Sponsored: AXA XL

These Five Emerging Cyber Threats May Be Creating Gaps in Your Coverage

As cyber risks intertwine with property, fidelity, professional liability and reputation exposures, comprehensive insurance coverage and services become paramount.
By: | July 30, 2018

Cyber risk continues to be the amorphous and seemingly indefensible threat facing businesses of all types and sizes, and insurers are continually tailoring their policies to respond to the changing environment. Making the challenge more difficult is the fact that cyber no longer is constrained to breaches of network security that imperil private information.

Cyber threats now intermingle with other types of exposure, like employee theft and professional liability, and can cause a broader spectrum of loss including property and reputation damage.

“We’re seeing a change now where the malicious actors aren’t just hacking networks to steal information; they’re reaching out from the digital world to cause different types of damage,” said Elissa Doroff, vice president, underwriting and product manager, AXA XL, a division of AXA.

As cyber becomes the root case of various types of tangible damage, it raises questions around what policies will be triggered by an event involving both digital and physical damage, and raises the potential for both gaps and overlaps in coverage.

Here are the top five ways cyber risk is evolving to create gray areas in existing insurance coverages:

1. Infiltration of Industrial Systems Leads to Property Damage

Hackers’ ability to breach a corporate network through various channels is nothing new. But when the intent is to cause physical harm rather than steal data, they can find their way into the industrial controls that operate a facility and wreak havoc.

In 2014, cyber criminals sent a German steel mill up in flames by speeding up the machinery until it became too hot and eventually exploded. The following year, bad actors brought down the Ukrainian power grid through similar methods.

A property policy responds to the resulting physical damages from such an incident, regardless of the cause. But the physical damages are just one piece of the attack.

The targeted organization will also have to investigate how the hackers gained access to their systems and whether they stole or altered any data in the process. The costs of a forensic investigation, restoration of data, notification and any other third-party liability exposures would not be covered under a property policy.

“A cyber policy would respond to network issues like theft of PII or use of transient malware that causes damage to a third party,” Doroff said. “And it would include the first-party coverages to remediate the network breach itself.”

Without a cyber policy, any incident of physical property damage caused by a cyber event would only be partially covered.

2. IoT and Bitcoin Amplify Ransom Risk

Elissa Doroff Vice President, Underwriting and Product Manager, AXA XL, a division of AXA.

When ransomware attacks first emerged, they weren’t significant enough to warrant large-limit cyber liability policies.

“On average, the claims didn’t exceed $50,000. You paid the ransom if you needed to. More sophisticated organizations with good backups knew that they would be safe without paying, so they could just wait for the hacker to go away,” Doroff said.

But the problem is no longer that easy to solve. The explosion of devices connected via the Internet of Things has created more access points to corporate networks.

“When workers connect with their phones outside of a VPN, it may not be bifurcated from the corporate network that has a higher level of security,” she said. “It opens the door for new strains of malware.”

The rise of bitcoin also drives up the ransom amounts sought by hackers. More thieves are asking for their payment in cryptocurrency, which continues to rise in value. This is why having a cyber insurance policy with access to the right breach response vendors is critical.

Since bitcoin is not readily ascertainable on the open market, insureds need access to forensics vendors that maintain a bitcoin wallet. When a ransom is demanded in bitcoin, the vendor can quickly respond to facilitate the transaction and the insured back to business as soon as possible.

“Cyber extortion claims are not $50,000 anymore. With the increase in bitcoin’s ubiquity and value, the cost of a ransomware attacks today can double or triple that amount,” Doroff said.

Where coverage for cyber extortion was once considered a throw-on to a cyber policy, it’s now a critical must-have. Cyber liability insurance without coverage for extortion could leave targets with insurmountable losses after an attack.

3. Social Engineering Expands Definition of Theft

Hackers have become adept at mimicking professional emails to request fraudulent transfers of funds, posing as a client or vendor, or sometimes as a senior manager making a request of a subordinate. Often, the employee tricked into sending the cash doesn’t realize the mistake until it’s too late, and both the thief and the money are long gone.

“That type of theft has created a gap in the insurance market when it comes to treatment of financial fraud,” Doroff said.

A fidelity and crime policy typically would not cover a loss stemming from a social engineering scheme because the funds ultimately were willingly transferred away, even if the employee that did so was deceived. Crime policies may only extend coverage to outright theft of money or securities.

“There has been a push in the marketplace to offer coverage for social engineering fraud within cyber policies, but most of the coverage that exists now is offered on a sub-limited basis,” Doroff said.

As cyber thieves find new ways to bilk businesses, a cyber policy with coverage for social engineering fraud in combination with a crime and fidelity policy closes the coverage gap for emerging types of theft.

4. Data Breaches Threaten Company Reputations

Plenty of high-profile breaches demonstrate how a cyber attack can cause the public to lose faith in an organization they trusted with their personal information. Target, Equifax, Yahoo and Uber are just a few examples.

“Adverse publicity will cause a loss of brand trust that negatively impacts sales, but measuring that impact is the difficult part of designing coverage,” Doroff said. Quantifying exposure is the barrier to developing coverages that adequately address the reputation risk of cyber breaches — but a few methods are emerging.

“We’ll look at a company’s sales over a six-month period after an incident and compare that to the previous year, which provides a snapshot of how much revenue they’ve lost that’s likely attributable to the cyber event,” Doroff said.

But, she added, quantifying the loss is not an exact science. Along with a comparison of sales and revenue, a more thorough financial audit conducted by forensic accountants may be needed. Each carrier will have their own preferred method for measuring reputation exposure.

Because most cyber policies on the market today don’t address this exposure at all, it’s best to work directly with underwriters up front to determine whether there is coverage for financial losses from reputation damage, and how those losses will be accounted for.

5. Storage of Sensitive Data Increases Professional Liability Risk

While theft of PII has always posed a significant threat to financial institutions, hospitals, and other organizations that house large amounts of customers’ private data, some firms previously less concerned with cyber risk are finding that they may have targets on their backs as well.

“This comes up often with professional services firms like attorneys’ offices or financial consultants,” Doroff said. “They have a duty to keep clients’ sensitive information secure. If there’s some third-party incident whereby their clients’ information gets out, they could face costly lawsuits.”

While a professional liability policy likely covers those legal expenses, it won’t cover the first-party losses related to the breach itself, including the investigation, notification and remediation expenses. For more and more firms, “It’s not sufficient to rely on your E&O coverage,” Doroff said.

Staying Ahead of the Coverage Curve

As cyber risks and responding coverages continue to evolve, companies are best served by working with a carrier at the forefront of cyber underwriting. AXA XL’s cyber and technology liability policy addresses the varying ways in which malicious hackers can infiltrate systems or otherwise cause harm.

“We built this policy based on all the endorsement requests we received from brokers, which meant changing some definitions, removing certain exclusions or broadening some insuring agreements,” Doroff said. “The result is a policy with very broad terms and conditions that is a market leader in terms of what brokers and insureds are looking for.”

Along with the policy, companies gain access to AXA XL’s breach preparedness services and vendor response panel.

“Our services include everything from training articles and videos to tabletop exercises, testing of employees’ response to phishing emails, and an 800-number manned by our claims team,” Doroff said. “Our broad vendor panel also offers several options for law, public relations and forensic firms, to help insureds recover quickly from a cyber incident — whatever shape it takes.”

To learn more, visit https://axaxl.com/insurance/insurance-coverage/professional-insurance/cyber-and-technology

SponsoredContent

BrandStudioLogo

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with AXA XL. The editorial staff of Risk & Insurance had no role in its preparation.





Advertisement

AXA XL, the property & casualty and specialty risk division of AXA, provides insurance and risk management products and services for mid-sized companies through to large multinationals, and reinsurance solutions to insurance companies globally. We partner with those who move the world forward. To learn more, visit www.axaxl.com.

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.

PART ONE: CRACKS IN THE FOUNDATION

Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.

PART TWO: BETRAYAL

As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.

PART THREE: FALLING DOMINOES

Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &

Bar-Lessons-Learned---Partner's-Content-V1b

Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.




Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]