Insurance coverage for “Business Email Compromise” (BEC) scams is a hot issue being litigated by companies and their insurance providers in jurisdictions across the country. The Ninth Circuit is poised to issue what may be an influential decision after hearing oral argument this week in a coverage action initiated by an accounting firm that lost its client’s money to a BEC scam. Learn more from Orrick attorneys Darren Teshima and Harry Moren at our sister blog, Policyholder Insider.
The coverage landscape for “Business E-mail Compromise” (BEC) scams remains somewhat tenuous, as organizations and carriers continue to battle in court over the extent of coverage. Although recent positive, policyholder-friendly trends in the Eighth Circuit (hacker who took over a bank’s computer system) and federal district court in Georgia (scheme based on spoofing a CEO’s e-mail) found insurance coverage for fraudulently transferred funds, a recent unpublished Fifth Circuit opinion moves in the other direction. Unfortunately, this new ruling—and the uncertainty it creates—may embolden insurers in fighting coverage for these scams under crime insurance policies.
Happy U.S. National Cybersecurity Awareness Month! One year ago, in recognition of the Department of Homeland Security’s annual campaign to raise awareness about cybersecurity, Orrick’s Cybersecurity & Data Privacy Group launched its award winning blog Trust Anchor.
Almost daily we hear news about data breaches, cybersecurity and privacy enforcement proceedings, litigation, and new laws and regulations. Trust Anchor covers it all: recent cases, legislative and regulatory developments, emerging compliance standards and best practices for cybersecurity and privacy risk management, insurance trends and more! But, we don’t just report on these events, we highlight key takeaways and what these developments mean for you.
“Business Email Compromise” (BEC) scams are becoming an increasingly prevalent concern for businesses—the FBI reports that incidents have increased 1,300% since January 2015. A federal district court in Georgia recently ruled that a BEC scam in which a fraudster deceived an employee into wiring $1.72 million to an account in China was covered a under a commercial crime policy. The court rejected the insurer’s argument that the wire transfer was not directly caused by the BEC scam, and determined that the policy language was ambiguous about whether intervening events affected coverage, thus resolving the ambiguity in favor of the policyholder. At our sister blog Policyholder Insider, Darren Teshima and Harry Moren discuss why this ruling is good news for policyholders who have fallen victim to a BEC scam.
Non-cyber insurance policies often contain exclusions to limit or preclude coverage for data breaches. A Maryland federal district court recently addressed the scope of such exclusions. The court analyzed the meaning of “data” in data breach policy exclusions in a multimedia liability policy and concluded that the undefined term “data” did not include satellite television programming. Having found that the exclusions did not apply, the court held that the underlying lawsuit involving allegations of unauthorized access to satellite television programming triggered the insurer’s duty to defend the policyholder. At Orrick’s Policyholder Insider blog, Darren Teshima and Harry Moren discuss this decision’s rejection of an insurer’s attempt to avoid coverage by broadening the scope of these data breach exclusions.
In one of the first court decisions to analyze in depth the coverage provided by a cyber policy, a federal judge has found that PF Chang’s policy came up short. Following a 2014 data breach in which hackers accessed and posted online 60,000 credit card numbers belonging to PF Chang’s customers, the company sought coverage under its “CyberSecurity by Chubb” insurance policy. Although PF Chang’s insurer, Federal Insurance Company (“Federal”), agreed to reimburse nearly $1.7 million for customer claims and other breach-related expenses, it refused to reimburse an additional $2 million in fees and assessments levied against P.F. Chang’s by the credit card brands. Last week a federal district judge in Arizona, applying Arizona law, denied PF Chang’s claim for reimbursement and granted summary judgment for Federal. While it held that these fees and assessments fell within the scope of coverage, the court held that the “contractual liability” exclusion barred coverage.
A recent Eighth Circuit ruling on cybercrime coverage held that the issuer of a financial institution bond must cover a bank’s losses after a hacker’s malware attack resulted in unauthorized fund transfers. The court rejected the insurer’s claim that employee negligence—a factor in the loss—excluded coverage. This is a good decision for financial institutions and crime insurance policyholders, and Orrick attorneys Russell Cohen, Darren Teshima, and Harry Moren discuss the decision and its potential impact on coverage for the trending Business E-mail Compromise (BEC) scam.
This week, a Fourth Circuit panel in an unpublished decision validated arguments long made by policyholders: that commercial general liability policies may provide coverage for certain data breach liabilities. In this case, Travelers Indemnity Company v. Portal Healthcare Solutions, the appellate court affirmed the district court’s 2014 ruling that an insurer had the duty to defend a company that provides electronic medical record management services in a class action alleging that the company made patients’ confidential records publicly accessible by posting the records to an unsecured public website.
The insurance industry has been making the case to Congress that cyberinsurance can be a path to good security practices, encouraging different groups inside an organization to better communicate with one another. The process of investigating, applying for and being approved for cyberinsurance may indeed prompt important discussions inside organizations about cybersecurity. And it may be a subject that prompts board-level discussion of cyber preparedness. But in our view, relying on cyberinsurance as the spark for those conversations is the tail wagging the dog or the chicken not the egg or the egg not the chicken.
Cyber insurance has reached a tipping point. The rising costs faced by data breach victims, which can exceed $100 million for the largest breaches, have spurred an increasing number of companies across industries to turn to cyber insurance in an effort to transfer at least some of those costs to an insurer. But cyber insurance is still relatively new, at least as a mass-market insurance product, and it is evolving quickly, although not as quickly as the threat itself. The policies are complex and not standardized, and courts have yet to provide any guidance about what will be covered and what will not. This state of affairs leaves many companies that have or are considering buying cyber insurance uncertain—not only whether they will be a victim of a data breach but also whether insurance will provide them with the coverage they need if they do become a victim.