A cyber insurance policy, also referred to as ‚Äö√Ñ√∫cyber risk insurance‚Äö√Ñ√π or ‚Äö√Ñ√∫cyber liability insurance‚Äö√Ñ√π coverage, is a financial product that enables businesses to transfer the costs involved with recovery from a cyber-related security breach or similar events.
Typically, the most important aspect of cyber insurance will be network security coverage. This coverage will respond in the event of a network security failure ‚Äö√Ñ√¨ such as data breaches, malware, ransomware attacks and business account, and email compromises. However, the policy will also respond to liability claims and ancillary expenses of an attack or breach.
In many cases, the policy can also provide access to a panel of top-tier breach coaches and other service providers.
We strongly encourage all our clients to consider the value of cyber insurance, especially if they handle or use digital information.
One of the first topics we cover with many new cyber insurance buyers is the business‚Äö√Ñ√¥s regulatory or contractual responsibility with regards to customers‚Äö√Ñ√¥ personal information. If your business stores customers data such as names, addresses, credit card information, Social Security numbers, and more, on any type of computer system on or offline, then there is a regulatory obligation to keep that data secure, and therefore, a higher price tag in the event of a breach.
Many are surprised to learn the real costs associated with a breach. According to a Ponemon report from 2017, cyberattacks cost small and medium-sized businesses an average of $2.235 million. On top of that, the study showed that 60 percent of the businesses that were polled said that attacks are becoming more severe and more sophisticated each year.
Additionally, if your business‚Äö√Ñ√¥s revenue stream has any contact with European consumers or businesses, then the recently implemented General Data Protection Regulation (GDPR) likely applies to you. Many US-based businesses have already taken measures to be GDPR compliant but that doesn't mean your insurance has followed suit.
Unsurprisingly, cyber insurance emerged onto the insurance scene recently as a result of the fact that other traditional business insurance policies were simply not created to cover the types of risks most commonly associated with cyber insurance.
Therefore, many insurance experts will argue that cyber insurance policies are still in their infancy and a lot of work needs to be done when it comes to standardizing coverage and making sure that insurance carriers are able to support the needs of modern businesses. Not only that, education is important in order for businesses to understand the threat of cyber attacks and the seriousness of these types of threats.
A very recent report from insurers Hiscox claims that seven out of 10 firms do not have a quality cyber security strategy in place.
There is, however, no doubt that the cyber insurance space will continue to grow rapidly and offers will certainly be expanded and customized. Also, as is the case with most other types of insurance offers, cyber insurance policies are evolving towards more industry-specific solutions and becoming less general.
Cyber insurance is as dynamic as the companies it protects and is consequently far from standardized. However, some of the issues that cyber liability insurance typically covers include:
- Data loss, recovery, and recreation
- Business interruption/ loss of revenue due to a breach
- Loss of transferred funds
- Computer fraud
- Cyber extortion
Important Note: Errors and omissions insurance is not cyber insurance and cannot serve as a substitute for proper cyber insurance, even if the E&O policy has a technology error rider.
If hackers expose or steal personal information, such as Social Security numbers, driver‚Äö√Ñ√¥s‚Äö√Ñ√¥ license number (in some states), address, and bank account information, a cyber liability insurance policy pays for:
- Notification Costs: This expense is significant because the company bears the burden of both identifying potential victims, which requires an internal investigation, and providing notification that‚Äö√Ñ√¥s reasonably calculated to give actual notice.
- Credit Monitoring: In effect, your cyber insurance policy pays for victims‚Äö√Ñ√¥ insurance policies. Regulators usually dictate the kind of credit monitoring to provide and it‚Äö√Ñ√¥s a safe bet they will not be satisfied with the cheapest available protection.
- Civil Damages: Most of these liability lawsuits are class actions, with hundreds of thousands of dollars in damages at a minimum, even for a very small company.
- Computer Forensics: This covers costs to hire computer forensics consultants working under the direction of your attorneys to determine whether a data breach occurred, to contain and prevent further damage, and to investigate the cause and scope of the breach.
- Reputational Damage: Data breaches can have profound PR implications for any business. A preferred policy will help you handle the potential fallout by covering the damages stemming from brand aversion due to a cyber incident for a certain amount of time after the breach. It can also help mitigate the potential cost by paying for PR management experts.
Cyber insurance providers also have a duty to defend policyholders from related administrative actions or liability lawsuits. For instance, cyber insurance will offer privacy liability coverage. This coverage is important for most companies, particularly those storing sensitive customer and employee information on their networks. Breaches that expose such information not only compromise those affected, but may expose your business to liability lawsuits from victims of such cyber incidents. Also, it will provide coverage in cases where you‚Äö√Ñ√¥re alleged to have violated privacy laws.
Like most coverages, there are certain exclusions that a cyber policy usually will not cover.
The policy will not respond if you are sued for any potential vulnerabilities in your systems before a breach occurs.
Most notably, cyber insurance policies will typically not reimburse you for future profits lost due to a cyber-attack or data breach.
If you fear losses due to theft of your intellectual property, you‚Äö√Ñ√¥ll have to look towards a specifically tailored intellectual property insurance policy. Additionally, allegations that the policy holder‚Äö√Ñ√¥s patents infringe upon those of a third party will also not be afforded coverage.
If an agent of a foreign power causes the breach, the coverage can be denied under the acts of war exclusion.
Additionally, the cost to improve your security and technology systems after an attack will not be included in most policies.
When considering whether you‚Äö√Ñ√¥ll be covered for cyber related exposures it's crucial to understand the concept of "Silent Cyber" Many traditional insurance policies, most notably general liability insurance (CGL), weren't designed with cyber risks in mind. This means that they dont have precise language either implicitly including or excluding cyber exposures. However, in practice this means that CGL policies generally won't cover cyber liability, and if they do the coverage will be minimal at best.
It's also important to note that social engineering attacks can be considered a special case. Social engineering refers to attacks that rely on psychological manipulation to gain access to sensitive information or funds. Victims following instructions from fraudulent emails or calls is not considered a computer system breach. Therefore, a special policy social engineering extension needs to be added to the cyber insurance.
We’ve made it easier than ever before to complete the purchase and get coverage. How easy? In just simple clicks you can have your policy!
We know the cost of insurance is a big factor for many, and that's why we keep our rates low and affordable for all. We work harder to earn your business.
At Kovr, our specialists are not only committed to give you the best experience digitally, but we are also available 24/7 to help with any concerns!
Getting a policy that does not properly protect you can cause a significant financial loss, it is our job to make sure we serve you the right product based on your need.
It's best to shop for this type of insurance by coverage as opposed to cost. Your company's sophistication and ability to avoid an incident and coverage limit are the two biggest factors in determining premium costs, as well as revenue and number of unique PII or PHI records stored or maintained on the insured's systems.
You will need legal representation in order to determine the scope of the federal and state notification requirement breaches. You will also need legal counsel to defend you in the event a suit is filed against you.
These expenses can include postage, paper, printing, call centers, etc.
What more can I say? The government will want, and get, their pound of flesh.
While not legally required, it is generally agreed that offering these services to the affected parties will reduce potential legal liability and is considered the right thing to do.
The manner in which the breach is reported to the media is crucial to restoring your reputation and maintaining your clients business associates, partners, and patients.
It's not uncommon for class action lawsuits to be filed against you following a breach. You will need legal representation which can be of your own choice or appointed by the carrier. Either way, coverage is available for these costs.
Ride-sharing company Uber had to pay a penalty to all 50 states after allegedly concealing a data breach in 2016 that affected roughly 57 million people.
A lawsuit filed against Facebook alleged that the company was guilty of unlawful business practices, deceit by concealment, negligence, and violations of California‚Äö√Ñ√¥s Customer Records Act as a result of a massive hack that exploited a security flaw to steal account credentials of as many as 50 million users.
Yahoo faced lawsuits from people who feared their accounts had been hacked and claimed the company was "grossly negligent" putting their financial and personal data at risk. The lawsuit also alleged that Yahoo did not adequately disclose the breach that exposed the private information of at least 500 million users.
Three years after Neiman Marcus disclosed that it had become the victim of a hack attack in 2013, exposing the credit card information of more than 350,000 customers, the retailer reached a $1.6 million settlement in the subsequent class action lawsuit.
Target Corp agreed to pay $39.4 million to resolve claims by banks and credit unions that said they lost money because of the retailer's late 2013 data breach. This settlement resolved class-action claims by lenders seeking to hold Target responsible for their costs to reimburse fraudulent charges and issue new credit and debit cards.