Trends in Cyber-Insurance Coverage to Meet Insureds Needs

Size: px

Start display at page:

Download "Trends in Cyber-Insurance Coverage to Meet Insureds Needs"

Sherman Scott
5 years ago
Views:

1 Trends in Cyber-Insurance Coverage to Meet Insureds Needs Linda Wendell Hsu Selman Breitman LLP 33 New Montgomery Street, Sixth Floor San Francisco, CA (415) William A. Boeck Lockton Financial Services Cyber Technology Practice LOCKTON COMPANIES 444 W. 47th Street, Suite 900 Kansas City, Missouri (816) Scott Ernst Wells Fargo Insurance Services 150 East 42nd Street, 16th Floor New York, NY (917) Karrieann Couture CNA Specialty Claim Technology/Cyber/Media/MPL/Fidelity PO Box 8317 Chicago, IL (312) [direct] (866) [fax]

2 Linda Wendell Hsu is the Managing Partner of her firm s San Francisco office. She helped open the San Francisco office in 1996 when it included two attorneys and one secretary, and under Linda s leadership the office currently employs dozens of lawyers and a full legal staff. Linda has specialized in insurance coverage and insurance bad faith litigation since She handles all first and third-party insurance coverage issues involving all types of insurance policies, including personal and commercial auto, homeowners, CGL, all types of professional errors & omissions policies, and cyber-insurance issues. She has authored countless coverage opinions, has mediated hundreds of cases, and successfully litigates both declaratory relief and bad faith actions, through trial if necessary. Linda is licensed to practice law in California, Washington D.C., and Washington State. William A. Boeck is a Senior Vice President and Insurance and Claims Counsel with Lockton Financial Services. He is located in the company s head office in Kansas City. Bill is Lockton s worldwide senior legal and claims resource for cyber coverages and claims. Bill is a member of Lockton s Global Cyber Technology Practice, and leads development of Lockton s proprietary cyber policy forms. Bill is also the practice leader for the Lockton Financial Services Claims Practice. Before joining Lockton in 2006, Bill spent over 19 years handling claims for insurers and representing insurers in private legal practice in connection with complex claims under management and professional liability policies. Bill writes and speaks regularly on insurance issues, and is the author of Lockton s Cyber Risk Update blog ( Bill has earned the Certified Information Privacy Professional (CIPP/US) designation from the IAPP. One of Bill s blogs is attached to this document. Scott Ernst is a Vice President with the Greater New York Metro office of Wells Fargo Insurance Services. Scott has over 30 years of experience in the commercial insurance business and since 1999 has focused on the advancing risks of the technology service and product companies, as well as the evolving areas of network security and privacy risk management and insurance. Scott is a frequent speaker on the complex and evolving issues of technology-related exposures. Scott received his BBA degree from the University of Michigan and is licensed in multiple states. Karrieann Couture is Assistant Vice President Specialty Claims at CNA, overseeing Technology, Cyber, Media, Miscellaneous Professional Liability and Fidelity. Prior to this role, Karrieann served as AVP in other claim areas including Management Liability and Financial Institutions, as well as Professional Services, which included Lawyers and Accountants. Karrieann also had claim professional roles at CNA and other insurance companies. Karrieann began her legal career as an insurance defense attorney. Over the course of her career, Karrieann has presented at various industry events. She received her B.A. from the University of Iowa and her J.D., with honors, from Drake University, where she served as Executive Editor of the Drake Law Review.

3 Trends in Cyber-Insurance Coverage to Meet Insureds Needs Table of Contents I. Introduction...5 II. The Current State of the Cyber-Insurance Market...5 III. Claim Scenarios to Consider When Evaluating Cyber-Insurance Policies...5 IV. Drilling Down: What Is Cyber Insurance, and the Interplay of Cyber Risk and Non-Cyber Policies...5 A. What Is Cyber Insurance?...5 B. The Interplay of Cyber Risk and Non-Cyber Policies...6 V. What the Future Might Hold for an Insurance Marketplace with Rapidly Changing Underlying Risks...6 VI. What You Should Know About the WannaCry Ransomware Attack, by William A. Boeck...7 Trends in Cyber-Insurance Coverage to Meet Insureds Needs Hsu et al. 3

5 Trends in Cyber-Insurance Coverage to Meet Insureds Needs I. Introduction In today s insurance marketplace, insurers are crafting cyber-insurance policies, either stand-alone or as part of an insurance package, to address the myriad of issues facing their insureds in the data breach and cybersecurity arenas. Insurers are faced with providing their insureds with the coverage they need while at the same time managing risk and providing a product at an attractive cost. The purpose of our discussion is to provide the audience with up-to-date information on the cyber-insurance market, the types of claims insurers are facing, and what the future might hold for the cyber-insurance marketplace. II. The Current State of the Cyber-Insurance Market The seminar will address the following issues: The relevant legal and regulatory framework. A general introduction to cyber-insurance. How cyber-insurance has evolved since its inception. How cyber-insurance interplays with legacy policies, particularly CGL and professional liability policies. III. Claim Scenarios to Consider When Evaluating Cyber-Insurance Policies The presenters will encourage a lively discussion of the following types of claims typical in today s rapidly changing world of data breaches and cybersecurity: First Party Claims. The panel will discuss business interruption and extra expense claims, cyber security breaches (including malware, viruses, worms, and Trojan horses; spyware and adware; zero-day attacks, hacker attacks and denial of service attacks), data recovery expenses resulting from a cyber security breach, and cyber-extortion. Malicious Attacks. Social engineering, advance persistent threats, ransomware, and malware issues will be discussed. Employee Mobility. Employee issues are one of the most common problems and lead to a litany of claims. Human error is a large source of these types of claims. Issues driven by remote workstations, lost devices, and theft/layoff will be discussed. Vendors/Outsourcing. Cyber-risks often occur as a result of third party negligence and malfeasance. Outsourcing liability and contractual / indemnity agreements can play a large role in handling these types of claims. IV. Drilling Down: What Is Cyber Insurance, and the Interplay of Cyber Risk and Non-Cyber Policies A. What Is Cyber Insurance? This seminar will address the following topics: Trends in Cyber-Insurance Coverage to Meet Insureds Needs Hsu et al. 5

6 The risks that cyber insurance covers, such as data compromise and computer system compromise. The hybrid nature of cyber policies. Insurers offer both first party coverage for costs resulting from cyber events and liability coverage for third party claims. Basic cyber coverages will be discussed, such as coverage for privacy liability, system security liability, regulatory liability, and breach event costs. Other cyber coverages include coverage for cyber extortion, network business interruption, and digital asset loss. Ancillary coverages also offered under these types of policies include technology E&O, media liability, and miscellaneous professional liability coverage Coverage problems will also be discussed. This includes discussion of coverage issues surrounding the wrongful collection of information, assessments of The Payment Card Industry Data Security Standard (PCI-DSS), which is an information security standard for organizations that handle branded credit cards from the major card schemes, and exclusions for failure to comply with warranties for minimum required practices and / or making material misrepresentations in the insurance application. See Columbia Cas. Co. v. Cottage Health Sys., No. 2:16-cv (C.D. Cal. Filed May 31, 2016), in which the insurer alleged no coverage for a class action suit against the insured for a breach involving medical information for failing to comply with the cybersecurity practices described in its application.) B. The Interplay of Cyber Risk and Non-Cyber Policies The panel will address the following types of policies relative to cyber risks faced by insureds: Legacy commercial general liability policies can provide coverage for cyber claims. See, e.g, Travelers Indem. Co. of America v. Portal Healthcare Solutions, LLC, 644 Fed.Appx. 245 (4 th Cir. 2016). Coverage for cyber risks are also potentially covered under property policies, professional liability policies, kidnap and ransom policies, and director and officer (D&O) policies V. What the Future Might Hold for an Insurance Marketplace with Rapidly Changing Underlying Risks There is still uncertainty in the cyber insurance market, which could present opportunities for insurers. More insurers and vendors will likely enter this market. Underwriters for these insurers continue to work to set appropriate premiums for cyber insurance policies. Insurance companies may start opening cybersecurity departments. We are already seeing insurers offer pre-breach and post-breach services, such as incident response seminars put on by panel defense counsel retained by the insurers to defend their insureds. We may see insurance companies start hiring cybersecurity specialists. 6 Cybersecurity and Data Privacy September 2017

7 VI. What You Should Know About the WannaCry Ransomware Attack, by William A. Boeck Trends in Cyber-Insurance Coverage to Meet Insureds Needs Hsu et al. 7

8 8 Cybersecurity and Data Privacy September 2017

9 Trends in Cyber-Insurance Coverage to Meet Insureds Needs Hsu et al. 9

10 10 Cybersecurity and Data Privacy September 2017

Trends, Vendor Management, and Practical Tips For In House Counsel. ACC National Capital Region October 16, 2018

Cyberinsurance Issues Coming for 2019 Trends, Vendor Management, and Practical Tips For In House Counsel ACC National Capital Region October 16, 2018 Scott N. Godes Partner Insurance Recovery Co-Chair,