Cyber/Privacy Insurance

Information Exposures

• Credit Card Information• Personally Identifiable Information

– Social Security Numbers– Drivers License Numbers– Banking Information– Employment Information– Insurance Information

• Personal Health Information• Business Information – Ever sign confidentiality

agreements or non-disclosure agreements? Private co. financials?

Likely Causes of Loss

• Lost/stolen portable computers or media…Blackberry/iPhone

• Lost/stolen back up tapes.• Improper disposal

– Paper records– Computer Equipment (fax machines)

• Computer Hacking• Employee Misuse• Rogue Employee

– According to 2004 CSI/FBI computer crime security survey, inside jobs represent 80% of reported security incidents.

• Vendor Negligence – big issue - Target• Negligent Release

Value of Stolen Data:Symantec Corp Report on the Underground Economy ‘07-’08

Rank for Sale

Rank Requested

Goods and Services

% for Sale

% Requested

Range of Prices

1 1 Bank account credentials

18% 14% $10-$1,000

2 2 Credit Card #’s with CVV@ #’s

16% 13% $.50 - $12

3 5 Credit Cards

13% 8% $.10 - $25

4 6 E-mail addresses

6% 7% $.30 - $40

5 14 E-mail passwords

6% 2% $4 - $30

6 3 Full identities

5% 9% $.90 - $25

After Breach. What to do?

• First off, was there a breach? Voluntary notification costs are huge.

• What happened and what data, hardware, and software was affected? Computer forensics firm

• What regulations apply and how do we comply? Privacy Attorneys– Along these lines, is affected data for people in other

states? Other states notification laws?

• How do we restore trust/make it right with our customers? Public Relations, Credit Monitoring, ID Theft Counseling

Current Developments• High profile data breaches: Target, Neiman Marcus, Sony, RSA, Citibank,

Lockheed Martin, Google • Cloud Computing

• Texas Medical Records Privacy Act (2012) – broader in scope than HIPAA as it applies to health care providers, heath plans, and other entities, individuals, businesses, or organizations that obtain, store, or possess PHI

• HIPAA provides that if a state law grants more privacy protection to a patient, state law applies

• PCI Standards/Compliance – Started in 2006

• Cyber/Privacy Insurance Market Growth: Approx $800M premium in 2010, which is about double 2007 (Betterley Report)

• Down Economy means Crime goes up…Why wouldn’t Cyber Crime go up?

– In 2009, more than 222M records were compromised in 469 reported incidents (per Identity Theft Resource Center)

Current Developments – Target & Neiman Marcus• Hackers becoming more sophisticated – robbers are always ahead of

the cops

• One unanswered question from the Target and Neiman Marcus breaches is how internal or external attackers managed to steal so much data while avoiding detection. But people with knowledge of the Target investigation told Reuters that the attackers' toolkit reportedly included memory-parsing malware known as RAM scrapers. The malware can be used to infect point-of-sale (POS) systems -- a fancy name for retailers' digital cash registers -- and then intercept sensitive information such as credit card numbers and magnetic-stripe data. While the data resides in memory it remains in plaintext -- and thus easy to intercept -- even if it later gets encrypted for storage or transmission.

• Visa reportedly published two security alerts last year -- in April and August -- warning retailers about a rise in RAM-scraping attacks. But one source told Reuters that the RAM scraping tools used by attackers were more sophisticated than what's been seen before, meaning that even if Target or any other retailer had bolstered its security defenses in the wake of the Visa warning, they may have been unable to stop the new malware.

Current Developments• SMALL BUSINESS IS THE TARGET:

– 2013 Symantec: Internet Security Threat Report :Targeted attacks on businesses with fewer than 250 employees are growing. Small businesses are now the target of 31 percent of all attacks, a threefold increase from 2011. While small businesses may feel they are immune to targeted attacks, cybercriminals are enticed by these organizations’ bank account information, customer data, intellectual property and the knowledge that they often lack adequate security practices and infrastructure.

– Among the key findings of Symantec’s 2010 SMB Protection Survey, small businesses:

• sustained an average loss of $188,000 per breach,• comprised 73 percent of total cyber crime targets/victims,• lost confidential data in 42 percent of all breaches, and• suffered direct financial losses in 40 percent of all breaches.

– In 2010, the U.S. Secret Service and Verizon Communications Inc.'s forensic analysis unit, which investigates attacks, responded to a combined 761 data breaches, up from 141 in 2009. Of those, 482, or 63%, were at companies with 100 employees or fewer. Visa Inc. estimates about 95% of the credit-card data breaches it discovers are on its smallest business customers.

– A 2010 survey by the National Retail Federation and First Data Corp. of small- and medium-size retailers in the U.S. found that 64% believed their businesses weren't vulnerable to card data theft and only 49% had assessed their security safeguards.

Healthcare – Recent Data Privacy Developments

• Federal Law: American Recovery and Reinvestment Act of 2009 (aka the Stimulus Bill) – HITECH Act.– Government spending $25.9B to promote and expand health

information technology– Goal is to create a nationwide network of electronic health

records

• U.S. Department of Health and Human Services office for Civil Rights (OCR) has beefed up staff and oversight. (UCLA Healthcare Systems had to pay $865K for celebrity patient disclosures – failed to restrict employees from records.)

• Contrasts with lax enforcement for the past 15 years.

• Under HITECH, "business associates," or third parties such as a billing company or cloud provider, now must follow the HIPAA privacy laws by protecting patient information and reporting data breaches.

HITECH Act (cont’d)

• What changes for a “business associate”?– They are subject to civil and criminal penalties (not just contractual

claims by the covered entity).

– Must comply with administrative, physical, and technical safeguards and documentation requirements under the HIPAA security rule.

– Two-way policing: The business associate and the covered entity must report known violations.

• Janitor in a hospital sees a doctor’s office throwing away sensitive medical records – obligated to report

– Notification: Must notify the FTC of any breach, and violation is considered an unfair and deceptive act.

– Covered entities: Must notify individuals within 60 days…If over 500 identities, they must notify “prominent media outlets” in the area as well as the Department of Health and Human Services.

Cloud Computing• IT purchasers realize the enormous potential for reduced

hardware and software costs. The cloud is becoming more popular.

Issues/Thoughts:- Large risk of data loss and business interruption when moving data and applications from hardware based system to the cloud.

- Access from any PC anywhere makes it more difficult for a cloud computing provider to verify that the user is who the user says they are via password.

- Cloud providers typically are not responsible for the data if there is a breach. Liability is typically pushed back on the insured via contract with the provider. Think Amazon and the massive amounts of data they host in the cloud.

- Will the cyber marketplace pick up contingent business income if the cloud service is unavailable? Remains to be seen.

Coverage Elsewhere?

• General Liability– BI/PD – definition of property is typically limited to “tangible”

items– Exclusion g. to coverage A of the ISO CGL form excludes

coverage for damages “arising out of the loss of, loss of use, damage to, corruption of, inability to access, or inability to manipulate electronic data (we have seen endorsements broadening coverage by adding an exception to the exclusion for damages because of “bodily injury”)

• Crime– Almost all policies are limited to money and securities

Cyber Insurance

• 1st-Party - Direct loss due to “injury” to electronic data or systems resulting from acts of others – no need for anyone to come after you for money– Breach response, extortion, restoration costs, business

income

• 3rd-Party - Liability for financial losses or costs sustained by others resulting from Internet or other electronic activities– Network liability, electronic media liability, regulatory

defense costs, privacy liability

Breach Response

• Usually triggered by unauthorized access, introduction of malicious code, accidental or unauthorized release of private information, and denial of service attacks.

• Pays forensic investigation expenses, cost of advertisements, notification expenses, credit monitoring services, cost of a public relations consultant.

Why Breach Response Coverage is Important:

• Easily the most likely coverage to be triggered

• Per Mark Greisinger,President of NetDiligence, a leading cybersecurity assurances company. www.NetDiligence.com Cyber-crime attorney: $700/hr Investigation/Computer Forensics Fees: $300 - $700/hour (find

out what happened, how to prevent/stop, type of data breached, etc.) pre negotiated rates are huge

Notification costs: mail notice letter to customers as much as $14/customer.

Credit Monitoring: $10-$12/year per person. Public Relations Firm: $10,000/month or $400/hour.

• Side note – Mark Greisinger developed the E Risk Hub that comes with probably 90% of cyber policies sold

Why Breach Response Coverage is Important:

• Texas Security Breach Notification LawThe law requires written or electronic notice directly to the affected residents, except that if the cost of direct notification exceeds $250,000, the number of people to be notified exceeded 500,000, or the data controller did not have complete contact information, then the law allows for notification by publication.

The law provides for a civil penalty of up to $1 million, plus the amount of reasonable expenses incurred in obtaining the civil penalty. The Texas attorney general or the prosecuting attorney in the county in which a violation occurred can bring suit to recover the civil penalty (payable to the state). This penalty would be in addition to any other available remedy, which could include damages suffered by the resident.

More Perspective…Just Notification Costs

• If it is estimated that it costs $200 per Identity…

– A men’s clothing store that does 5 sales a day would end up paying $365K for the data breach of a year’s worth of customers.

– MRI clinic does 10 scans a day Monday through Friday…$520K for all of the patients seen in one year.

Extortion

• Usually triggered by a threat to bring down a network (introduce “malicious code”), divulge digital records without authorization, or deny a company’s service to third parties (typically a retailer that depends on customer traffic/sales on their website.)

• Pays investigation costs, costs for a negotiator, and “ransom.”

• Can be sublimited, but not always.

• Coverage used to not be that big of a deal, but a recent rise in claims (especially in Europe) has increased the importance.– Cryptolocker bigger in Europe

Extortion - Example

• Hackers demand $10 million to return patient records stolen from Virginia state site.

The Washington Post reports, "Hackers last week broke into a Virginia state website used by pharmacists to track prescription drug abuse." After deleting records "on more than eight million patients," they "replaced the site's homepage with a ransom note demanding $10 million for the return of the records." The event marks "the second major extortion attack related to the theft of healthcare data in the past year. In October 2008, Express Scripts, one of the nation's largest processors of pharmacy prescriptions, disclosed that extortionists were threatening to disclose personal and medical information on millions of Americans if the company failed to meet payment demands."

Restoration Costs

• Usually triggered by unauthorized access, introduction of malicious code, accidental or unauthorized release of private information, and denial of service attacks.

• Pays for Restoration of Data within computer system. If the data cannot be restored or recreated, policy will pay the cost to reach that determination.

• Can be directly related to extortion coverage.

Business Interruption

• Intent has to be malicious and direct. Will not be triggered if power goes out, servers fail, etc.

• Pays normal gross margins for the time period in which the network was disabled.

• Time Period Deductible (i.e. 10 hours)

• Direct – Loss of Sales.

• Indirect – Lose ability to Manage Inventory. Example: WaWa stores***Some markets playing around with customer attrition/reputational damage products.

Network Liability

• Often confused with privacy coverage. Not so.

• Triggered by unauthorized access/use, computer virus, denial of service attack, denial of access, mistake in administration of network.

• Pays third party damages for inability to access website (e.g. customer of a supplier), transmission of a virus to a third party from insured’s computer system, use of insured’s network to launch of a denial of service attack on a third party.

Electronic Media Liability

• Personal Injury for Insured’s Network Communications. Think of insured’s website as a newspaper.

• Libel, slander, product disparagement; violation of right of privacy; misappropriation and plagiarism; infringement of copyright, trademark, etc.

Electronic Media Coverage – May be Worthless

• Recent ISO CGL PI/AI coverage should pick it up…except:j. Insureds In Media And Internet Type Businesses"Personal and advertising injury" committed by an insured whose business is:(1) Advertising, broadcasting, publishing or telecasting;(2) Designing or determining content of web-sites for others; or(3) An Internet search, access, content or service provider.However, this exclusion does not apply to Paragraphs 14.a., b. and c. of "personal and advertising injury" under the Definitions Section.For the purposes of this exclusion, the placing of frames, borders or links, or advertising, for you or others anywhere on the Internet, is not by itself, considered the business of advertising, broadcasting, publishing or telecasting.k. Electronic Chatrooms Or Bulletin Boards"Personal and advertising injury" arising out of an electronic chatroom or bulletin board the insured hosts, owns, or over which the insured exercises control.

***A note on Chatrooms. The website owner is usually not responsible for “user” content. If they screen “users” beforehand, the law assigns a higher standard.

Regulatory Defense Costs/Fines and Penalties

• Covers the defense of regulatory actions by governmental agencies against the insured for alleged violations of privacy regulations/laws.

• Attorney’s Generals are becoming more and more aggressive in enforcing regulations

• AG’s have historically been understaffed and cannot handle enforcement, so some have engaged 3rd party law firms to investigate random companies and make sure they are compliant with state laws

• AG’s like to use high profile breaches to spring board their political careers into the spotlight– CT, NY, SD, MA AG’s have already indicated they will file

suit against Target due to the recent breach

Privacy Liability

• Usually triggered by misappropriation, theft or unauthorized access. (Failure to secure data or errors and omissions in handling data.)

• Data covered: Personal Information, Non-public data (usually corporate information).

• *****Want all data covered, not just electronic data. (Improperly disposed of or secured paper records.)

• Claims from individuals are rare but seen on the healthcare side – class actions a bigger worry.

• National Institute of Standards and Technology (part of Dept of Commerce) has issued cyber standards. They are informal and voluntary, but…– Gives plaintiff attorneys ammunition when it comes to class actions– Seen as informal government regulations– There is no negligence standard for safeguard of PII, but the NIST is

speculated to be used heavily to create one for those entrusted with PII

Why Don’t Insureds Buy?

• Firewalls are up to date/everything is encrypted – robbers are always ahead of the cops.

• Cost – historically cost has been high. Carriers now have a better grasp of exposures and have more premium across their books, so pricing is significantly less than what it was just a few years ago.

• App is too long – we can provide a standalone quote with full limits with nothing more than a company name, revenues, and an address. Will always turn around a quote in 24 hours, but usually it’s flipped in less than an hour.

• Any other objections you hear?

Who Needs the Coverage (the most)?

• Who deals with confidential data?– Healthcare– Government– Financial Institutions– Schools/Universities– Online Merchants– Churches/Philanthropic Organizations

What can your clients do to prevent/mitigate cyber losses?

• Policies• Privacy Policies• Information Security Policies• Computer Usage Policies

• Employee Training

• Technical Security Controls• Access Controls: Firewalls, passwords, etc. • Anti-virus

• Physical Security Controls

• Incident Response Plan• Erisk Hub is very useful for insureds

Conclusion

• Not a matter of “if” but “when” almost nothing you can do to prevent an attack

• Small business is a huge target fewer controls and resources to prevent/handle an attack

• 1st party coverage is huge “tack on cyber” on a Chubb, Hartford, etc – E&O policy will typically sublimit 1st party cover to something

silly