Cyberattacks are an increasingly frequent and costly risk faced by almost every business today. While the availability and scope of cyber-specific insurance has developed exponentially over the past few years, it is important to remember that more traditional policies (such as general liability and first-party property insurance) can still be a source for coverage in connection with cyber incidents, as a recent court decision demonstrates.
Recent headlines have raised significant concerns about the possibility of cyberattacks on U.S. businesses as a result of the heightened tensions with Iran. The Department of Homeland Security, through its Cybersecurity and Infrastructure Security Agency (CISA), has published alerts and guidance recommending heightened awareness and vigilance. In “International Pressure Raises Cybersecurity Threats,” Tamara D. Bruno, Brian E. Finch and Cassie Lentchner explore some of the practical steps companies can take toward cybersecurity precautions, compliance and insurance when heightened tension in the Middle East or other events increase the threat of cybersecurity incidents.
In late August, the Federal Energy Regulatory Commission (FERC) and North American Electric Reliability Corporation (NERC) issued a joint white paper proposing a “name-and-shame” approach to electric utilities that failing to meet NERC Critical Infrastructure Protection (CIP) Reliability Standards. The standards represent a baseline for protecting against cyber-attacks on critical infrastructures. FERC and NERC propose to depart from the historical practice of withholding most material details regarding CIP Reliability Standard violations, and instead to start disclosing the names of allegedly violating electric utilities in response to Freedom of Information Act requests—“naming and shaming them.” This development underscores the substantial cyber risks utilities face and, likewise, the importance of appropriate insurance for those risks.
Colleagues Matthew G. Jeweler, Cassie Lentchner and Brendan Hogan (along with Richard Mroz , managing director of Resolute Strategies LLC) examine the proposal more closely in “Name-and-Shame Proposal of Electric Regulators Highlights Need for Cyber Insurance.” They also outline a few key points electric utilities should keep in mind with respect to securing the right kinds of insurance coverage for cyber-related incidents.
Packed stadiums? Check.
Players and teams with huge followings? Check.
Massive social media appeal? Check.
But here, the events that spectators are so eager to attend aren’t live basketball or football games. Instead, fans are lining up to watch others competitively play video games, more commonly known as esports. In 2018, esports garnered 258 million unique viewers globally, compared to 204 million for the National Football League’s 2016 regular season. In 2019, esports are predicted to draw 299 million viewers and hit $2 billion in revenue, up from $1.5 billion in 2018. The International Olympic Committee is even considering adding esports to the 2024 Olympic Games.
A data breach may cost a company millions in recovery and liability damages, but rarely does a breach force a company into bankruptcy. However, a months-long data breach at American Medical Collection Agency (AMCA) in 2018-2019 did just that, forcing its parent company, Retrieval-Master Creditors Bureau Inc., into Chapter 11 bankruptcy. AMCA has not stated whether it had cyber insurance, but the situation presented by this breach and bankruptcy filing serves as a cautionary tale for those without adequate cyber insurance coverage—or any at all.
Recently, the Board of Governors of the Federal Reserve System has indicated it may move forward with enhanced cybersecurity standards for large financial institutions and the third-party vendors that serve them. Over on Pillsbury’s SourcingSpeak blog, colleagues Andrew L. Caplan, Meighan E. O’Reardon and Curtis A. Simpson examine just what those standards might be in “The Fed May Increase Cybersecurity Standards for Large Financial Institutions and their Service Providers.”
Experts are full of advice about the importance of designing and implementing a robust cyber breach response plan. They opine frequently on its key components, such as identifying the roles and responsibilities of the response team, steps for investigating and containing the breach, internal and external communications regarding the breach and the response, and applicable legal requirements. For the most part, however, their advice focuses on the information-technology aspects of the plan, with some attention given to the roles of senior management and the legal department. But few commentators offer tips on one of the most consequential components of a cyber response plan: insurance.
Have $57 million (or more) to spare? You’re going to need it if you run afoul of the EU’s General Data Protection Regulation (GDPR) without cyber insurance.
In late January 2019, the French data protection authority, CNIL, imposed a fine of €50 million—or roughly $57 million—on Google for violations of the GDPR. The fine is the largest imposed to date under the GDPR, since it came into effect in May 2018. The Google fine highlights a couple of things: the GDPR has teeth, and regulators in the EU won’t hesitate to enforce the regulation. Possibly more frightening to companies subject to the GDPR is that the fine was not imposed because of any data breach or disclosure of sensitive information but, rather, on account of Google’s ordinary data privacy practices.
Even when you’ve done your utmost to secure your organization’s cybersecurity—you’ve followed the advice of all the experts, you’ve checked all the boxes—you still may have an Achilles’ heel. Your cybersecurity is only as strong as its weakest point, which is often a vendor or supplier. In this context, a vendor could be anything from a cloud service provider, data processor, or IT engineer to an HR consultant, accounting firm, or health care benefits manager, while a supplier could be a key provider of manufacturing components or raw materials.
On insurance coverage issues, sometimes the boat seems to be listing in the wrong direction. For example, insurers have long tilted the decks to avoid coverage for “spoofing” attacks and similar kinds of email fraud by throwing their weight behind arguments that such transactions do not involve a “direct loss” from the use of company computers to implement a fraudulent scheme, which they claim their policies require. But in the first half of July, not one, but two federal appellate decisions—Medidata Solutions Inc. v. Federal Insurance Co. and American Tooling Center, Inc. v. Travelers Casualty & Surety Co.—rocked the insurers’ boats.