that software and data are covered under
"tangible" property, a general liability
policy may be sufficient. However, with
the costs incurred by a cyber breach, that
is not a risk worth taking.
AOL experienced first-hand the
problems of having a policy that just
covered "tangible" property. AOL's
commercial general liability policy
did not define "tangible." When AOL
suffered a data breach, it sought coverage
under its commercial general liability
policy. The court held that the damage
caused by the cyber breach was not
covered under the term "tangible," and
ruled in favor of the insurance carrier.
of Minnesota found that a commercial
general liability policy was ambiguous as
to whether "tangible" property included
coverage for a computer tape containing
data belonging to a third party, and the
court ruled in favor of coverage.
electronic data "tangible" property is just
one of many issues that can arise when
relying on a commercial general liability
policy. Another issue to consider is a
claim for defense and indemnification.
In 2011, Sony Corp. of America and
Sony Computer Entertainment America
suffered a breach in which over 77
million user accounts were hacked,
costing Sony around $2 billion.
defense and indemnification claim, and
the insurance company filed suit seeking
a ruling that it did not have to defend
Sony against any data breach claims.
In 2014, the New York Supreme Court
determined that the insurance company
the court found that the policy covered
material published directly by Sony,
and not the third party who stole the
data.
Bowl ad for cyber liability insurance"
and remarks that "Sony showed that
companies cannot look to general
liability policies to cover data breaches.
They need to get cyber insurance."
company from the damages
of a cyber attack?
policies available. When negotiating
a cyber liability policy, analyzing your
potential exposure is the first step. One
way to analyze your exposure is to hire
a forensic firm to perform a forensic
analysis of your company's exposure to
cyber risks. Once you receive the report,
"Other key considerations include
whether the company has overseas
operations, whether the company has
call centers, the extent of the company's
internet operations and the company's
reliance on cloud computing."
your firm's data and help to provide the
best coverage for your business.
failing to procure coverage for a cyber
breach, the advantages of purchasing
cyber liability insurance are worth
the cost. You would never leave the
door to your business unlocked after
closing time, why leave data exposed
to cyber threats 24/7? According to
ComputerWeekly.com, "Data breaches
and death."
time to do so. Conducting a forensic
analysis of your company's exposure to
cyber threats, addressing those security
issues and procuring cyber liability
insurance for coverage in the event of
a cyber attack are crucial to protecting
your company from the extensive costs
of a breach. Relying on your commercial
general liability policy is not enough.
Procuring coverage through a cyber
liability policy is the best decision to
ensure coverage.
2014), available at http://public.dhe.ibm.com/common/
ssi/ecm/se/en/sel03027usen/SEL03027USEN.PDF (last
visited February 23, 2015).
3 Ponemon Institute, 2014 Cost of Data Breach Study:
2014), available at http://public.dhe.ibm.com/common/
ssi/ecm/se/en/sel03027usen/SEL03027USEN.PDF (last
visited February 23, 2015).
5 ISO Comments on CGL Endorsements for Data Breach
2014), available at http://www.insurancejournal.com/
news/east/2014/07/18/332655.htm (last visited February
23, 2015).
JOURNAL (March 17, 2014) available at http://www.
insurancejournal.com/news/east/2014/03/17/323551.
htm (last visited February 23, 2015).
10 Latham & Watkins Client Alert, Cyber Insurance: A Last
WATKINS INSURANCE COVERAGE LITIGATION
PRACTICE (April 15, 2014), available at lw-
cybersecurity-insurance-policy-coverage.pdf (last visited
February 23, 2015).
http://www.computerweekly.com/news/2240202703/
An-introduction-to-cyber-liability-insurance-cover (last
visited February 6, 2015).