Managing Cyber Risk Through Insurance and Vendor Contracts

1. Managing Cyber Risk Through Insurance and Vendor Contracts Dino Tsibouris (614) 360-3133 dino@tsibouris.com Tom Srail, SVP, FINEX NA – Cyber and E&O Team tom.srail@willis.com Mehmet Munur (614) 360-3101 mehmet.munur@tsibouris.com

2. Outline • Cyber risks • Costs relating to cyber risks • Use of insurance for cyber risks • Lawsuits relating to insurance policies • Strategies in obtaining coverage • Traditional v. Cyber Insurance • Vendors • Conclusion

3. Cyber Risks • Hacking incidents • Data breaches • Privacy breaches • Unauthorized access • Social engineering • Vandalism or defacement • Cyber extortion • Regulatory enforcement following incidents

4. Cyber Risks • Privacy is a heightened & evolving exposure • Reliance on Vendors (Cloud, IT, HR) • Regulatory Changes • Underwriters are paying multi-million dollar losses • Business Interruption and Systems Failure • Credit card related fines and lawsuits. • “Cyber” Insurance has broadened to address these risks

5. “CYBER” INSURANCE TIMELINE Cyber Insurance Introduced NoticeCosts Covered Broad Privacy Ins. Vendor Coverage Corp Confidential Info PCI Fines & Penalties Systems Failure Reg. Fines &Penalties 1996 1998 2000 2002 2006 2008 2010 2012 2004 HIPAA GLB SB1386 PCI HITECH SEC Epsilon/ Sony Card Systems TJX Heartland Insurance History Regulatory/Industry History Claims/Losses History

6. What is the Data? What Data do you collect/process? • Personally Identifiable Information (PII): SSN, Drivers License, etc. • Payment Card Information (PCI): Credit Card, Debit Card Numbers • Protected Health Information (PHI) • Personal or Sensitive Personal Data (EU)

7. Where is the Data? Where is it? Do you share with third parties? • How well is it protected? • How long is it kept? What is a Breach? • Unauthorized disclosure • Unauthorized acquisition • Data compromised

9. Costs of a Data Breach • DIRECT COSTS • Notification • Call Center • Identity Monitoring (credit/non-credit) • Identity Restoration • Discovery / Data Forensics • Loss of Employee Productivity • INDIRECT COSTS • Restitution • Additional Security and Audit Requirements • Lawsuits • Regulatory Fines • Loss of Consumer Confidence • Loss of Funding Cost per record: $214 (2010) (up $10 from 2009) $73 $141 Source: Ponemon Institute

10. Costs of a Data Breach • Notification: $1/individual • Credit monitoring: $15-$50/individual • Call Centers, Fraud Alerts, Database Scanning, Restoration Services • Civil, regulatory and possibly criminal defense • Data Privacy counsel can cost $1,000+ per hour. • Business Interruption Costs/Data Damage?

11. Source: Advisen Cyber Risk Special Report

12. Source: Advisen Cyber Risk Special Report

14. Security Incidents and Insurance Proceeds In millions of dollars Source: SEC

15. Creative Hospitality Ventures v. US Liability Insurance • Restaurant gives customers receipts showing full account number in violation of FACTA. • Class action lawsuit ensues. • Restaurant seeks coverage under CGL policy.

16. Creative Hospitality Ventures v. US Liability Insurance • Policy limited to “personal and advertising injury.” • Defined as any publication that invaded the right to privacy. • Circuit court reversed magistrate holding that printing receipt was publication. • Therefore, no coverage.

17. Auto-Owners Insurance v. Websolv • Individual sues Websolv for sending unsolicited faxes as a violation of TCPA. • Websolv seeks coverage under CGL policy. • Auto-Owners sued arguing that it had no duty to defend under: • Advertising Injury – publication & privacy. • Property Damage – fax.

18. Auto-Owners Insurance v. Websolv • Appeals court held that Iowa law, not Illinois law, applied and that policy did not cover the injury. • Appeals court held: • Privacy interest v. seclusion interest. • Publication v. secrecy. • Damages expected v. intended. • Concluded that there was no coverage.

19. Eyeblaster v. Federal Insurance • Computer user sues Eyeblaster alleging injuries relating to its advertising software. • Eyeblaster seeks coverage under CGL and Network Technology Errors or Omissions Liability policies. • Federal denies coverage and brings this lawsuit.

20. Eyeblaster v. Federal Insurance • CGL includes coverage for “physical injury to tangible property” but excludes “any software, data or other information that is in electronic form.” • District court finds that there is no physical injury; therefore, no coverage. • Appeals court finds that inability to use computer constitutes injury under the policy and reverses.

21. Zurich Insurance v. Sony • Sony’s online networks are attacked and passwords are compromised. • Sony shuts down PSN for weeks. • Sony offers fraud monitoring. • Sony offers discounted games in apology. • Sony is sued in tens of class action lawsuits. • Zurich sues Sony for declaratory judgment.

22. Zurich Insurance v. Sony • Sony has insurance through many providers, including Mitsui Sumitomo, National Union, ACE, AXIS, Lloyd’s, Chartis, and others. • Zurich claims that its insurance policies cover: • Bodily injury, • Property damage, and • Personal and advertising injury. • Litigation ongoing.

23. Common Issues • Interpretation of undefined terms crucial in coverage. • Interpretation varies depending on trial court, appeals court, and state law. • Litigating insurance policy consumes time and resources.

24. Common Issues • Data may not be tangible personal property. • Publication may not have occurred. • Privacy rights may not have been breached.

25. Common Issues • CGL policy covers specific risks. • Cyber risks may not be covered. • Coverage varies widely among policies.

26. Traditional Insurance Gaps • Theft or disclosure of third party information (GL) • Security and privacy – “Intentional Act” exclusions (GL) • Data is not “tangible property” (GL, Prop, Crime) • Bodily Injury & Property Damage triggers (GL) • Value of data if corrupted, destroyed, or disclosed (Prop, GL)

27. Traditional Insurance Gaps • Contingent risks (from external hosting, etc.) • Commercial Crime policies require intent, only cover money, securities and tangible property. • Territorial restrictions • Sublimit or long waiting period applicable to any virus coverage available (Prop)

28. Preparation is Key • Policy must be part of an Enterprise Risk Management program • Utilize privacy, security, and legal: • Policies • Procedures • Controls • Understand probability and magnitude of risk • Audit products and services

29. Preparation is Key • Ask Your Privacy / IT professionals: • Incident Response Plan (tested?) • Vendor Contracts / Insurance Requirements • Privacy Risk Assessment • Check Existing Insurance Gap Analysis • New coverage terms must integrate with • Response Plans • Traditional Policies

30. Cyber Risk Coverage • Data breach • Governmental civil actions • Virus liability • Content liability • Extortion • Lost data

31. Privacy & Network Coverages Expense (Loss Mitigation) Coverage • Data Breach Expenses: • Consumer notification and credit monitoring service costs (sub-limit) • Forensics/Investigations • Public Relations/Crisis Management Expenses

32. Privacy & Network Coverages Liability Coverage • Privacy Liability • Network Security Liability • Media, IP and Content Liability

33. Privacy & Network Coverages Direct (First Party) Coverage • Revenue Loss (Interruption to income due to systems outage) • Data Reconstruction

34. Limits and Exclusions • Must the insured notify you right away? • Indemnification for losses or claims, too? • Who chooses the lawyer to defend a lawsuit? • Are there preferred vendors? • Limitation of liability – dollar amount?

35. Vendor Contracts • Breaches may occur at a vendor. • Contract clauses and limitations should harmonize with insurance clauses. • Damage limits should factor policy limits. • Notify if a breach may have occurred. • Should they tender your defense? • You are liable, but they can help.

36. Vendor Contracts IT/Software Companies • Request Tech E&O, plus Privacy/Network Coverage • Some Tech E&O policies have security/privacy exclusions • Breach could occur without “wrongful act” being committed

37. Vendor Contracts Business Services – Payroll, Auditors, Counsel • Request appropriate E&O coverage • Request Privacy/Network coverage Credit Card Processors/Acquiring Banks • Request Privacy/Network Coverage (Gaps in Bond or Professional Liability coverage)

38. Vendor Contracts Other Vendors that transport, touch, interact with your systems or sensitive information • Request Privacy/Network coverage

39. Upcoming Issues • Revisions to the EU Data Protection Directive that propose fines of up to 2% of annual turnover of a company • Federal data breach notification in the U.S. • FTC Final Privacy Report and Privacy by Design • Department of Commerce multi-stakeholder enforceable codes of conduct process

40. Outline • Cyber risks • Costs relating to cyber risks • Use of insurance for cyber risks • Lawsuits relating to insurance policies • Strategies in obtaining coverage • Traditional v. Cyber Insurance • Vendors • Conclusion

41. Questions Dino Tsibouris (614) 360-3133 dino@tsibouris.com Tom Srail, SVP, FINEX NA – Cyber and E&O Team tom.srail@willis.com Mehmet Munur (614) 360-3101 mehmet.munur@tsibouris.com