Does Your Business Insurance Cover Cyberattacks?

For many U.S. businesses, data breaches are inevitable. So while prevention is still important, it also pays to be prepared for the aftermath.

For those companies hoping to rely on commercial general liability (CGL) policies, it’s likely time to think again. While older policies were unclear regarding whether coverage existed for cyberattacks and data breaches, insurance companies are increasingly including policy language that expressly excludes these types of losses.

For example, the CGL policies issued by Insurance Services Office, Inc., which provides the form contracts used by many insurance providers, now contain exclusions for cyberattacks and other forms of data breaches. One such provision disclaims coverage for damages related to “access to or disclosure of any person’s or organization’s confidential information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information.”

While cyber insurance policies were once reserved for billion-dollar companies operating in high-risk industries, one in three businesses now carries insurance intended to cover data breach losses. According to New York insurance brokerage firm Marsh, LLC, the sale of cyber insurance polices increased 20 percent in 2013. The high-profile Target breach also convinced many companies that were debating such policies to take action.

As we have previously highlighted on this Business Law Blog, the costs of data breaches are skyrocketing. Ponemon Institute’s 2014 Cost of Data Breach Study found that the average cost of a data breach was $3.5 million last year, representing a 15 percent increase over 2012 figures. Accordingly, having insurance coverage to cover the costs of providing credit monitoring, defending potential lawsuits, and hiring crisis management professionals can be extremely valuable. Therefore, if your business currently relies exclusively on a CGL policy to provide comprehensive risk management, it may be time to explore your other options.

Part of my practice covers protecting businesses from pitfalls in their insurance coverage. Our firm also has a Cyber Security and Data Protection group, chaired by Partner, Fernando Pinguelo. If you have any questions about this post or would like to discuss your company’s insurance coverage, please contact me, Charles Yuen, or the Scarinci Hollenbeck attorney with whom you work.