For relatively little expense, insureds can often add cyber endorsements to traditional CGL, professional liability or other insurance policies.  On October 25, 2016, the Northern District of Alabama issued a decision in Camp’s Grocery, Inc. v. State Farm, one of the few decisions interpreting cyber coverage to date, that demonstrates why insureds should be wary of opting for cyber endorsements instead of stand-alone policies.  Docket No. 4:16-cv-0204, 2016 WL 6217161.

Camp’s had a series of no good, very bad days.  First, hackers accessed its network and compromised customers’ credit card, debit card and check card information.  Yipes.  Then, three credit unions sued Camp’s to recover card reissuance, fraud reimbursement and fraud prevention expenses.  Double yipes.  Finally, Camp’s tendered the claim to State Farm, which informed Camp’s that the Computer Programs and Electronic Data Extension of Coverage and related endorsements to its property and casualty policy only covered Camp’s first party data breach losses.  The endorsements did not cover, in State Farm’s view, third party liability claims like the credit unions’.

The court agreed.  It held that State Farm and no duty to defend or indemnify Camp’s with respect to the credit union lawsuit.  It explained that “[i]nsurance contracts generally are assigned to one of two classes: either ‘first party coverage’ or ‘third party coverage’…’First party coverage’ pertains to loss or damage sustained by an insured to its property…In contrast, if the insurer’s duty to defend and pay runs to a third party claimant who is paid according to a judgment or settlement against the insured, then the insurance is classified as ‘third party insurance.’  Thus, wholly different interests are protected by ‘first-party coverage’ and ‘third-party coverage’.”  In holding that Camp’s endorsements offered only first party coverage, the essentially held that Camp’s had no coverage since it was only attempting to deal with the credit unions’ third party claims.

First, I have to say that Paul Stockman at McGuireWoods has beaten me to the punch in his article, “Cyber Risk ‘IRL’.”  So, read that.

Stockman addresses a coverage issue I’ve noted in cyber policies across carriers.  They tend to say something like: “The Company shall not be liable for Loss on account of any Claim or for any Expense…for bodily injury…or damage to or destruction of any tangible property.”  Carrier’s position: If the data breach or malware attack causes an explosion, that’s on somebody else.  My take – well, it would depend on the facts, the policy wording and the state of the law in the relevant jurisdiction.  Of course.

It’s now clear, however, that cyber attacks can do more than corrupt and steal electronic data.  Cyber attacks can also result in machine malfunctions that cause physical harm ‘IRL,” or “in real life.”  Consider a hacker taking control of an HVAC system, or a car or a nuclear centrifuge (it separates uranium isotopes to make nuclear bombs).  The result: IRL, broken stuff, injured people damage.

Unless you already know the answer, you might want to check out a recent webinar presented by Angie Singer Keating (of the IT firm Reclamere), Brian Courtney (The Safegard Group, insurance brokerage), Renee Martin (my Partner at Dilworth) and little old me.  You can check it out here.  Enjoy!

The struggle to identify appropriate policy limits continues to frustrate many in the market for cyberinsurance.  So does the difficulty involved with comparing premiums across policies offering coverage terms with a lot of variation.  But publicly available data continues to improve, and this piece from the folks at Cyber Data Risk Managers is particularly interesting.  CDRM shared data on 34 actual clients’ premiums and limits based on industry and annual revenue.  Among the highlights:

Highest Revenue: A pharmaceutical benefits management company with annual revenues of $4B bought a policy with a $5M limit for a premium of $84,000.

Highest Limits:  A data storage center with annual revenues of $15M bought a policy with a $20M limit for a premium of $120,000.

If you are a United States company that processes or maintains data from individuals living in the European Union, this matters to you.  The US/EU Data Privacy Shield self-certification process goes live on August 1, 2016.  There lots of good information out there already, but there is also a good bit of scrambling to put in place a framework for companies that want to enroll in this new program.  Do you want the high-level overview?  Of course you do.  Here is what Privacy Shield compliance will probably entail:

  1.  Revise your privacy policy to comply with the new requirements/language.
  2. Select a third-party dispute mechanism to handle complaints from EU data subjects.

Here is how it is supposed to work.  Something bad happens.  You’re insurance company pays for it.  Then, your carrier sues the bad guy who harmed you.  That’s subrogation.

In the data breach context, this timeless construct presents numerous challenges.  The most notable is the difficulty associated with finding the bad guys.  But that isn’t your problem.

The contract you have with your data hosting service, credit card processor or other vendor, on the other hand, might very much be your problem.  You probably pay a monthly fee.  Depending on the size of your company, that fee is probably a modest amount.  For smaller organizations, it might only be $20 or so per month.  Now, consider what this vendor is holding – all of your data.  Yikes.

Cyberinsurance policies typically provide first and third party coverage.  First party coverage relates to an insured’s own expenses in investigating and remediating a data breach, and recovering the insured’s data and other information assets.  Third party coverage kicks in when customers and regulators seek to hold the insured accountable for the breach.

But we know this already, right?

We also know that underwriters started with commercial general liability (CGL) forms when they started writing cyber policies because, well, it was the closest thing they had on file and nobody likes to start from scratch.  I’ve previously discussed how this has led to some CGL provisions spilling into cyber policies even though they really don’t belong.  The contractual liability exclusion, the acts of war/terror exclusions, etc.

On May 31, 2016, the U.S. District Court for the District of Arizona held that P.F. Chang’s obligation to pay its credit card processor nearly $2M following a 2014 data breach was contractual, and therefore not covered under its cyberinsurance policy.  Ouch.  Let’s back up.

In 2014, hackers posted the credit card numbers of 60,000 P.F. Chang’s customers on the internet.  P.F. Chang’s had a Chubb cyberinsurance policy in place, for which it paid a $134,052.00 annual premium.  Chubb paid P.F. Chang’s $1.7M in policy benefits to cover forensic investigation, litigation defense and other costs, but that was less than half of the cost of this breach.

Really?  Yes, really.

Those new, old-school Air Jordans are retro cool (and I have them).  Those new cyberinsurance retroactive dates – eh.

I blogged about retroactive dates here.  Reminder: an insurance policy retroactive date is the day prior to which otherwise covered occurrences are not covered.  In the first policy placed with a particular carrier, this will usually be the policy’s inception date as well.  In my prior post, I discussed the problem of data breaches that occur prior to the retroactive date, but which are not discovered (and litigated, regulated, remediated etc.) until after that date.  Since many data breaches are not immediately discovered, this sequence could seriously impact coverage, particularly for new entrants to the market.

Here’s another twist.  What about the alleged “wrongful act” that purportedly caused the breach (the “occurrence” if you want to get technical about it)?  A plaintiff or regulator may contend that the “wrongful act” was the failure to implement particular security measures, and that may have occurred years before the breach.  If the policy ties the retroactive date to not only the “occurrence,” but also the”wrongful act” that did or allegedly caused it, double whammy.  And because the wrongful act could be at least alleged to have occurred at any time, this language could be placing coverage determinations in the hands of plaintiffs and regulators.  Dangerous.

Contact Information