Management & Cyber Liability Insurance

Background: An employee sent an email out to the customer database letting them know about a special sale available to them. Instead of attaching a copy of the flyer they accidentally attached a spreadsheet containing customers’ personal details.

Policy Response: First Party and Third Party Costs

Outcome: The First Party and Third Party Costs sections of the policy responded with $250,000 paid for:

• Notification costs and credit monitoring services for all affected customers

Legal costs and expenses associated with settling the legal proceedings initiated by some customers

Background: A retailer emailed a group of customers to promote a sale with special discounts available to them. The retailer intended to attach a copy of the flyer detailing the discounts but instead attached a copy of a spreadsheet that contained a customer list, including customer names, addresses and credit card information.

Result: The retailer was required to notify all affected customers of the error and offered credit monitoring services. Several of the affected individuals began legal proceedings against the retailer. The notification and credit monitoring costs totaled $50,000, and the amount to settle the legal proceedings with the retailer’s customers combined with the associated legal costs and expenses totaled $100,000.

Solution: A Cyber Insurance Policy provides coverage for breach of privacy which includes legal costs, indemnification of third parties and crisis management costs.

Background: A company accountant of a local manufacturing firm received an email from her boss asking her to transfer $120,000 to a supplier abroad. Because this was a common type of request, she processed the payment before realising that the tone of the email wasn’t right and the domain name was a single letter off. Upon further investigation, it was found that cyber thieves had infiltrated their systems and grew knowledgeable enough about company dealings to send a convincing phishing email that lost the company thousands of dollars.

Result: The company lost the $120,000 and incurred costs to secure their IT system.

Solution: A Cyber policy provides coverage for the loss of money caused by phishing scams and the costs to secure IT systems.

Background: An IT company misplaced multiple drives that contained personal information for over one million customers. It was unknown whether the drives were lost, stolen or destroyed. The IT company was required to notify the affected individuals, as well as the privacy regulator. The regulator conducted an investigation into the incident and fined the company for failing to have appropriate safeguards in place to protect customer information.

Result: The company incurred legal fees of $1,000,000 in connection with the regulatory investigation and defending legal actions brought by affected customers and for the costs and expenses in notifying customers their personal information had been lost, stolen or destroyed. The company was also fined $75,000 by the privacy regulator. The total loss to the company exceeded $5,000,000.

Solution: This type of scenario triggers multiple Insuring Clauses under a Cyber policy including privacy fines and investigations.

Background: A hotel started a blog to convey information to customers and the public. The blog page contained a logo/image that was similar to a design that had been copyrighted by another entity. That entity sent a letter demanding the company remove the image. Negotiations between the parties failed and the other entity began legal proceedings against the hotel.

Result: The entity (plaintiff) demanded more than $5 million in damages. Defence costs and expenses incurred so far exceeds $1 million, and the case has not yet gone to trial, so it’s expected these costs will increase.

Solution: A Cyber policy provides coverage for breach of copyright under the Multimedia Insuring Clause.