Cyberinsurance for Financial Institutions

Transcription

1 Cyberinsurance for Financial Institutions

2 PRESENTERS Panelists Patrick Cox, CIPP/US, SVP, CPO, LPL Financial Scott Godes, Partner, Barnes and Thornburg LLP Brent Rieth, VP, Team Leader, Financial Services Group, Aon Risk Solutions

3 EVOLVING THREAT History of individual accounts Increasing internal risks Perimeter, firewalls, patching Employees and contractors Vendors (with or without network access) Increasing external and systemic exposure Non-traditional actors (different value metrics) Larger, systemic dependencies

4 CORRESPONDING CHANGES IN EXPECTATIONS Broader recognition of value for cyber-insurance People, tools and processes Staffing Prevention, Detection, Response Standards and activities Budget Regulatory guidance and notices

5 COVERAGE LITIGATION Commercial General Liability 1. Am. Economy Ins. Co. v. Aspen Way Enterprises, Inc., No. CV BLG-SPW (D. Mont. Sept. 25, 2015). 2. Recall Total Info. Mgmt., Inc. v. Fed. Ins. Co., 83 A.3d 664 (Conn. App. Ct. 2014), aff d, 317 Conn. 46 (Conn. 2015). 3. Travelers Indem. v. Portal Healthcare Solutions, LLC, 35 F. Supp. 3d 765 (E.D. Va. 2014), currently on appeal, No , (4th Cir.) 4. Zurich Am. Ins. Co. v. Sony Corp. of Am., No /2011 (N.Y. Sup. Ct. Feb. 24, 2014), settled after oral arguments on appeal. 5. Hartford Cas. v. Corcino & Assocs., 2013 WL (C.D. Cal. 2013), appeal dismissed, No (9th Cir. Apr. 30, 2014). 6. Retail Ventures v. Nat l Union, 691 F.3d 821 (6th Cir. 2012). 7. Nationwide Ins. Co. v. Hentz, 2012 WL (S.D. Ill. Mar. 6, 2012), aff d, 704 F3d 522 (7th Cir. 2013). 8. Netscape Commc ns Corp. v. Fed. Ins. Co., 343 F. App x 271, 272 (9th Cir. 2009).

6 COVERAGE LITIGATION Commercial General Liability

7 COVERAGE LITIGATION Crime 1.Retail Ventures v. Nat l Union, 691 F.3d 821 (6th Cir. 2012). 2.Universal Am. v. Nat l Union, 959 N.Y.S.2d 849 (N.Y. Sup. Ct. 2013), aff d, 972 N.Y.S.2d 241 (N.Y. App. Div. 2013) (modifying to declare rights of the parties seeking declaratory relief), aff d, 2015 N.Y. LEXIS 1434 (N.Y. June 25, 2015). 3.Apache Corp. v. Great Am. Ins. Co., No. 4:14-cv-237 (S.D. Tex. Aug. 7, 2015).

8 COVERAGE LITIGATION E&O 1.First Commonwealth Bank v. St. Paul Mercury Ins. Co., No , slip op. (W.D. Pa. Oct. 6, 2014), resolved by settlement and dismissed 2.Eyeblaster, Inc. v. Fed. Ins. Co., 613 F.3d 797 (8th Cir. 2010). D&O 1.First Bank of Del. v. Fid. & Deposit Co. of Md., 2013 WL (Del. Super. Oct. 30, 2013), reargument denied, 2013 WL (Del. Super. Dec. 4, 2013).

9 COVERAGE LITIGATION Property 1. Am. Guar. & Liab. Ins. Co. v. Ingram Micro, Inc., 2000 WL (D. Ariz. Apr. 18, 2000). 2. NMS Servs. Inc. v. The Hartford, 62 F. App x 511 (4th Cir. 2003). 3. Se. Mental Health Ctr., Inc. v. Pacific Ins. Co., 439 F. Supp. 2d 831, 837 (W.D. Tenn. 2006). 4. WMS Indus. Inc. v. Fed. Ins. Co., 384 F. App x 372 (5th Cir. 2010); WMS Indus., Inc. v. Fed. Ins. Co., 588 F. Supp. 2d 730 (S.D. Miss. 2008). 5. Vonage Holdings Corp. v. Hartford Fire Ins. Co., 2012 WL , at *3 (D.N.J. Mar. 29, 2012). 6. Landmark Am. Ins. Co. v. Gulf Coast Analytical Labs., 2012 U.S. Dist. LEXIS 45184, at *10 (M.D. La. Mar. 30, 2012). 7. Metro Brokers, Inc. v. Transportation Ins. Co., 2015 WL (11th Cir. Mar. 5, 2015).

10 COVERAGE LITIGATION 1.First Bank v. Fed. Ins. Co., No. 4:09-CV-532-TIA (E.D. Mo. May 11, 2009), resolved by settlement and dismissed, (July 26, 2010). 2.State Nat l Ins. Co. v. Global Payments, Inc., No. 1:13-cv CAP (N.D. Ga. Apr. 12, 2013), resolved by settlement and dismissed, (Jan. 10, 2014). 3.Travelers Prop. & Cas. Co. v. Fed. Recovery Servs., Inc., No. 2:14-cv-170 TS (D. Utah May 11, 2015). 4.Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv (C.D. Cal. May 7, 2015).

11 TIPS FOR EVALUATING INSURANCE FOR CYBER RISKS

12 LARGE DATA INCIDENTS Date Made Public July 2016 April 2015 February 2015 Incident Ashley Madison 37 million users of an extra-marital online dating site were breached. The personal details of the users were stolen and have been disclosed publicly, along with the company s financials, by the hacking group The Impact Team. Sony The data dump of over 100 Terabytes of data included employee criminal background checks, salary negotiations, and doctors letters explaining the medical rationale for leaves of absence. Spreadsheets containing the salaries of 6,800 global employees, along with Social Security numbers for 3,500 U.S. staff were lost. Anthem Names, dates of birth, member identification numbers, addresses, phone numbers, addresses, and employment identification numbers were stolen from the Anthem network. Anthem reported that up to 80,000,000 individuals were impacted by the incident October 2014 September 2014 Staples Similar to the attack on Michaels Stores, cyber criminals succeeded in stealing customer card data from a subset of Staples locations. Multiple banks received alerts from Visa and MasterCard about unusual activity on the cards impacted in the breach. The supposed attack occurred between July and September Home Depot Home Depot reported a massive breach of 56M customers who had financial information compromised in an intrusion first reported in April of The attack compromised the financial details of customers who shopped at 2,666 stores in the US and Canada. The hackers compromised 53M addresses, as well. Home Depot is facing 44 civil lawsuits as a result of the breach. January 2014 December 2013 Neiman Marcus A customer information database was hacked near the same time as the Target breach. Only retail shoppers were affected and it was reported to be approximately 1.1M individuals. It was confirmed that payment cards of customers were fraudulently used after malware was installed on terminals in the Neiman Marcus stores. Target Corp. Attackers leveraged access to Target s network through a third party, where they were able to penetrate the company's Point of Sale (POS) systems. The total number of affected individuals totaled 110M. Months after the CEO resigned, it was reported that the breach would ultimately cost it s shareholders $148M. *Source: privacyrightsclea ring house.com

13 CYBER FACTS AND FIGURES Root Causes of a Data Breach Average Cost of a Data Breach U.S. Data Average Cost Per U.S. Data Breach Event Average Cost per Compromised Record % Caused by Malicious Attacks 2014 $6.53M $217 47% 2013 $5.85M $201 44% 2012 $5.4M $188 41% 2011 $5.5M $194 37% 2010 $7.2M $214 31% 2009 $6.8M $204 24% 2008 $6.7M $202 12% 2007 $6.3M $197 Not tracked Source: Ponemon Institute s 2015 Global Cost of a Data Breach (May 2015) Source: Ponemon Institute s 2015 Global Cost of a Data Breach (May 2015)

14 Q Cyber Marketplace Overview Loss Ratios for large risks went from ~40% to >100% for many insurers from Many insurers in high excess layers were receiving <$6,000 per million in limit, prior to Q3 2014, paid limit losses on multiple risks. Larger insurers in the Cyber product space incurred multiple limit losses, aggregating to over $200M in loss within 12 months. Insurers reconstructed underwriting procedures and portfolio management strategies. $80, Average PPM by Industry $70, $60, $50, $40, $30, $20, $10, $ (1Q) Financial Institutions Healthcare Retail Technology 14

15 NETWORK SECURITY & PRIVACY LIABILITY MARKET UPDATE Capacity Coverage Claims & Losses Retentions Pricing Capacity for Cyber coverage continues to grow both domestically and abroad - There are approximately unique markets that can provide Cyber capacity, with new entrants each year - Markets exist domestically (primary and excess), the UK (primary and excess) and Bermuda (excess only) - Of the available markets, there continue to be 7-9 Tier I markets Coverage continues to expand in both breadth and limit availability - Carriers continue to differentiate their offerings with new /enhanced coverage components (Goodwill Coupon, Breach Response Services, PCI Coverage, etc.) - Breach mitigation coverages continue to expand to meet clients needs, including higher limits of coverage and the availability of coverage through a tower Stronger data is being gathered as more breaches are reported - There continue to be a numerous breaches reported with additional reports tracking costs of the breaches - Policies are responding, particularly to the breach mitigation, allowing better tracking of claims payments Retentions remain stable and varied - Retentions of all levels are available in the market, but vary based on industry class, revenue and unique exposures - Adjusting retentions can lead to more coverage/sublimit flexibility Pricing continues to trend upwards - Pricing continues to rise in the wake of significant breaches, particularly in the affected industries - Renewal premiums continue to increase between 15 25% for insureds with no change in exposure profile

16 QUESTIONS? Patrick Cox, CIPP/US SVP, CPO LPL Financial Scott Godes Partner Barnes and Thornburg LLP Brent Rieth VP, Team Leader, Financial Services Group Aon Risk Solutions