Cyberattacks, including hacks, ransomware and malware attacks, are on the rise. Nearly every industry has been or could be affected, including professional and financial services, manufacturing, distribution, health care, education, tech, retail, energy, government and non-profit. Experts believe this trend will only continue. But insurance may be able to help manage the growing risks, as Lisa Szymanski and Adrienne Kitchen discuss in this episode. ----more---- Transcript: Intro: Hello, and welcome to Insured Success, a podcast brought to you by Reed Smith's insurance recovery lawyers from around the globe. In this podcast series, we explore trends, issues, and topics of interest affecting commercial policyholders. If you have any questions about the topics discussed in this podcast, please contact our speakers at insuredsuccess@reedsmith.com. We'll be happy to assist. Adrienne: Welcome back to Insured Success. I'm Adrienne Kitchen, and I'm joined by Lisa Szymanski. Cyberattacks, including ransomware, business email compromise attacks, third-party breaches, network intrusions, inadvertent disclosures, and malware attacks are on the rise. Nearly every industry has been or could be affected, from professional and financial services to manufacturing and distribution, healthcare to education, tech to government, and non-profits and retail to energy. And experts believe this trend will only continue. Lisa: The cyber threat landscape is quickly evolving, creating new and unique risks. Data and privacy breaches are disruptive, expensive, and embarrassing, and many lead to litigation. Malicious attacks are on the rise. So it's a question of when, not if, a business will suffer a data breach. Adrienne: That's right, Lisa. And most states, including D.C. And the U.S. minor outlying islands, have data breach notification statutes. A handful of states have statutes mandating methods by which businesses must secure data. The federal government also has enacted several statutes and regulations addressing data privacy and security in different realms, from health to finances and government to family. Lisa: With respect to insurance, traditional insurance like commercial general liability policies typically exclude losses arising from a data breach. However, other policies like employment practices liability policies, directors and officers policies, errors and omissions, and even property policies may provide some cover. This is because security breaches may give rise to claims against management, commercial crime policies may cover certain direct losses, and computer fraud and property policies may provide cover for damage to types of electronic data. Adrienne: An often overlooked, unpurchased, optional feature of some cyber policies is system failure insurance, which is usually triggered by an unplanned outage of a computer system resulting from operator error, erroneous updates of software, or a similar unintentionally damaging maintenance of computer systems. Another often overlooked aspect of cyber policy is customer attrition, which provides cover for lost profits due to a residual loss of customers following a service interruption. Lisa: Data security and privacy liability policies may be placed as standalone policies, or coverage sections in package policies, or endorsements to traditional liability policies. All of this cover is relatively new, so the forms vary significantly and are always evolving. Data security and privacy liability insurance is negotiable, and policyholders should compare the policies and try to obtain bespoke coverage whenever possible. Generally speaking, data security and privacy liability policies may cover several risks, including, for example, misappropriation of private information, unintentional disclosure of private information leading to a risk of or actual identity theft, failure to protect confidential information from misappropriation or disclosure, failure to disclose or notify victims of a breach incident, violations of federal, state, local, or foreign laws governing data protection and privacy, including certain regulatory actions, as well as business interruption. Adrienne: Data security and privacy liability policies may also cover certain costs incurred when a business responds to, investigates, or remedies a breach. This includes things like breach notification costs, attorney's fees for legal assistance from privacy counsel following the breach. Sometimes these are called breach coaches, the costs of a forensic examiner. Various other response costs like maintenance of a system for those affected to communicate with the company. Remedial measures like credit monitoring and expense reimbursement may also cover defense and claims administration costs, damages, and consumer redress fund payments. It also may cover business interruption costs to hire communications professionals to address the effects of negative publicity so the company can maintain goodwill, and other costs like replacing or restoring electronic information, extortion payments, and criminal rewards. Lisa: Data security and privacy liability policies typically contain a number of exclusions, and I'd like to highlight a few of those for you. These include intellectual property violations, products liability, violations of anti-spam, blast facts, and similar laws, misconduct committed by senior management, infrastructure failures, inability to use, the performance of, development of, expiration of, or withdrawal of support of certain tech products and software, and content created by third parties. Adrienne: Right. And as mentioned, cyber insurance is vital. It's also vital to check your kidnap, ransom, and extortion policies. They may cover things like ransomware attacks, although you want to take a look at your policy language because that is becoming less the norm, but the older policies do, and some may still. Cyber and KRE policies may cover the costs of independent forensic analysts, independent consultants, lawyers, and others, either expressly or as part of the loss mitigation coverage. Importantly, many policies have pre-approved vendors and counsel that must be used or require that the insurer give consent before the policyholder retains any vendors or counsel. Lisa: Publicity costs may also be covered, and this is particularly important because reputational harm may be one of the largest damages to a corporation following a cyber attack. Adrienne, maybe you could talk about steps that policyholders can take before and after the breach to help protect their business. Adrienne: Before the breach, selecting the right policy and the application process are crucial. You have to consider all possible areas of exposure and ensure your business has enough coverage for its risks. Cyberattacks are costly and can shut down a business completely if networks and computers are unusable, if the business cannot afford recovery costs, faces third-party liability, or cannot survive any temporary loss in income. Costs can vary and rise very quickly following a cyber attack. So it's vital to fully assess all potential exposures that your business might face and ensure you have adequate coverage, including for things like business interruption, ransomware payments, third-party liability, data recovery costs, legal fees, PR, and payment to customers. In determining what losses are likely, businesses should consider things like potential damages, including loss of a computer system or the data within. A business shutdown, potential fines and penalties, reputational damage, and things like theft and extortion. It's also really important to keep your IT security officers and the stewards of the IT systems in the loop when completing cyber insurance applications. Cyber insurance applications increasingly focus on cybersecurity infrastructure and controls, and an inadvertent error in an application may be used as a basis to deny coverage. So it is crucial to consult the people with the most information about your business's IT systems and keep them closely involved with the application process. Lisa: It's also crucial to understand your company's specific risks and exposures. For first-party costs, where the company is hacked or is subject to a ransomware attack, look for coverage for notification and credit monitoring expenses if your customer's personal information could be stolen in a data breach. These expenses add up quickly. Some policies cover credit monitoring and identity theft protection services for customers as well. With respect to third-party costs, look for liability costs associated with a breach of personally identifiable information. Also look for coverage for lost business income and extra expense due to a cyber attack, including express coverage for mitigation costs, particularly if you use your own IT and cybersecurity salaried employees to respond to an attack, to the extent they are working to respond to and recover from a cyber attack. It is also important to look for defense costs in the event your business is sued following a breach. Adrienne: Exactly. It's also important to consider obtaining coverage for employee or vendor acts. Insurers may decline claims if an employee or vendor with access to your data was at fault. Look for policies that include coverage for these kinds of incidents. Some policies bar coverage for rogue active employees but will cover the negligent active employees. This issue is increasingly important given the rise of social engineering fraud. Also be aware of sublimits that may leave your business without sufficient coverage following a social engineering fraud loss. Lisa: Another thing you should do is consider obtaining retroactive coverage. The reason for this is because breaches can occur months before they are discovered. Consider whether your business would benefit from retroactive coverage of breaches that occur before the