Cyber liability insuranceProtecting your organisation

Would your organisation recover from a cyber attack?

Cyber attacks were big news in 2015, with many high profile news stories about well known brands – and their customers – falling victim to security breaches. But what is not so well publicised is the number of attacks on smaller organisations. According to figures in the Information Security Breaches Survey 2015 – a report commissioned by HM Government – 74 per cent of small businesses suffered a security breach in 2015. That’s an increase of 14 per cent on the previous year.

Unfortunately, it’s smaller organisations that more often don’t have the financial resources to recover from an attack, making it arguably one of the greatest risks of 2016.

Over

records are now exposed every time a UK business suffers a data breach.*

is the average number of days a business can be out of action following a cyber attack.*

lucasfettes.co.uk

Last year, 74% of small organisations suffered a data security breach.* Don’t add your name to the list this year.

days10

is the average cost to a small business of its worst security breach of the year.*

£75k – £311k

23,000

What insurance covers are available?

There are a number of ways in which your organisation could be exposed – but there are covers available to mitigate the risk, for example:

Multimedia liability

Covers the insured company for claims against them of defamation, libel and slander, and unintentional infringement of intellectual property rights such as copyright, plagiarism or piracy.

Example claim:

Easy Group sought compensation from sixty separate companies who had the word “easy” in their registered internet domain name. In one specific case Easy Group took legal action against easypeople.co.uk and demanded that they pay the fee of £100,000 for its legal costs in pursuing the matter.

Network security and privacy liability

Covers the liability of the insured company should they fail to prevent the transmission of a virus, or a denial of service attack to a client’s network, or destroy data that has been entrusted to them by a third party, or fail to prevent the unauthorised disclosure of confidential information.

Example claims:

A supermarket’s point of sales system was hit by external malware, disabling communication between the registers and the inventory machine. The supermarket ran out of stock and had to close until the till system was fixed and stock replenished.

A multinational insurance company was punished by a multimillion-pound fine by the UK’s regulator when it lost a backup tape containing the private details of over 46,000 policyholders.

An employee’s laptop or USB flash drive is stolen containing your customers’ information.

Privacy notification costs

Covers the legal costs, including postage and advertising, incurred by the insured company in notifying its customers that a network or privacy breach has occurred, potentially compromising customer data.

Note:

Whilst data breach notification laws do not currently exist here in the UK other than for communication service providers, it is important to consider that companies doing business in the USA (and certain countries within Europe) should be aware of state legislation that requires companies to notify individuals of security breaches involving personally identifiable information.

Credit assistance expenses

Covers fees incurred by the insured company in the procurement of professional credit monitoring services or identity theft assistance for individuals affected by a network or privacy breach.

Example claim:

A business services company conducted a mailing project for a customer and inadvertently mailed out approximately 60,000 envelopes bearing account numbers on the outside. It claimed £220,000 for notification and credit monitoring services.

Crisis management expenses

Covers expenses incurred by the insured company for professional fees in relation to legal advice concerning a media strategy, crisis consulting and independent public relations services following a breach.

Example claim:

An investment adviser’s chief customer service officer had his laptop stolen. The laptop contained more than 100,000 customer records, including social security numbers. Costs for hiring a public relations firm to restore customer confidence or mitigate negative publicity generated by the incident were £75,000.

Forensic expenses

Covers fees incurred by the insured company for specialist forensic auditors or investigators who have been retained to conduct a review or audit to substantiate how the breach occurred.

Example claim:

A travel agency with four locations, £650,000 turnover and 30 staff, experienced three separate data breaches over a three-year period, in which hackers gained access to their computer system. Over 250,000 individuals’ credit card and passport details were compromised. £1.2m was paid for the forensic and legal costs in defending the investigation.

Electronic data rectification expenses

Covers all reasonable costs and expenses incurred to repair or restore the insured’s computer system to the same or equivalent standard as immediately before it was damaged or destroyed by a network security breach.

Example claim:

A manufacturer had a disgruntled employee delete their entire database. It cost the company £5m in lost revenues and £1.3m to replace the lost data.

Cyber extortion

Covers the insured company for extortion demands where there is a credible threat to destroy the insured’s computer system or website, or a threat to introduce a malicious code or a denial of service attack.

Example claim:

A law firm with a turnover of £1.3m and eight staff had its server and client records locked by Ransomware software. It was only able to get the files released after paying a ransom of £50,000 to hackers.

Lucas Fettes & Partners Limited are independent insurance intermediaries authorised and regulated by the Financial Conduct Authority. *2015 Information Security Breaches Survey, HM Government. 43/16 GM004

Talk to usAs an independent insurance broker we have access to over 300 insurers and will arrange cover based entirely on your needs and budget. We can also provide impartial advice and guidance on a range of risk management measures. To find out more, please speak to your usual Lucas Fettes & Partners contact or your local office.

BerkhamstedT: 01442 866670E: berkhamsted@lucasfettes.co.uk

BristolT: 0117 989 8300E: bristol@lucasfettes.co.uk

ChichesterT: 01243 530450E: chichester@lucasfettes.co.uk

GlasgowT: 0141 248 1620E: glasgow@lucasfettes.co.uk

LondonT: 020 7413 0999E: london@lucasfettes.co.uk

ManchesterT: 0161 973 9101E: manchester@lucasfettes.co.uk

Newport, Isle of WightT: 01983 522577E: newport@lucasfettes.co.uk

Cyber business interruption

Covers the insured company for loss of business income directly following a network security breach that results in a total or partial interruption to the insured’s computer system.

Example claim:

An online retailer with a turnover of £3m and 15 staff had its website defaced, including a link to a competing retailer’s website. Hackers then gained access to personal information about customers and took over their website. £500,000 was paid for loss of income and other related costs.

PCI fines and penalties

Covers the insured company for Payment Card Industry (PCI) fines or penalties arising from a network or privacy breach due to the insured’s non-compliance with Payment Card Industry Data Security Standards.

Note:

Since 2005 more than 80% of credit card breaches have occurred at small businesses. Failure to comply with Payment Card Industry Data Security Standards (PCI DSS) could result in fines of up to £50,000 per infringement.