Three Ways a New SEC Rule Increases Risk for Public Companies

The SEC will soon tighten the deadline to disclose material data breaches, applying more pressure and scrutiny to organizations and their boards.

Closeup of a person using a laptop in a darkened room

Cybersecurity exposure is about to get even more dangerous for public companies.

In late July, the Securities and Exchange Commission approved a new rule that requires publicly traded companies to report any data or cybersecurity breach within four days of determining the incident’s materiality.

“Cyber incidents are still incredibly frequent. Ransomware events continue to creep up and become more and more expensive. And public companies now have a very real exposure in respect to this new SEC rule,” said Ray Ash, EVP and head of management liability, Westfield Specialty Insurance.

There are few ways the new rule presents heightened risk to companies:

1) Determination of “Materiality”

The determination of materiality itself is uncharted territory. Some cases will be obvious. Theft of social security numbers or bank account information, for example, is clearly material. Other events might not be so clear-cut. As the SEC hasn’t offered definitive criteria for a “material” breach, this definition will likely be shaped by the courts.

“The crux of materiality is really going to be tested by the plaintiff’s bar in court,” Ash said.

“We saw a similar situation 10-plus years ago out of the Dodd-Frank Act, which gave shareholders the opportunity to vote on executive compensation practices. The vote was nonbinding and suggested to have no legal recourse, but that didn’t stop the plaintiff’s bar from testing it. All suits filed in regard to executive pay were dismissed in the end, but they nonetheless incurred defense costs, which ultimately get passed on to insurance companies.

“I think we will see the same here. Regardless of whether plaintiffs win their cases, they will still drive up legal costs. Until we really get a feel for how companies are responding in the event of a breach and determining materiality, it definitely is a new front in the D&O world,” he said.

2) A Challenging Timeframe

A four-day turnaround time will be very tight for most companies. Meeting such a quick deadline turns up the pressure to a degree that some boards of directors and cybersecurity teams are simply not prepared to face.

Ray Ash, EVP and head of management liability, Westfield Specialty Insurance

“Even in the most high-profile breaches where PII [personal identifiable information] was stolen — social security numbers, passport numbers — even those companies took months to disclose the incident,” Ash said.

Equifax, for example, took roughly two months to announce a data breach after it was discovered. The breach that took place from mid-May to July of 2017 was not disclosed until September 2017. Yahoo did not disclose a significant data breach until about two years after it occurred. The hack itself took place in 2014 and was not discovered immediately. Disclosure did not come until 2016.

Some of the delay can be attributed the process of uncovering exactly what and how much data was compromised. Companies may want to ensure the breach is contained and a remediation plan is in place before disclosing an incident. Sometimes, law enforcement requests that breaches not be publicly disclosed while investigations are underway.

In any case, a four-day window will force companies to direct more time and resources to the identification and containment of a breach.

3) Stock Hits and Shareholder Suits

Stricter regulation will also increase the downstream risk of private shareholder lawsuits that can stem from noncompliance. SEC action on top of the breach itself could cause share prices to drop, potentially triggering a wave of litigation. Equifax, for example, saw its stock price fall more than 30% after its breach disclosure. The private class action suits that followed cost just under $150 million.

“You have that additional layer of exposure when you have public shareholders, and there is a microsecond-by-microsecond valuation of a company based on its current news. In terms of D&O claims, the SEC exposures, while severe, generally have not been tower-burners. It is the knock-on effect of the private security class actions. That’s where losses jump into the tens of millions. And the plaintiff’s bar does a good job of finding shareholders that support lawsuits,” Ash said.

Uncertain Impact

It’s not yet clear just how severely the new SEC rule will impact public companies’ risk profiles — or shape their risk mitigation strategies. Will companies be quick to report any breach, big or small, out of fear that the jury will not agree with its determination of materiality? Is it worth the extra effort and cost to disclose first and investigate later?

“No one knows where this is ultimately going to go. Maybe it will become similar to the excessive compensation environment of 10 years ago, which turned out to be a lot of sound and fury that ultimately amounted to nothing. Or it could be a new front in the world where everything is securities fraud, which only exacerbates the event-driven litigation concept,” Ash said.

“In some of the high-profile breaches, the suits that followed were prime examples of event-driven litigation. Some turned out to be severe, some did not. But in our current world of cybersecurity threats, this rule has the potential to really reshape the severity — and certainly the frequency — of shareholder class actions.”

Risk Mitigation

What should public companies do to prepare for the implementation of this new rule and reduce their exposure to regulatory action and subsequent shareholder suits?

“The good news is that cybersecurity has been a topic at the forefront of organizations’ enterprise risk management strategies for years. So, the idea of hiring a CISO or CIO — someone in charge of cybersecurity and data management — the framework already exists,” Ash said. “It will likely have to be built out more to support what the SEC is asking for.”

Cybersecurity staff might typically report to the board of directors and executive team quarterly, but now it may be prudent to build a special committee within the board itself that is dedicated to cyber security risk mitigation, breach identification and reporting. Engaging outside counsel early to help establish this framework is also likely worth the investment.

“The more effort you can put into strong governance practices now will really pay off in the future, as far as your ability to respond to a breach and defend from private action,” Ash said. “Prevention is the best practice here. Bolstering good corporate governance is always going to be the best defense.” &

The R&I Editorial Team can be reached at [email protected].

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

By: Risk & Insurance | April 3, 2024

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.