Defending Data
Data security represents both a new market opportunity to sell insurance coverage and a new risk – especially for independent insurance agencies that may not be compliant with data security laws or have plans to protect their own companies from data breaches.
While data security is an evolving issue, failing to protect data can have a huge financial impact on a company. The average total per-incident cost of a data security breach was $6.65 million in 2008, according to the “U.S. Cost of Data Breach Study” conducted by data protection company PGP Corp. and information management research firm The Ponemon Institute.
The PGP/Ponemon study indicated that data breach incidents cost U.S. companies $202 per compromised customer record and more than 84 percent of data breach cases in 2008 involved organizations that had more than one breach. Also, more than 88 percent of all cases in the study involved insider negligence. The cost of lost business was the most costly effect of a breach, averaging $4.59 million or $139 per record compromised.
Understanding the Exposure
There are many types of data security breaches. Over a five-year period, Kroll Inc., a risk consulting operating unit of Marsh & McLennan Companies Inc., found that in data security breaches, 4.8 percent occurred in disposal of documents on computers; 1.8 percent occurred with e-mail; 20.8 percent occurred because of hacking; 22.4 percent occurred because of lost, missing or stolen laptops; and 15.3 percent occurred via the Web.
Oftentimes, the breaches are a result of not having the appropriate procedures in place to prevent employee mischief.
“Typically, we find that technology people doing the work don’t have security background checks but they’re given access to the systems. So we find that a lot of security breaches are done by insiders,” said Thomas Katona, president, managing member of Apogee Insurance Group. “We don’t do background checks on IT people, but we give them the keys to the castle.”
One hurdle to ensuring data security is that many companies don’t understand the exposure, said Leslie Lamb, global risk and insurance manager for Cisco Systems Inc. “Cyber liability is fairly new, and we’re all fairly vulnerable,” Lamb said.
Companies may not have the right protocol in place to prevent breaches, and they might not have clear guidelines to handle a breach if one occurs.
Nevertheless, it’s important for business owners to get up to speed about how to handle a breach.
“If a breach occurs, the ability to respond must be timely,” said Shena Crowe, Infragard Coordinator for the Federal Bureau of Investigation. “Companies only have about 30 days or less.”
“After a breach, a lot of companies don’t know what to do,” said Adam Sills, underwriter for Darwin Professional Underwriters Inc. For instance, companies do not have to send out a notice to customers for every sort of breach – but if they do, that will incur costs. And although it may not be required by law, many consumers expect the company that has had a data breach to offer them credit monitoring, which can be a huge additional expense for a business.
Notification costs $1 to $2 per individual; credit monitoring costs $10 to $20 per person per year, said Nicholas Economidis, an underwriter for Beazley USA.
Regulations in 44 states, the District of Columbia, Puerto Rico and the Virgin Islands require that individuals (customers, employees, citizens, students, alumni, etc.) be notified if their confidential or personal data has been lost, stolen or compromised.
“Having a response plan in place can save a lot of money,” Sills said.
“The costs can go off the wall in terms of remediation when there are secure data claims, and without a contingency plan in place, quite often there is a knee-jerk reaction to how companies deal with claims, how they deal with notifications, how they stop the security breach, and how they remedy how much data was breached,” Apogee Insurance’s Katona said. “Most companies will have a disaster recovery plan, and no contingency plan in place for data security breaches. It is imperative that they do.”
Despite the gravity of the issue, business owners have a false sense of security about data breaches, according to a recent national survey of more than 1,500 business leaders conducted by Zogby International on behalf of Identity Theft 911. In the study, most business owners indicated data breaches were not the highest priority. Nearly two-fifths did not have an incident response plan or outside vendor management procedures in place. Another third did not encrypt customer and employee data that contains personally identifiable information.
Even if business owners are concerned about the risks, they may not be aware of the insurance coverages available to help protect their livelihoods. “It’s surprising how many don’t know the coverage exists, and that the CGL (commercial general liability policy) and GL (general liability policy) don’t cover electronic data,” said Katona.
When seeking coverage for data breaches, security and privacy insurance can help with liability defense costs and damages; notification costs; credit monitoring expenses; and first-party losses. Primary limits available go up to $25 million, and excess limits go up to $150 million or more. Sublimits often apply or notification credit monitoring, Katona said.
Agents should advise customers to be careful about what coverages they purchase, Sills said. There is no standard application that ISO puts out, so insurers have different approaches to what risks they will insure.
“Policies have changed in the past four to five years,” Sills added. The number of carriers offering coverage also has increased from a handful five years ago to about 25 to 30 carriers today.
“People tend to confuse cyber insurance with data security and data breach insurance,” Katona saud. He explained that cyber insurance is typically what happens with viruses or malicious code, and there is damage that occurs with systems being down. Data security coverages are available for almost every component of the business, and are designed to help with notification, crisis management, etc.
Because the technological environment changes rapidly, agents should go over forms carefully because they are providing coverage for a moving target, Katona said. “In a form that says, ‘cyberspace activity,’ what does that really mean?” he asked. “The vast majority of old coverages are insufficient or incorrect today, because of new technology.”
Agent Opportunities
While it may be challenging to keep up with evolving technology, it is a great time for independent insurance agents to sell coverages.
“Data security has become a hot topic in the past three or four years. A lot of legislation has been passed, and data security breaches have become a main street type exposure,” so clients are a little more aware that a breach could occur, Economidis said. And with the world doing business on the Internet and the presence of Wi-Fi (wireless Internet access), “it’s virtually impossible to secure all of that information,” he said.
“It isn’t a matter of an exposure might occur, it will occur,” Katona said. “Ninety-eight percent of the time, companies have voids in their secure data information that will expose them, with things like HIPAA (Health Insurance Portability and Accountability Act) information, credit card information and people’s home addresses. I would guess that 5 percent of the world has coverage for secured data. That’s only a guesstimate, but it’s an enormous market, even for main street businesses that are doing credit card transactions.
“I think agents, in a soft market, should be paying attention to the emerging coverages. This is one of those coverages, and one that most of their clients probably do not have,” Katona added.
Customers often are not aware what the rules and regulations are when a breach occurs. They also often are not aware of the costs associated with a breach. “It’s a wonderful opportunity for agents and brokers to educate their insureds and sell,” Katona added.
Of course, that means agents and brokers must educate themselves. “Our major challenge as an industry right now is educating agents and brokers as to what kind of questions they need to ask their insureds, to get their arms around what kind of information their clients have,” Katona said.
And, agents and brokers should take steps to ensure they’re covered themselves.
“Insurance agents and brokers, obviously, capture a lot of information to write coverage for their insureds,” Katona said. The Gramm-Leach-Bliley Act requires companies to have certain security measures in place. For smaller agencies, absorbing the costs of securing doors or having password protection and certain security measures in place can be difficult. But “98 percent of the agents we deal with are not Gramm-Leach compliant,” Katona said. “As a group of insurance agents and brokers, we have a responsibility to protect that data.”
Crowe, Economidis, Lamb, Katona and Sills spoke on a panel about data security at the 2008 PLUS International Conference in Nov. 2008. This article is based on the presentation, as well as independent interviews with Insurance Journal.
Web Resource:
More information on state data breach laws is available from the National Conference of State Legislatures at www.ncsl.org/programs/lis/cip/priv/breach.htm.