CYBERINSURANCE TRENDS AND DEVELOPMENTS

Size: px

Start display at page:

Download "CYBERINSURANCE TRENDS AND DEVELOPMENTS"

Aubrey Bell
5 years ago
Views:

2 CYBERINSURANCE TRENDS AND DEVELOPMENTS What cyber risks can be covered Emerging products Recent cases, pending legislation and regulation Claims case studies

3 INTRODUCTION TO CYBERINSURANCE Gartner defines cyber insurance as coverage protecting against losses related to cyberrisks, such as data theft/loss, business interruption caused by a computer malfunction or virus and fines or lost income because of system downtime, network intrusion and/or information security breaches.

THE CYBERINSURANCE MARKET Betterley Estimates 2016 Premiums at $3.2 Billion* PWC Estimates The Market To Be $7.5 Billion By 2020** * The Betterley Report: June 2016 https://www.irmi.

4 THE CYBERINSURANCE MARKET Betterley Estimates 2016 Premiums at $3.2 Billion* PWC Estimates The Market To Be $7.5 Billion By 2020** * The Betterley Report: June ** Insurance 2020 & Beyond: Reaping the Dividends of Cyber Resilience

5 CYBERINSURANCE IS NOT General Liability Business Owner Policy Professional Liability Directors and Officers Crime * (Although there are cybercrime policies)

6 General Liability Data not covered WHY? Specific exclusions since ISO made mandatory Litigation- breach cases

7 WHY? Professional Liability/Errors & Omissions No litigation as yet, but see Affinity Gaming v Trustwave PL covers negligence. Cyber losses not necessarily due to negligence Exclusions

8 WHY? Directors and Officers No litigation, but derivative actions for failure to secure Errors and omissions Exclusions Crime Maybe, but read the policy

9 WHY? Business Owner Policy ISO mandatory exclusion 2015 ISO introduced information security endorsement

10 Data Breach TYPES OF COVERAGES Computer Attack & Network Security liability Media Liability Identity Theft

11 NEW AND DEVELOPING COVERAGES Personal Lines Connected Home Data Breach Cyber Attack Cyber Bullying Digital Assets

12 Commercial IoT NEW AND DEVELOPING Automated Cars & Trucks Alternative Distribution Channels (Commercial Product Delivered by Bank) Electronic Funds Transfer (Fraud by Hacker/Social Engineer)

13 WHAT S COVERED? 1 st Party -- your own, direct losses 3 rd Party liability to third parties

14 1 ST PARTY COSTS Forensic IT Services Crisis Management Legal Advice Public Relations Call Center Cost of Notifying Affected Individuals

15 1 ST PARTY COSTS PCI Fines and Penalties Business Interruption Data Reconstruction Damage to Hardware/Software/Apps Credit Monitoring Services for Affected Individuals

16 3 RD PARTY COSTS Defense of Litigation Regulatory Defense Costs and Fines Damage Awards/Settlement to Affected Individuals

17 Q&A What are you seeing that isn t covered? How can the insurance industry help you to finance risks you re not seeing covered today?

18 LEGISLATIVE TRENDS

19 47 State Laws DATA BREACH Scattered federal laws

20 DATA BREACH Tennessee- elimination of encryption safe harbor- will it matter? Illinois- joining other states in including health information as pii Vermont- health information pii + established private c/a for breach of phi

21 Nebraska- DATA BREACH Joining other states in requiring Attorney General notification Online account credentials require notice- 5 th state to do so No encryption safe harbor if key also compromised

22 PENDING Federal data breach bills Won t pass prior to election Preemption of state laws a big issue Whether security standards will be mandated (NIST, SANS)

23 BREACH LEGISLATION TAKE-AWAY Uncertainty in breach statutes impacts insurers Increasing regulation at state level Inconsistent over the different jurisdictions Increases cost of claims

24 AUTONOMOUS VEHICLES Congress and several states passed bills to set up study committees and/or allow for autonomous vehicle operation

25 AUTONOMOUS VEHICLES TAKE-AWAYS May not affect the claimant, but fingerpointing in autonomous vehicle accidents may increase litigation and associated costs Is it the driver s fault or the OEM? Decline in accidents may lower cost of insurance

26 LITIGATION

27 DATA BREACH LITIGATION About 5% of data breaches result in 3 rd party litigation 76% decline from 2014 to 2015 in credit card related breach suits 26% overall decline Source: Bryan Cave, 2016 Data Breach Litigation Report

28 DATA BREACH LITIGATION No reported class action verdicts Likelihood of a defense verdict = 98% SOURCE: Empirical Analysis of Data Breach Litigation (11 Journal of Empirical Legal Studies 74 (2014), Sasha Romanosky, David A. Hoffman, and Alessandro Acquisti, )

29 DATA BREACH LITIGATION SOURCE: Empirical Analysis of Data Breach Litigation (11 Journal of Empirical Legal Studies 74 (2014), Sasha Romanosky, David A. Hoffman, and Alessandro Acquisti, )

30 CLAIMS EXPERIENCE Fewer than 1% of breach claims involved 3rd party claims When there were 3rd party claims, 2/3 were made by individuals, 1/3 were class actions

31 HURDLES TO PLAINTIFFS IN BREACH SUITS Hurdles for Data Breach Plaintiffs Standing- Must show concrete injury (although injury may be intangible) Failure to state a claim upon which relief can be granted- injury alleged insufficient- must be compensable Establishing causation Economic loss doctrine- negligence Class certification- Proposed class must have common injuries that can be calculated

32 SPOKEO V ROBINS Article III Standing Nothing new, just restated and remanded Actual/imminent harm Injury in fact Traceable to the challenged conduct Likely to be redressed by court

33 SPOKEO TAKE-AWAYS Potential application to data compromise Mixed bag of application Didn t clarify anything except that the full analysis must be completed

34 P.F. CHANG'S CHINA BISTRO, INC. V. FED. INS. CO. Payment card processor passed $2 M in chargebacks, assessments and fees to PF Chang s following breach (MasterCard charged BAMS) Dismissed at summary judgment

35 P.F. CHANG S POLICY EXCLUSIONS Data compromise policy Covers Privacy Injury - injury is not Privacy Injury Excludes any loss or expense assumed by any insured under any contract or agreement.

36 P.F. CHANG S TAKE-AWAY So, this is why we talked about types of coverage. If you re looking for PCI assessments & fees to be covered, make sure it s in the policy

37 TRAVELERS V PORTAL The Travelers Ind. Co. of Am. V Portal Healthcare Solutions, L.L.C., 4 th Cir Publication arguably alleged because information could be found via Google Court held duty to defend (although not necessarily duty to pay)

38 TRAVELERS Publication where some other cases had not found it before (Recall Total Info. Mgmt., Inc., et al. v Federal Insurance Co., et al.,; Zurich Am. Ins Co. v Sony Corp. of Am.) General liability, not data compromise policy

39 TRAVELERS TAKE-AWAYS The ISO issued exclusions to CGL policies beginning in 2013 (after this breach). The typical CGL policy does not cover breach/publication Whether or not the court finds publication is intensely fact specific and not necessarily predictable

40 AND The Travelers decision was unpublished, so it doesn t have precedential value

41 QUESTIONS? Thank you! 2016 The Hartford Steam Boiler Inspection and Insurance Company. All rights reserved. This presentation is for informational purposes only. HSB makes no warranties or representations as to the accuracy or completeness of the content of this presentation. Under no circumstances shall HSB or any party involved in creating or delivering this presentation be liable to you for any loss or damage that results from the use of the information or images contained in this presentation.

42 HOW DID THINGS GO? (WE REALLY WANT TO KNOW!) Did you enjoy this session? Is there anyway we could make it better? Let us know by filling out a speaker evaluation. Start by opening the IAPP Events App. Select this session and tap Click the following link for speaker evaluations. Once you ve answered all three questions, tap Done and you re all set. Thank you!

Cyber-Insurance: Fraud, Waste or Abuse?

SESSION ID: STR-F03 Cyber-Insurance: Fraud, Waste or Abuse? David Nathans Director of Security SOCSoter, Inc. @Zourick Cyber Insurance overview One Size Does Not Fit All 2 Our Research Reviewed many major