Cyber loss trends, insurance coverage and claim payouts Presented by Katie Andruchow, MBA, CIP, CRM National Cyber and Privacy Expert Aon Risk Solutions™ Financial Services Group Aon’s Cyber and Privacy Practice

Overview of Cybercrime It is estimated that cybercrime costs the global economy more than $400 Billion USD a year

Overview of Cybercrime

Common Threats: Lizard Squad

Common Threats: Cryptolocker

Real Prize in Caesars Fight: Data on Players Customer loyalty program is valued at $1 billion by creditors The most valuable asset in the bitter bankruptcy feud at Caesars Entertainment Corp. isn’t the casino operator’s opulent Roman-themed resort at the heart of the Las Vegas Strip. It’s the company’s big-data customer loyalty program, valued at $1 billion by creditors.

Common Exposures Employee payroll information: Names, addresses, SIN number Even if payroll processing is outsourced to a third party ex ADP Human Resources records: Employee employment histories, health records, salary information Corporate confidential information Third party intellectual property, M&A documents, CRM system information Network Interruption: Security Breaches causing operational downtime Dependent Business Interruption: Key service providers experience security breaches that in turn interrupt the Insured business Cyber Extortion: threats made against an organization to disclose confidential information “or else”

Types of Privacy Breach Costs Incurred First Party Costs Organization’s out-of-pocket costs Notification Expenses IT Forensics Public Relations Call Centre Expenses Brand Damage Mitigation Efforts Credit Monitoring Identity Theft Monitoring Data Recovery and Restoration Expenses Loss of Intellectual Property Business Interruption Cyber Extortion and Cyber Terrorism Third Party Liability Civil suits From business partners From employees and the general public Legal defense & damages Regulatory investigations and proceedings From privacy commissioners Fines, penalties and civil awards Costs of investigations

What Does a Cyber Policy Cover? Provided on a Claims- made basis; for liability arising out of: Network security breaches to insured computer systems Network security breaches to third party service providers networks Privacy breaches: Failure to protect confidential information Transmission of malicious code to third parties Regulatory investigations, proceedings and penalties Levied by Privacy Regulatory bodies Fines, penalties and civil awards Costs of investigations

What Does a Cyber Policy Cover? Privacy Breach Costs Notifications Legal Advice IT Forensics Credit Monitoring Identity Theft Monitoring Business Interruption Extra Expenses incurred because of loss Ordinary Payroll Lost Income Digital Asset Restoration Costs of Labour to recreate digital records Costs to replace damaged hardware and software Cyber Extortion

What Does a Cyber Policy Cover? Additional First Party Coverage For Financial Institutions Electronic theft of funds Fund theft suffered by clients via phishing attacks For Healthcare Sector Costs and services to obtain new health care numbers For Any Risk Processing Payment Cards Payment Card Industry Fines, penalties and investigation

Causes of Insured Losses 2014 NetDiligence Claims Cost Report

Real Claim Payouts: Third Party vs. First Party

Tort of Intrusion Upon Seclusion Created in Jones v Tsige in 2012 with a 3-part test: No need for economic harm or dissemination Courts expanded on Jones in many cases since this point in time 1. Defendant’s conduct be intentional or reckless 2. Defendant invaded the plaintiff’s private affairs or concerns without lawful justification 3. Reasonable person would regard the invasion as highly offensive, causing distress, humiliation, or anguish

Actual Claim Payouts Hardest hit sectors were Retail and Financial Services. Heath care is a close third Small- to mid-sized organizations experienced the most incidents, while large caps lost the most records per breach The average claim payout was $733,109; Average claim payout for a large cap company was $2.9MM Claims ranged from $600 to $6.5M; most claims fell within $30,000-$400,000 32% of the losses reported has insider involvement Netdiligence 2014 cost of cyber claims study

Questions?