Cyber Liability / Privacy Liability
Cyber Liability or Privacy Liability - provides insurance to any business, including not-for-profit organizations that:
• Obtains social security numbers, drivers license numbers, bank account numbers of clients or employees.
• Has access to patient medical records.
• Is in the process of going ‘paperless’ or keeps paper files onsite.
• Provides online access to sensitive data.
• Allows laptops or access to their network from a remote location.
• Relies on their computer network on a daily basis.
This Insurance Pays for:
• Costs to comply with federal and/or state required notification.
• Regulatory proceedings(including fines and penalties) as a result of a privacy breach. This includes HIPAA violations.
• Employees (teachers, volunteers) and/or groups of affected individuals(alumni, current students, parents) suing for damages as a result of a privacy breach.
• Liability for the transmission of malicious code to an outside party.
• Denial of service attack on your network, causing computer system to go down and business interruption expenses.
• Intellectual property/privacy lawsuits. These include libel/slander arising out of content that is on your internet or intranet sites.
Who needs Cyber Liability Insurance?
Any business with a computer or website or that obtains Personal Information (social security numbers, drivers license numbers, bank account numbers) of clients or employees.
In 2017, 1.8 million records were targeted, median number of records lost was 1,091. Hackers caused 27% of the incidents, Malware/Virus caused 16%, and Third Parties (Vendors) accounted for 13% of the incidents.
Healthcare and Professional Services were the most breached sectors (18% each) followed by Financial Services (13%), Retail (11%) and Non-Proft (8%)
PCI was the most frequently exposed data.
The average breach cost was $394,000, the average cost per record was $303. Legal Defense median cost $15K, Crisis Services median $36K and Legal Settlement median cost $50K
Cyber Liability FAQs
Disclaimer: The information provided in this FAQ section is for general informational purposes only and is not intended as professional IT or cybersecurity advice. RMG Insurance is not an IT provider. We recommend consulting with your in-house IT professionals or a qualified cybersecurity expert to assess and address the specific needs of your organization.
- Social engineering: Manipulates behavior or norms to induce victims to take actions, like clicking links or revealing sensitive information.
- Phishing: Fraudulent emails or web solicitations designed to obtain sensitive data, often by impersonating legitimate businesses.
- Spear-phishing: A more targeted form of phishing aimed at specific individuals using personalized details.
- Clone phishing: Impersonating a well-known company by cloning their official website or emails.
- Smishing: Phishing attempts via text messages.
- Vishing: Phishing attempts via phone calls or voicemails.
- Quishing: Phishing emails that use QR codes to compromise mobile devices.
- Bluesnarfing: Accessing a wireless device through Bluetooth connections.
Cyber insurance can help mitigate financial losses from these types of attacks by covering expenses related to data breaches, system restoration, and legal liabilities.
- Enable Multifactor Authentication (MFA): Implement and enforce MFA on all critical business systems and endpoints. Use it when accessing VPNs or remote desktop protocols (RDP).
- Use Endpoint Detection and Response (EDR): Secure and monitor network endpoints with EDR to detect malicious activities.
- Apply dual authentication for wiring funds: Verify fund transfers by confirming with a pre-determined phone number or through another method of authentication.
- Backup data regularly: Ensure data backups are segmented, tested, and stored separately to avoid ransomware attacks.
By implementing these practices, you reduce your vulnerability to cyber threats. Additionally, cyber insurance provides a safety net, covering the costs of business interruption, legal fees, and even regulatory fines in the event of a cyberattack.
MFA is a security process that requires users to verify their identity using two or more methods. It adds a layer of protection to business systems and prevents unauthorized access.
Having MFA in place not only reduces your risk of a data breach, but cyber insurance may require this as part of its coverage criteria, helping you avoid costly damages.
EDR secures network endpoints and detects malicious threats. It must be operationalized and monitored to be effective.
Cyber insurance policies often require proper cybersecurity tools like EDR. Should a breach occur, your insurance will cover recovery expenses, ensuring minimal disruption to your business.
Implement dual authentication for wire transfers and always verify vendor or customer information via a pre-determined phone number before sending payments.
In case of social engineering or wire fraud, cyber insurance can help cover the financial impact, including the cost of stolen funds and legal costs.
CLAIM SCENARIOS:
- Client information was on a case manager’s laptop that was stolen from her office. Files on the laptop contained patient names, social security numbers, dates of birth, addresses, phone numbers, medical condition information and case information.
- Third-party vendor that hosted a foundation’s website experienced a security incident. Customers who donated to the organization may have had their names, dates of birth and credit card information accessed.
- Adult day care’s computer network is down for 4 days as a result of a Trojan horse attack and are unable to provide any services as a result. There is a need to hire experts to correct their system and get it back to where it was functioning.
- In an effort to go paperless, cleaning crew at a HIV awareness organization discards all employee files in an unsecured dumpster. Personal information of all employees is compromised and those affected join a class action suit against the non-profit.
- Animal shelter holding a golf tournament posts information regarding the event on their website. As a result of the shelter not getting permission to use a golf company’s logo, they are sued for copyright infringement.
Have questions? Please call us at 610-867-6869 or click here to submit the online form and we will be glad to assist you.
Client Testimonials
Thank you so much for your time. You are so great at what you do and I can’t tell you how much I appreciate it when people take pride in their work and do it well. Less money and more coverage… doesn’t get much better than that!
-- Jana Morris, Executive Director, Recovery Revolution, Bangor, Pa.
Ron Martin- not just my insurance guy but now a friend! He is sincere and truly cares about you and the success of my business. Checks in periodically just to see how we all are doing. Insurance buying was never so easy. Thanks, Ron.
-- J.& D. Morgan, Monkey's Uncle, Doylestown, Pa
