everything, and report it promptly and formally. Even if you don’t know how bad your injuries are yet, report the incident that caused them.

Myth 5: Small delivery companies in Savannah are exempt from workers’ comp if they’re hit by a cyberattack.

This is another misunderstanding. In Georgia, any employer with three or more regular employees has to carry workers’ compensation insurance. That’s the rule. It applies to everyone, whether it’s a huge logistics firm operating out of the Savannah Economic Development Authority (SEDA) area or a smaller, local delivery service with routes near the Savannah College of Art and Design (SCAD) campus. If they meet that three-employee threshold, they must have coverage. The kind of incident, be it a cyberattack or a traditional accident, doesn’t change this requirement. If a small company’s systems are hacked and an employee gets hurt, their workers’ comp insurance is the one that has to cover it. The company’s size or the cleverness of the attack doesn’t let them off the hook from their legal duty to their employees under the Georgia Workers’ Compensation Act. It’s about the number of employees, not company revenue or how good their firewall is.

Myth 6: Only physical injuries from a cyberattack are covered, not damage to personal property or lost wages due to system downtime.

Workers’ compensation in Georgia is designed to cover two main things: medical expenses and lost wages that result from an occupational injury. It does not cover damage to your personal property, even if it was damaged during a work incident caused by a cyberattack. So, if a delivery driver’s personal phone gets fried because it was connected to a hacked company system, that’s not a workers’ comp problem. This distinction also matters for lost wages. While workers’ comp does cover lost wages *due to an injury* (like through temporary total disability benefits), it won’t cover wages you lost just because the company’s systems were down and you couldn’t work. If the cyberattack forces the company to shut down for a week and you simply can’t do your job, you can’t get workers’ comp for that lost pay unless you also sustained a compensable injury during the incident. The whole point of workers’ comp is to replace a part of your wages lost because an *injury* makes you unable to work, not because of a general business interruption. For property damage or wages lost from downtime without an injury, you’d have to look at other things like property insurance, but not workers’ comp. Filing a workers’ comp claim after a cyberattack on a Savannah delivery company means you have to know Georgia law, not just what you think you know. You need to report the injury fast, document everything, and understand how a digital problem can cause a real-world injury that’s covered by the law.