One thing is for certain: cyberattacks have become the norm, not the exception. Not even the NSA is capable of completely warding off security breaches. Major banking and retail institutions, as well as the government, are not surprisingly the most likely targets because of the amount of sensitive and private data they control. Still, other companies outside these sectors must heed the warnings and not become the next cyber victim. Protecting against cyber vulnerability is not merely a domestic issue. Rather, multinational companies are prime targets, and are currently undergoing institutional changes to navigate the EU General Data Protection Regulation (GDPR) that goes into effect May 2018.
Every single industry or business in this day and age has either been the victim of a cyber attack or is concerned they will be next. A few examples from the last couple of months show how widespread the problem is. In June, a global ransomeware attack quickly spread across 64 countries, impacting organizations from law firms, banks and governments to food producers and hospitals. The attackers demanded $300 in Bitcoin—approximately $977,000 U.S. dollars in total—from each victim to unlock their data. At the annual DefCon computer security conference in late July, hackers took less than 90 minutes to hack voter-ballot machines and at least one hacker even broke into the system wirelessly, suggesting that U.S. computer-ballot boxes may be susceptible to attack.
The costs and penalties associated with a cyber attack or data breach should not be underestimated. For example, NPR recently calculated the average cost of a health care breach at more than $2.2 million, “not to mention the reputation damage.” And the FCC recently ordered AT&T to pay $25 million in connection with the exposure of more than 250,000 U.S. customers’ information.
Cyber insurance continues to be one of the hottest topics in the insurance industry. In the last several years it has evolved from a little-known specialty product to a standard purchase for some corporate risk departments. By now, most companies generally are aware that cyber attacks present substantial risks. Many unfortunately have first-hand experience as victims of an attack. But many companies still do not necessarily view cyber insurance as a “must-have” type of insurance, like general liability or property insurance. Some companies may believe their potential cyber exposure is minimal or simply think that cyber coverage is cost prohibitive. A recent D.C. Circuit decision is a sobering reminder that cyber insurance should at least be considered in connection with a company’s risk management plan, and is probably a “must-have” for companies that maintain records containing a substantial amount of personal information.
In the client alert The “Panama Papers” and the Secret World of Shell Corporations, Insurance attorneys Joseph Jean, Alexander Hardiman and Matthew Putorti along with their colleagues Carolina Fornos, Mark Hellerer, Maria Galeno, William Sullivan, Nancy Fischer, Nora Burke and Danielle Vrabie discuss a leak of 11.5 million documents from a law firm in Panama that may implicate politicians, criminals and celebrities in sheltering of fortunes in offshore tax havens through the use of shell companies. In light of these events, financial institutions and other entities may need to consider whether they are implicated, how to assess the risks, how to minimize exposure, if any, and whether insurance coverage is available.
As more and more companies ranging across a wide spectrum of industries have been exposed to network and data security breaches, the market for insurance products to cover cyber risks has grown just as fast. With policies sold under names like “cyberinsurance,” “privacy breach insurance,” “media liability insurance” and “network security insurance,” the market is chaotic. Premiums and terms vary dramatically from one insurer to the next. And because cyber policies are far from uniform, it’s crucial to understand not only what you’re being offered, but also how to negotiate coverage for the risks inherent in your business. This post contains five of my top ten recommendations. (The remaining five tips are in Part 2.) Continue reading →