By Reid Rushing, President | Insurance Division
Lately, you can’t watch TV or read the newspapers without hearing something about a data breach or company being hacked (most recently at DNC headquarters), and companies are increasingly starting to get into the Cyber Security product game. Until recently, it’s been long thought that the specific exposures of data breaches from notifying your clients to actual cost of the loss data were properly covered and defended only by purchasing a Cyber Liability Policy.
In April 2016, the U.S. Court of Appeals for the 4th Circuit changed that thought process. Here’s a little more of the back story. Travelers Insurance was asked to defend Portal Health Care Solutions, a medical records safekeeping firm that provided the medical records for Glens Falls Hospital, for a breach in 2013 where patients’ medical records were exposed on the internet for four months. Portal was insured by Travelers during this time, and Travelers claimed that the breach was not covered under its policies.
Travelers claimed that under Coverage Part B Personal and Advertising Injury on their Commercial General Liability Policy, there was no “personal injury” or “publication” as defined by the policy; therefore, they had no right to defend the suit.
The courts held that “publication occurs when information is ‘placed before the public,’ not when a member of the public reads the information placed before it.” This basically means that the records are “published” the moment they became accessible to the public via an online search.
Other State Court rulings, Connecticut in 2014 and New York in 2015, found no coverage for Cyber claims in a traditional Commercial General Liability Policy. The Connecticut suit claimed that 130 computer tapes fell out of the back of a vehicle and never recovered. In 2015, the New York Court ruled that Zurich American Insurance had no duty to defend Sony Corp of America in litigation from the April 2011 hacking of the PlayStation online services since the acts by third-party hackers do not constitute “oral or written publication in any manner of the material that violates a person’s right of privacy.”
Cyber Risk is continually evolving. Courts and insurance companies are tirelessly trying to clarify coverages on the Commercial General Liability Policy for data breaches. Luckily, many companies are starting to provide Cyber Liability Policies for their clients to make sure that the coverage is there when their customers lose data or get hacked.
If you want to know more about Cyber Liability and coverages offered, please call us at 850-476-3745.