INSIGHTS
BridgePay, payments down for days: the dependency small businesses cannot see
On 6 February 2026 ransomware stopped the US payment platform BridgePay for at least four days: merchants forced to go cash-only, municipalities and water utilities unable to collect online. The analysis: the hidden supplier, waiting periods and deductibles, aggregation on payments and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, February 2026 · by cybercoverinsurance
On 6 February 2026, at around 3:30 a.m. Eastern time, the US payment platform BridgePay stopped working. In the evening the company confirmed a ransomware attack. Gateway, virtual terminals, payment pages and partner portals stayed down for days. Some merchants accepted only cash, and cities and water utilities could not collect bills online.
For cyber underwriters the case is an example of dependent business interruption for small businesses: merchants across the country who may not have known they depended on BridgePay, because the platform worked behind the point-of-sale or billing software they used. It is also an example of aggregation on payments.
What is known
The attack. On 6 February BridgePay reported degraded systems at 3:29, identified a cyber incident at 6:34 and confirmed ransomware in the evening. The FBI, the Secret Service and outside specialists were involved. The group responsible was not named (Cyber Security News).
The services down. The payment gateway API, the cloud service for terminals, the virtual terminal with reporting, hosted payment pages and partner portals were all out of service. According to initial forensic findings, card data was not compromised and files were only encrypted, with no evidence of usable data exposure (BleepingComputer).
The effects. Some merchants could accept only cash, including a restaurant cited by the press. The city of Palm Bay, Florida, asked residents to pay in person. Frisco, Texas, and the platforms Lightspeed Commerce and ThriftTrac also reported problems (BleepingComputer). On 9 February all services were still down and BridgePay gave no restoration date (Payment Expert).
Water utilities. On 12 February WaterISAC reported that several municipal water utilities, mostly in Texas but also in Kansas, Michigan, Wisconsin and Florida, could not collect bills. Wichita restored online payments thanks to a workaround by its vendor that bypassed BridgePay, while the platform was still down (WaterISAC).
What is not known. The number of merchants hit, the date of full restoration, the way in, the group responsible and whether a ransom was paid have not been made public.
The dependency nobody knows about
The hidden supplier. BridgePay's technology often works behind third-party software platforms (Payment Expert). A restaurant chooses point-of-sale software, not a payment gateway. When the gateway stops, the merchant discovers a dependency it had never declared.
The questionnaire does not see it. Questions on critical suppliers collect the names the insured knows: the cloud, the business software, the point-of-sale software. The supplier's supplier stays out. For a dependent business interruption cover limited to named suppliers, BridgePay would not have been among them.
Cash as a continuity plan. For a small merchant, accepting only cash means losing a large share of takings. The loss is lost revenue spread over many small businesses, each often close to or below the deductible.
Waiting period and duration
Days, not hours. The outage lasted at least four days (Payment Expert). With waiting periods usually measured in hours, many merchants would have passed the time threshold. Their problem is the amount: a few days of lost card takings can be lower than the deductible.
The workaround reduces the loss. Wichita restored payments thanks to a vendor that bypassed BridgePay (WaterISAC). Insureds with a second payment channel, or a vendor able to switch quickly, limit the length of the claim.
Public bodies collect less, but do not lose. For cities and water utilities the loss is mainly delayed collections and manual handling costs. The insurable loss is smaller, but the pressure on services to residents is high.
Aggregation on payments
One event, many small insureds. A platform outage hit merchants in various sectors, municipalities and water utilities in several states. For a small business portfolio, payments are an aggregation point like the cloud.
The chain is long. Merchant, point-of-sale software, gateway, processor, card network. Each link can stop. Aggregation does not depend on the supplier name the insured knows, but on the one further down the chain.
The payment provider as insured. For those insuring BridgePay or similar platforms, the biggest risk is liability towards partners and merchants for lost takings. Contracts usually limit this liability, but the number of counterparties is very high.
What to bring to renewals
Impact for insurersMedium
Ransomware stopped a US payment platform for at least four days, forcing merchants to work cash-only and preventing municipalities and water utilities from collecting payments online.
On the portfolio side, the BridgePay case suggests mapping the payment chain of insured small businesses, at least for the main gateways and processors in each market. A one-week outage scenario at a widespread gateway, with small losses across thousands of insureds, is a useful test for aggregation and for deductibles on dependent business interruption covers.