The Wild West Meets the Future: Key Tips for Maximizing Your Cyber and Privacy Insurance Coverage

Size: px

Start display at page:

Download "The Wild West Meets the Future: Key Tips for Maximizing Your Cyber and Privacy Insurance Coverage"

Catherine Cooper
5 years ago
Views:

1 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber and Privacy Insurance Coverage James P. Bobotek (202) Pillsbury Winthrop Shaw Pittman LLP

DOCUMENT TITLE OR CLIENT NAME SUB HEADLINE / DATE / LOCATION / ETC A GROWING THREAT ENVIRONMENT Companies Continue to be Exposed to Cyber Risks TJX Companies was hacked, exposing credit cards

Sony suffered a breach in its video game online network exposing names, addresses and possibly credit card data belonging to 77 million user accounts in what is one of the largest-ever

A flaw in Pinterest site s API exposed users email addresses 70 million records were affected.

Ebay was subject to 145 million User Data Records breached JP Morgan Chase was subject to 76 million Data Records breached and Staples reported over 1 million payment cards were stolen.

July 2008 January 2012 March 2013 October 2013 January 2014 April 2014 September 2014 December 2014 January 2007 September 2011 September 2012 March 2013 December 2013 May 2014 October 2014

Over 24 million customers were impacted in massive security breach. Zappos CEO issues letter and urges all customers to change their passwords.

2 DOCUMENT TITLE OR CLIENT NAME SUB HEADLINE / DATE / LOCATION / ETC A GROWING THREAT ENVIRONMENT Companies Continue to be Exposed to Cyber Risks TJX Companies was hacked, exposing credit cards and transaction details for 94 million records. Sony suffered a breach in its video game online network exposing names, addresses and possibly credit card data belonging to 77 million user accounts in what is one of the largest-ever Internet security break-ins. Wells Fargo, Bank of America, Citi Group and JP Morgan Chase were affected in a series of cyber security attacks that affected millions of customers. A flaw in Pinterest site s API exposed users addresses 70 million records were affected. Target reported a major data breach and warned that up to 110 million records, including debit / credit card info were compromised. Ebay was subject to 145 million User Data Records breached JP Morgan Chase was subject to 76 million Data Records breached and Staples reported over 1 million payment cards were stolen. Criminals access the personal details and Social Security numbers of more than 70 million people the biggest health-care data theft to date. July 2008 January 2012 March 2013 October 2013 January 2014 April 2014 September 2014 December 2014 January 2007 September 2011 September 2012 March 2013 December 2013 May 2014 October 2014 February 2015 Facebook experienced a glitch during testing of a new design that exposed 80 million records of users birth dates. Over 24 million customers were impacted in massive security breach. Zappos CEO issues letter and urges all customers to change their passwords. Evernote is hacked and requests 50 million users to change their passwords. Adobe announces that a hack of company systems exposed customer names, IDs, encrypted passwords, and debit/credit card info impacting 152 million records. 1.1 million payment cards exposed A data breach targeting Michaels a national chain of arts and crafts stores impacted more than 3 million customers. Multiple breaches impacting millions of payment cards and store locations, 56 million Payment cards and over 1,500 locations breached among this group of companies. Sony reported over 47,000 employee records, personal s and documents were breached. February 2015 Marsh FINPRO Cyber/Privacy Practice 2

3 Cyber Breaches The Root Causes for US Events* Human Error 31% Malicious Attack 44% System Glitch 25% * Ponemon Institute, 2014 Cost of Data Breach Study: Global Analysis (May 2014) 3 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

4 Are Cyber Events Preventable? 4 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

5 Cyber Breaches The Current Climate 42.8 Million $2.7 Million Number of reported data breach incidents in 2014 Average financial loss as a result of data breach incidents in 2014 Represents a 48% increase from 2013 Represents a 34% increase from 2013 * Pricewaterhouse Coopers, The Global State of Information Security Survey 2015 (Sept. 30, 2014) 5 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

6 Average Costs of a Data Breach 6 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

7 What is Cyber and Privacy Insurance? These policies are variously referred to as technology, e-business, media, cyber, network security, or internet liability policies. They can provide coverage for losses to you, such as when your website or online store is shut down by hackers. Because cyber liability is an evolving area of insurance, policy wordings, definitions, coverages, and exclusions vary significantly among insurers. 7 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

8 Cyber Liability Such policies may provide coverage for damages you cause to others when you or another person or entity for whom you are responsible: Accidentally release(s) private information (personal, medical, financial) over the internet, resulting in embarrassment or identity theft; Send(s) spam or viruses to others due to programming errors or failure to use appropriate filters, update patches, etc.; Allow(s) hackers to access credit card information; Permit(s) confidential information to be taken from the business premises on laptops, thumb drives, or other storage devices; Enable(s) hackers to steal information at Wi-Fi sites due to poor security; Infringe(s) on another s intellectual property or copyrighted materials. 8 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

9 What Does Cyber Insurance Cover? Third-Party (Liability) Coverage Information Security and Privacy Liability Covers the pure liability component of the loss including the cost of defending the claims. Regulatory Defense and Penalties Covers the cost of dealing with regulators and paying applicable fines/penalties. Website Media Liability Covers insured s liability for material published on its website. 9 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

10 What Does Cyber Insurance Cover? Post-Breach Response Coverage Privacy Notification and Crisis Management Expenses (the loss containment component of cyber and privacy coverage). Hiring a forensic expert; Engaging a PR agency; Notifying customers whose personally identifiable information ( PII ) has been compromised; Monitoring customers credit (usually for one year); Notifying banks and credit card companies. 10 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

11 What Does Cyber Insurance Cover? First Party/Time-Element Coverage Business Interruption Covers loss of income incurred during the period of recovery resulting from an electronic disruption. Extra Expense Covers additional costs (above normal operating expenses) required to expedite recovery after a disruption, such as: overtime labor, express parts shipping, hiring special experts. Typically subject to a time, not a monetary, deductible. 11 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

12 What Does Cyber Insurance Cover? First-Party/Theft of Property Coverages Data Assets - covers cost of restoring and recovering the data lost from the failure of an insured s computer system (usually defined as a theft of data or introduction of a virus ). Coverage typically does not apply when data asset loss is caused by intentional employee acts (it is not fidelity coverage ); No coverage for upgrading software or other programs during the postbreach restoration process; No coverage for the cost of research to recover lost data (only provides coverage for electronic recovery methods); In most cases, insurer must preapprove costs or all expenditures. 12 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

13 What Does Cyber Insurance Cover? First-Party/Theft of Property Coverages Cyberextortion covers: Monies paid to meet extortion demands; Monies paid to computer security experts to advise insured on how to prevent future extortion attempts; and Costs of expert assistance to deal/negotiate with cyber-extortionists (perhaps even more important than above). Ransomware is the latest extortion technique: Insured goes to the home page of the company s website and finds it replaced with a ransom demand that must be paid to restore the home page! 13 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

14 What Does Cyber Insurance Cover? First-Party/Theft of Property Coverages Computer Fraud (less standard typically obtained by financial institutions) Covers loss from fraudulent, unauthorized entry into a computer system resulting in a theft of money or data. Funds Transfer Fraud (less standard typically obtained by financial institutions) Covers loss when funds are fraudulently transferred from one financial institution to another. Difference? Funds transfer fraud = transfer of funds BETWEEN institutions; no funds transfer involved in computer fraud coverage. 14 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

15 Areas of Potential Friction Adequacy of limits, size of retentions Retroactive coverage Consent and panel provisions Coverage for your vendors errors and omissions & your services to others Loss vs. theft of data 15 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

16 More Areas of Potential Friction One size fits all crisis management expense coverage Traps for the unwary Interplay with your indemnity agreements subrogation issues Other insurance provisions Inadequacy of defense coverage 16 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

17 What If You Don t Have Cyber Insurance? Do Not Despair! Insurance industry (and some brokers) contends that there is no coverage under conventional insurance, but many courts disagree. Tender your claim to all of your other insurers! 17 The Wild West Meets the Future: Key Tips for Maximizing Your Cyber Insurance Coverage

Cyber & Privacy Liability and Technology E&0

Cyber & Privacy Liability and Technology E&0 Risks and Coverage Geoff Kinsella Partner http://map.norsecorp.com http://www.youtube.com/watch?v=f7pyhn9ic9i Presentation Overview 1. The Cyber Evolution 2.