Insight

Cyber Coverage Pitfalls

Institutional data breaches are, unfortunately, more common (and more costly) than ever. Cybersecurity insurance can help—but is your firm’s policy really as ironclad as you think?

Digital lock shatters into pieces
RW

Robert W. Wilkins

November 2, 2022 04:00 PM

An oft-repeated mantra in business and technology is that it’s not a question of if a data breach will happen, but when. The average cost of a corporate data breach in the United States is nearly $9.5 million, according to an IBM report published in 2022. Without adequate cybersecurity insurance, companies (and law firms) might find themselves facing a double threat: being the victim of a breach and then having to contend with the denial of their cyber insurance claim. This article addresses the risks of failing to implement and follow all of the policies and procedures required by the cyber insurance policy.

Given the exponential growth in breaches and their high costs, insurance providers are raising premiums and increasingly investigating whether the practices, as represented by the insured when it applied for coverage at the outset, were implemented and regularly tested and updated as needed. Failure to do so has resulted, and will continue to result, in denial of coverage.

The Expanding Litigation Threat

The biggest risk of this kind that businesses face is not from individual plaintiffs asserting damages from a data breach—it’s a class action brought on behalf of all those similarly situated. In the past, Article III standing cases have generally held that plaintiffs could not establish the requisite “injury in fact” based on the mere risk of future harm because their personally identifiable information or protected health information was exposed.

For years, class-action data breach cases have foundered on that basis. However, a growing body of case law provides guidance on what constitutes “concrete harm,” and the number of class-action cases finding a concrete injury is on the rise. For a good summary of the law on this critical issue, see TransUnion LLC v. Ramirez (2021) and Hunstein v. Preferred Collection and Management Services, Inc. (2022).

Loss of Insurance Coverage

Recent reports have shown that an insured party’s perception of its security versus reality often differ greatly. One of the biggest reasons for coverage denial concerns misrepresentations in the company’s application and/or the failure to maintain security practices amid the ever-changing threat environment. Most cyber insurance policies provide broad coverage for cyber extortion, data restoration, public relations, computer fraud, business interruption, regulatory compliance and related elements. However, the coverage under a policy depends on the representations the insured made in its application, and its subsequent compliance with them.

A typical application for cybersecurity insurance will contain a privacy and security liability questionnaire, as well as a portion about information security. Key items insurance providers require for such policies, according to an August 2022 FitchRatings report, include the use of multifactor authentication, employee training on phishing and other types of cyberattacks, strength-of-password requirements, regulatory reporting obligations, an assessment of the quality of one’s incident-response plan and penetration testing. In addition, all 50 states have data-breach notification laws, and law firms or clients must comply with the requirements of each state in which they do business.

Companies must regularly monitor, update and test all cybersecurity requirements mandated in their policy.”

The hole in the cyber insurance net stems from the insured’s potential misrepresentations in its application and its failure to adjust to the changes in the methods by which bad actors gain illegal access to data. Recently, one insured business that suffered an enormous data breach was denied coverage and had its policy rescinded. See Travelers Property Casualty Company v. International Control Services, Inc. (2022).

Travelers’ success was based on the fact that International Control Services, in its policy application, stated (and signed a separate attestation) that it required multifactor authentication to gain administrative access to its data. Upon investigation, Travelers determined that ICS misrepresented the scope of its authentication process, resulting in the breach.

A business’s failure to follow the policies and procedures claimed in its application is dire. In fact, most insurance policies have a specific exclusion that precludes coverage for claims arising from the policyholder’s failure to maintain adequate security standards. Companies must regularly monitor, update and test all cybersecurity requirements mandated in their policy. The same is true for policies regarding cyber extortion and ransomware attacks.

It’s not just insurance companies that require businesses to have solid procedures and policies to prevent and contain data breaches. Banks, corporate clients and a multitude of others require similar assurances from law firms they deal with that the firms have, comply with and regularly test, update and monitor a written information-security policy and incident-response plan.

Takeaways

The increase in data breaches, the costs resulting from them (which can include potential criminal and regulatory liability), the representations required by clients and insurance companies and the need to meet constantly changing threats in this data-driven age demand that law firms and their clients implement and closely monitor cybersecurity policies and practices. To that end:

  • Read your cybersecurity insurance policy application and representations to confirm each representation is accurate.
  • Update your policies and practices to stay on top of changes and innovations in data security.
  • Train and test your employees in data security practices and potential breaches, especially phishing schemes.
  • Keep an open line of communication with your insurance provider and follow its recommendations regarding cybersecurity.
  • Consider having an outside vendor run penetration tests of your data security systems.

The bottom line: Breaches may be inevitable, but diligence and preparation can mitigate both their financial and reputational impact.

Robert W. Wilkins, a Jones Foster shareholder, and the Litigation & Dispute Resolution Practice Group Chair, is double Board Certified by The Florida Bar in the areas of Business Litigation and Civil Trial. He is Co-Chair of the E-Discovery Subcommittee and the Data Security Subcommittee of the ABA Litigation Sections’ Commercial and Business Litigation Committee. He is also an active member of The Sedona Conference Working Group 1, Electronic Document Retention and Production and Working Group 11, Data Security and Privacy Liability.

Headline Image: istock/TU IS

Related Articles

Connecticut Attorney General Releases Status Update on Data Privacy Act


by Gregory Sirico

Connecticut's attorney general recently released a report on the current status of the Data Privacy Act, focusing in on some keys areas of enforcement.

Animated woman's face with code scattered everywhere

Colorado Attorney General Calls For Cannabis Reclassification


by Gregory Sirico

In this article, Best Lawyers highlights a recent call to action by the Colorado state attorney general, requesting a full drug reclassification of cannabis.

Cannabis buds sitting on a checkerboard tabletop

The U.S. Best Lawyers Voting Season Is Open


by Best Lawyers

The voting season for the 31st edition of The Best Lawyers in America® and the 5th edition of Best Lawyers: Ones to Watch® in America is officially underway, and we are offering some helpful advice to this year’s voters.

Golden figures of people standing on blue surface connected by white lines

IN PARTNERSHIP

Does Your Law Firm Need a COO?


by Esquire Bank

Esquire Bank explains how having a chief operating officer can help with law firm growth plans, business management, client acquisition and daily operations.

Does Your Law Firm Need a COO?

IN PARTNERSHIP

Contingency Fee Law Firm Valuation: What Factors Matter for Financing?


by Esquire Bank

Esquire Bank offers information on the valuation of a contingency law firm and the financing options they offer to support law firm growth strategies.

What Factors Matter for Law Firm Financing

IN PARTNERSHIP

The No-Stress Way to Efficiently Fund a Law Firm


by Esquire Bank

Esquire Bank explains how many lawyers who are starting their own firms can identify a strategic banking partner to offset the difficulties of self-funding.

The No-Stress Way to Efficiently Fund a Law Firm

IN PARTNERSHIP

How to Easily Acquire Smart Financing for Sustainable Law Firm Growth


by Esquire Bank

Esquire Bank explains what private equity is and why many private equity firms are finding it more advantageous over more traditional forms of financing.

Esquire Banks Guide to Financing for Sustainable Firm Growth

The Best Lawyers in Mexico Celebrates a Milestone Year


by Best Lawyers

Best Lawyers is excited to announce the 15th edition of The Best Lawyers in Mexico™ and the second edition of Best Lawyers: Ones to Watch in Mexico™ for 2024.

Sky view of Mexico city scape

Best Lawyers Expands 2024 Brazilian Awards


by Best Lawyers

Best Lawyers is honored to announce the 14th edition of The Best Lawyers in Brazil™ and the first edition of Best Lawyers: Ones to Watch in Brazil™.

Image of Brazil city and water from sky

IN PARTNERSHIP

How Private Equity Investment is Disrupting the Legal Industry


by Esquire Bank

Private Equity loans are changing how law firms operate, but these funding options should not affect the profession's ethical standards or the best interests of the clients.

Four Hands Taking Pieces Out of a White Pie Graph

The 2024 Best Lawyers in Spain™


by Best Lawyers

Best Lawyers is honored to announce the 16th edition of The Best Lawyers in Spain™ and the third edition of Best Lawyers: Ones to Watch in Spain™ for 2024.

Tall buildings and rushing traffic against clouds and sun in sky

The Best Lawyers in Portugal™ 2024


by Best Lawyers

The 2024 awards for Portugal include the 14th edition of The Best Lawyers in Portugal™ and 2nd edition of Best Lawyers: Ones to Watch in Portugal™.

City and beach with green water and blue sky

Announcing The Best Lawyers in South Africa™ 2024


by Best Lawyers

Best Lawyers is excited to announce the landmark 15th edition of The Best Lawyers in South Africa™ for 2024, including the exclusive "Law Firm of the Year" awards.

Sky view of South Africa town and waterways

Violating the Victim


by Megan Bishop and Thomas R. Ward

Two criminal law lawyers from Colorado detail the confounding ways in which prosecutors violate the victim in domestic violence cases.

Cartoon of woman in blue shirt and hair covering her face

IN PARTNERSHIP

Circuit Split: Can Federal Courts Award Lost Profits as Part of a Restitution Order?


by Nicholas Oleski

The Sixth Circuit has ruled against awarding lost profits as restitution to a business forced to close due to a robbery, highlighting a growing circuit split on whether lost profits can be included in restitution orders under the Mandatory Victims Restitution Act (MVRA).

Red shop doors with glass broken open

IN PARTNERSHIP

Where’s My Apology Letter? Client Control and Expectations Regarding Representation


by Joseph S. Passanise and Taylon Sumners

Through every interaction with clients, lawyers can practice effective client management, utilizing clear communication, transparency and diligence.

Professional men and women sitting around a table shaking hands and making business deals

Trending Articles

The 2024 Best Lawyers in Spain™


by Best Lawyers

Best Lawyers is honored to announce the 16th edition of The Best Lawyers in Spain™ and the third edition of Best Lawyers: Ones to Watch in Spain™ for 2024.

Tall buildings and rushing traffic against clouds and sun in sky

Best Lawyers Expands Chilean 2024 Awards


by Best Lawyers

Best Lawyers is pleased to announce the 14th edition of The Best Lawyers in Chile™ and the inaugural edition of Best Lawyers: Ones to Watch in Chile™, honoring the top lawyers and firms conferred on by their Chilean peers.

Landscape of city in Chile

Best Lawyers Expands 2024 Brazilian Awards


by Best Lawyers

Best Lawyers is honored to announce the 14th edition of The Best Lawyers in Brazil™ and the first edition of Best Lawyers: Ones to Watch in Brazil™.

Image of Brazil city and water from sky

Announcing The Best Lawyers in South Africa™ 2024


by Best Lawyers

Best Lawyers is excited to announce the landmark 15th edition of The Best Lawyers in South Africa™ for 2024, including the exclusive "Law Firm of the Year" awards.

Sky view of South Africa town and waterways

The Best Lawyers in Mexico Celebrates a Milestone Year


by Best Lawyers

Best Lawyers is excited to announce the 15th edition of The Best Lawyers in Mexico™ and the second edition of Best Lawyers: Ones to Watch in Mexico™ for 2024.

Sky view of Mexico city scape

How Palworld Is Testing the Limits of Nintendo’s Legal Power


by Gregory Sirico

Many are calling the new game Palworld “Pokémon GO with guns,” noting the games striking similarities. Experts speculate how Nintendo could take legal action.

Animated figures with guns stand on top of creatures

The Best Lawyers in Portugal™ 2024


by Best Lawyers

The 2024 awards for Portugal include the 14th edition of The Best Lawyers in Portugal™ and 2nd edition of Best Lawyers: Ones to Watch in Portugal™.

City and beach with green water and blue sky

The Best Lawyers in Peru™ 2024


by Best Lawyers

Best Lawyers is excited to announce the landmark 10th edition of The Best Lawyers in Peru, the prestigious award recognizing the country's lop legal talent.

Landscape of Peru city with cliffside and ocean

How To Find A Pro Bono Lawyer


by Best Lawyers

Best Lawyers dives into the vital role pro bono lawyers play in ensuring access to justice for all and the transformative impact they have on communities.

Hands joined around a table with phone, paper, pen and glasses

Presenting the 2024 Best Lawyers Family Law Legal Guide


by Best Lawyers

The 2024 Best Lawyers Family Law Legal Guide is now live and includes recognitions for all Best Lawyers family law awards. Read below and explore the legal guide.

Man entering home and hugging two children in doorway

The Best Lawyers in Colombia™ 2024


by Best Lawyers

Best Lawyers is honored to announce the 14th edition of The Best Lawyers in Colombia™ for 2024, which honors Colombia's most esteemed lawyers and law firms.

Cityscape of Colombia with blue cloudy sky above

Announcing the 2024 Best Lawyers in Puerto Rico™


by Best Lawyers

Best Lawyers is proud to announce the 11th edition of The Best Lawyers in Puerto Rico™, honoring the top lawyers and firms across the country for 2024.

View of Puerto Rico city from the ocean

Canada Makes First Foray Into AI Regulation


by Sara Collin

As Artificial Intelligence continues to rise in use and popularity, many countries are working to ensure proper regulation. Canada has just made its first foray into AI regulation.

People standing in front of large, green pixelated image of buildings

Commingling Assets


by Tamires M. Oliveira

Commingling alone does not automatically turn an otherwise immune asset into an asset subject to marital distribution as explained by one family law lawyer.

Toy house and figure of married couple standing on stacks of coins

How To Check a Lawyer's Reputation


by Best Lawyers

If you find yourself facing legal issues, researching and hiring a lawyer with a solid track record and high level of credibility can make all the difference.

Figure holding a magnify glass over digital profile

What Is a Retainer Fee for a Lawyer?


by Best Lawyers

In this article, Best Lawyers breaks down exactly what a retainer fee is, why lawyers utilize them and what clients should expect when seeking legal guidance.

Two animated hands exchange money and contracts