Cyberliability

Subscribe to Cyberliability via RSS

Cyberattacks continue to grow in sophistication and frequency, with attackers targeting businesses of all industries and sizes with seeming impunity. In the wake of this ongoing pervasive and indiscriminate threat, corporate risk departments are taking measures to assess cyber risks and update network security and protocol in hopes of staying one step ahead of potential hackers.

But just as risk departments are reacting in real time to this ever-growing threat, so too are members of the insurance industry. As cyberattacks grow in sophistication and frequency, costs expended to recover from these attacks grow in kind, which has led to an explosion in insurance claims under cyber insurance policies and other responsive coverage. With insurers obligated to pay substantial sums to settle these claims, the result has been a tightening of the cyber insurance and related markets for renewals and placements and, with respect to claims under existing policies, heightened scrutiny and application of existing terms in rendering claims decisions.

The Court’s decision

An example of such novel application became front and center in a recent decision in Merck & Co., Inc. et al. v. Ace American Ins. Co. et al., Case No. UNN-L-2682-18 (N.J. Sup. Ct.). Merck, a multinational pharmaceutical company, sued its insurers after they denied coverage under an “all risks” insurance policy for a 2017 cyberattack that crippled Merck’s computer systems and caused an alleged $1.4 billion in losses to the company.

Although it was undisputed that the policies at issue provide coverage for “loss or damage resulting from the destruction or corruption of computer data and software,” insurers pointed to an unusual exclusion to support their argument that coverage must be denied: the “Hostile/Warlike Action Exclusion.”Continue Reading Lessons from Merck v. Ace: A cyberattack does not amount to an ‘act of war’

At Reed Smith, we pride ourselves on forming true partnerships with our clients to find creative and unexpected solutions to the most challenging insurance coverage issues. As part of this commitment, we have authored a column for Thomson Reuters to provide advice, strategies, and information on the full range of insurance coverage issues affecting commercial…

Experian Data Breach Resolution (Experian) has identified its “top data breach trends of 2020,” and the cannabis industry should take note. In its “Data Breach Industry Forecast 2020,” Experian predicts that “we will see many burgeoning industries, such as cannabis retailers, cryptocurrency entities, and even some environmental organizations targeted for cyberattacks as a result of online activism or ‘hacktivism.’”

In recognition of this risk, cannabis retailers as well as other cannabis-related businesses should – in addition to taking other prudent risk-mitigation steps – ensure that they have procured insurance to protect against potential cyber-related losses and claims. While the cyber-insurance market available to cannabis-related businesses is still rather limited, such businesses generally still can – and should – obtain at least some cyber coverage today.
Continue Reading Are you covered? Cannabis industry must prepare for cyberattacks in 2020

Purchasing insurance for a cannabusiness can feel like a daunting task, but it does not have to be one.

In addition to grappling with many of the same issues and questions that any business confronts when seeking insurance, a cannabusiness encounters certain additional, unique challenges due to the industry in which it operates. That is no reason to panic, however. And, it is certainly no reason to avoid purchasing insurance.

There are a number of steps that a cannabusiness – or, really, any business – can take to maximize the likelihood that the insurance-procurement process will be smooth and successful. In particular, when purchasing insurance, a cannabusiness should consider the following 10 steps: Continue Reading Ten important steps a cannabusiness should consider when purchasing insurance

Since July 2017, national, regional and local businesses operating in Illinois have been hit with a virtual storm of class actions under the Illinois Biometrics Privacy Act (“BIPA”), 740 ILCS 14 et seq.  BIPA regulates how businesses may record and store biometric data from customers or employees, and these actions create the potential for significant losses, including the costs of defending class action litigation and potential awards of statutory damages. Defending, settling and paying judgments in claims under BIPA may be covered in whole or in part under cyberliability, media liability, and/or employment practices liability insurance. Businesses operating in Illinois and states with similar laws (such as Texas and Washington) should carefully review their liability insurance programs to determine whether they may respond to a claim under BIPA or a similar statute, and should provide prompt notice of claim in the event of a suit.

The Illinois BIPA requires written consent before any biometric data can be collected and stored; requires companies to develop a publicly available written policy disclosing its schedule and guidelines for its retention of, and eventual permanent destruction of, employees’ biometrics; and mandates how companies must handle biometric data once in possession. If a company fails to abide by the consent, disclosure, or handling requirements, an employee may recover the greater of either (i) actual damages, (ii) $1,000 for a negligent violation, or (iii) $5,000 for an intentional or reckless violation. Awards of plaintiffs’ attorneys’ fees and injunctive relief are also available.
Continue Reading Beware the Fine (Thumb) Print: Insurance Coverage for Class Actions Under the Illinois Biometric Information Privacy Act, and Similar Biometric Privacy Statutes

The October 21, 2016 DDoS attack on the internet’s domain name system infrastructure underscores the need to consider cyberliability insurance coverage as a critical component of your company’s security and privacy breach response plan, and if your company carries cyberliability insurance, to ensure that your coverage will respond to a network business interruption, security breach…

In an encouraging development for insureds, the United States Court of Appeals for the Fourth Circuit held that a health care company’s general liability insurer was required to defend the company against claims stemming from an alleged failure to secure electronic medical records. In The Travelers Indemnity Co. of America v. Portal Healthcare Solutions, L.L.C., No. 14-1944 (4th Cir. Apr. 11, 2016), the Fourth Circuit held that the breach resulted in a “publication” of medical records, thus falling within the scope of the general liability policy issued to Portal Healthcare Solutions, L.L.C. (“Portal”).  The decision reaffirms that insureds that experience adverse cyber events are not limited to cyber-specific policies as the source of potential insurance coverage.

Portal’s insurer, The Travelers Indemnity Company of America (“Travelers”), commenced litigation in the United States District Court for the Eastern District of Virginia, seeking a determination that it was not required to defend Portal against a putative class action alleging that Portal negligently failed to secure a server hosting medical records, which resulted in those records becoming available on the Internet. Ruling on cross-motions for summary judgment, the District Court sided with Portal, reasoning that the allegations “at least potentially or arguably” alleged a “publication” of private medical information that either (a) gave “unreasonable publicity” to the patient’s private life, or (b) “disclose[d] information” about the patient’s private life.  Either circumstance triggered a coverage obligation under the Travelers policies.Continue Reading Court Upholds Coverage Under General Liability Policy for Claim Alleging Failure to Protect Data

National Public Radio and other news outlets are reporting that a Los Angeles-area hospital recently paid a $17,000 ransom (in the form of 40 bitcoins) to hackers to unencrypt its computer networks, which had been held hostage after “ransomware” was introduced into the hospital’s network. Ransomware is a form of malicious software, or “malware,” that encrypts information or aspects of an organization’s computer network, preventing authorized users from accessing it. Persons maliciously cause the ransomware to be placed on the network, then demand money in exchange for an encryption key to unlock the network. It is not difficult to see the tremendous economic losses and liability risks of a ransomware attack, in particular to a medical facility treating vulnerable patients.
Continue Reading Companies can insure against cyber ransom

Professional sports organizations are facing a new off-field risk: potential exposure of their proprietary data. In this new age of data in professional sports, teams are spending millions of dollars on sabermetrics and other data science techniques to obtain a competitive edge. But as the recent alleged breach of the Houston Astros’ computer database by…

In light of the growing concern over cybersecurity, the United Stated Department of Justice (“DOJ”) issued guidance last week on how to prepare for and respond to cyber attacks.  Taking lessons learned by federal prosecutors while handling cyber investigations, and input from private sector companies that have managed cyber incidents, the guidance contains a step-by-step guide on what to do before, during and after a cyber incident.

Specifically, the DOJ recommends having a plan in place before any cyber attacks occur.  That plan should include identifying critical data and assets that warrant increased security, having the technology and services needed to respond to a cyber incident in place, having legal counsel that is familiar with legal issues associated with cyber incidents, and ensuring that your team knows who is responsible for what tasks in the event of an attack.   If an attack happens, the DOJ recommends assessing the scope of the incident and working quickly to prevent any on-going damage, collecting and preserving data related to the attack, and notifying law enforcement.  The DOJ cautions against using any systems that have been compromised and trying to “hack back” against the system involved in the attack.Continue Reading United States Department of Justice Announces “Best Practices” for Addressing Cyber Attacks