Cyber Liability Insurance

Data Restoration:  This is a primary protection area that you will want to discuss with your agent.  What will your policy pay toward the cost to replace and/or restore electronic data.  We are talking about data, programs, software, etc. damaged or destroyed by hacker or a virus or other named peril within the policy.

Cyber Extortion:   That is big one that we are hearing about right now and we often think of the ‘big’ companies subject to this type of loss.  Not so!  I’ve known some small, one-person operations where their computer was hacked, commandeered and a $5,000 ransom required to release the data.  According to ’60 Minutes – June 6 broadcast- it has become so widespread that the ‘bad guys’ can go on the web and rent the necessary apps to effect a data breach.  Further to the ’60 Minutes’ piece, some -if not most of the hackers- use a standard ransom demand, but are willing to negotiate down to whatever the ‘kidnapped’ computer owner can pay.  If there were any good news in that story, it was the nearly 100% of time, once the ransom is paid, the data is released.   The majority of the cyber liability policies will cover any extortion payment made within the insurer’s consent plus related expenses – such as the cost of hiring an expert negotiator to negotiate with the extortionist.

Loss of Income and Extra Expenses:  This definition can become very specific in some insurance contracts.  It, of course, largely means what income you lost while attempting to restore your data system, as well what it cost to restore operations to normal.   Some policies, have an itemized list of expenses they will consider; others require the back-up to verify the loss of income.

Crisis Management:   Some amount of Crisis Management is pretty consistently included in most cyber liability products; however, the level of protection varies significantly among the conveyances.  They can be broad enough to include the cost of hiring an attorney, a forensic accountant, a computer expert or even public relations expert to assist in assessing damages, sorting out what data was compromised, as well as mitigating the damage to the company’s reputation.

Notification Costs:  Too often insureds don’t consider the cost of notifying the people whose information has been compromised.  It sometimes comes as a surprise to the insured that most states have laws in place that require businesses to inform every individual who was likely injured by the data breach.  Some  insurer’s go so far as to provide for the cost of providing credit monitoring services for affected parties.

There are a few items typically found in the more complex policies particularly attractive to larger corporations: Network Security & Privacy Liability –to cover claims caused by negligent acts, errors or omissions.  Electronic Media Liability – to cover lawsuits involving libel, slander, invasion of privacy, domain name infringement, etc. Regulatory Proceedings – to cover fines, penalties imposed on businesses by regulatory agency; typically would also include the cost of an attorney to respond to the regulatory authority.

Perhaps, what is equally important is what is not covered by the cyber liability contract:  Bodily Injury; property damage, Intentional dishonest acts by the insured; war, terrorism, contractual liability, utility failure, cost restoring computer systems to a higher degree of functionality; acts committed prior to policy inception or retro-active date.