1. Crisis Management Assistance Crisis Management Presented by Jack Cloonan

3. Crisis Management

5. Failing to Plan is Planning to Fail Crisis Management

6. IRONSHORE CRISIS MANAGEMENT SEMINAR: Facility Explosion

7. BREAKING NEWS

8. PANEL DISCUSSION Stratton Horres – Panel Moderator Christopher Kelly – Property: The Minute After Dawn Krigstin – How to Handle An Environmental Crisis Peter Duda – Managing Communication

9. Property: The Minute After Christopher Kelly, Vice President Property Claims Ironshore

10. PROPERTY: THE MINUTE AFTER Who What Where Why When How? © 2013 Wilson Elser. All rights reserved.

11. WHO: Do You Call? –Employees - Facilities, Site Manager, Other sites, Accounting(?) Contractors - Demolition/Clean up, Construction, Engineer –Broker, Insurer, Adjuster –Local Authorities - FD, PD, Bldg. Dept. Is Project Lead? –Risk Manager, Plant Manager, Facilities Dept., Other? © 2013 Wilson Elser. All rights reserved. Does the Claim Belong To? –The Insured

12. WHAT: Is Damaged? –Building, Premises, Property of Others, Equipment, Stock, Operations © 2013 Wilson Elser. All rights reserved. Resources are Needed? –To keep business operating –To satisfy authorities –For Insurance Claim – inventory, asset register, workflows, leases/contracts, involved parties. Is Our Goal? –Repair/Replace? “As Was” or Modified? –Abandon/Exit?

13. WHERE: Are the resources? Can/Should Operations Resume? © 2013 Wilson Elser. All rights reserved.

14. WHY: To Satisfy Business Need? To Satisfy Authorities? Local, State, Federal To Satisfy Community? To Satisfy Insurance Company(ies)? © 2013 Wilson Elser. All rights reserved.

15. WHEN: Sequence of Actions? Five Minutes or More – ago. © 2013 Wilson Elser. All rights reserved.

16. HOW: Planning –Pre Loss: Business Continuity Plan (BCP) –Post Loss: Exercise/Adapt Plan Listening – To In-House Personnel, To Authorities, To Adjustment Team, To Your Gut Communication – Cliché, but Key © 2013 Wilson Elser. All rights reserved.

17. ADJUSTMENT PROCESS Insurer Adjustment Team –Adjuster Accountant Salvor Engineer Building Consultant Attorneys –Subrogation –Coverage © 2013 Wilson Elser. All rights reserved.

18. ADJUSTMENT PROCESS Reduce Loss – (NOT Coverage Oriented) –Salvor –Subrogation Counsel/Cause & Origin Evaluate Claim –Adjuster –Accountant –Engineer –Building consultant –Coverage Counsel Evaluate Coverage –Adjuster –Coverage Counsel © 2013 Wilson Elser. All rights reserved.

19. ADJUSTMENT TEAM VALUE ADD Assist Insured In Making Informed Decisions May Have Worthwhile Suggestions May Be Able to Refer Resources May Be Able to Interface With Authorities/Contractors Prompt Issuance of Payments (Partial/Final) © 2013 Wilson Elser. All rights reserved.

20. HARD FACTS It is the Insured’s Property, Business, Claim Adjustment Team Can Be Resource, But Does Not “Authorize” Not All Business Decisions are Insured © 2013 Wilson Elser. All rights reserved.

21. KEYS TO SUCESS PRE-LOSS –Have A Plan –Identify Resources –Relationships POST LOSS –Open Communication Documentation Verbal Relationships © 2013 Wilson Elser. All rights reserved.

22. OPPORTUNITIES Potential Positive Impacts –Employees –Customers –Community –Operations © 2013 Wilson Elser. All rights reserved.

23. How to Handle An Environmental Crises Dawn Krigstin, Vice President Ironshore Environmental Claims

24. ENVIRONMENTAL CLAIMS SOURCES OF ENVIRONMENTAL CLAIMS  The discovery of persistent contaminants in soil or groundwater;  The accidental or sudden release of contaminants that persist in soil, groundwater, the atmosphere or structures; or  An individual’s long-term or acute exposure to contaminants that may leave lasting injuries. CHARACTERISTICS OF AN ENVIRONMENTAL CLAIM  Influence of regulatory agencies on claim resolution  Uncertainty as to cause of damage or injury  Disputable effectiveness of any particular cleanup strategy  Immediate response/action is usually required W HICH COMPANIES HAVE ENVIRONMENTAL EXPOSURES ?

25. ENVIRONMENTAL CLAIMS –All claims are fact specific and fact intensive –Environmental claims are complicated –Many parties are usually involved -Regulatory agencies -Claimants -Insureds -Brokers -Multiple potentially responsible parties with various contributions to the loss -Multiple carriers (based on policy years, coverages) –To complicate matters, it is often difficult to determine the cause of an environmental claim as well as the effectiveness of a particular cleanup strategy.

26. IDENTIFY PLAYERS Which carriers? Professional liability Property Environmental Tank Policies Which Parties? -Maintenance issue? -Suppliers (defective product?) -Contact Information? Broker Carrier Crisis hotlines Insured Claims Managers

27. MANAGING EXPECTATIONS TEAM = Insured & Adjuster & Broker What is the process? What is expected? Contractors? Consultants? Expectations and strategies can be established early Identify additional information needed and determine who is best to provide Makes process more personable, sets tone Dilutes contentiousness or distrust Allows for informal discussion about application of policy terms Broker can help better explain policy and process to the insured Team can focus on resolution, fair compensation or satisfaction of the applicable regulatory requirements

28. CONSIDERATIONS (AKA: DAMAGE CONTROL) Attorneys Statements Pictures Accident Recreationists “Boots-on-Ground” Adjusters Environmental Consultants Air Quality Monitoring/Tracking Public Relations

29. NEED PR? YES!

30. PREPARE!!! Pre-crisis planning –Press releases with fill-in-the-blanks –Meet your claims team –Build relationships with local fire stations/attorneys/etc. –Have contract in place with ER companies Terms and rates can be addressed when cooler heads prevail. –Know who to call –Manage internal processes –Ask question to help understand the post-claim stages, timelines and strategies

31. Managing Communication is Critical Peter K. Duda - Communications Specialist Executive Vice President and co-head of the global crisis and issues practice Weber Shandwick

32. Crisis requires prompt, incremental response With social media, transparency and speed are even more paramount Pre-define (or quickly define) roles and responsibilities of employees and advisors managing communication is critical

33. local issues can quickly become national news West Fertilizer Company Explosion West, Texas (2013) Freedom Industries Chemical Spill Charleston, West Virginia (2014) Catastrophic business impact Loss of enterprise value Government investigations Civil and criminal litigation Media attention Long-term community impact, distrust ExxonMobil Pegasus Pipeline Release Mayflower, Arkansas (2013) ConEd Gas Explosion New York, New York (2014)

34. COMMUNICATIONS RESPONSE: How Not to Do It

35. © 2013 Wilson Elser. All rights reserved. COMMUNICATIONS RESPONSE: Respond Rapidly When the Crisis Strikes Prompt, incremental response –Rapid engagement of a pre-prepared crisis communications plan –Instant activation of 24/7 crisis management war room with team members from key practices: operations, management, legal, communications, sales and influencer experts Pre-define (or quickly define) roles and responsibilities of employees and advisors –Establish secure flow of information, leak-proof security protocols Rapid response through digital and traditional media –Activate necessary dark sites/pages; remove content when necessary/appropriate –Pre-and-post SEO, including optimizing keyword search, promoted tweets and ads Close coordination with authorities Round-the-clock monitoring –Clear mechanisms for notifications and alerts –Ongoing media coverage reports, social media impact analysis Consistent messaging across all documents

36. RECOVERY: Restoring the Company’s Reputation Post-crisis analysis to help determine best practices moving forward Ongoing social media monitoring to maintain an ear to the ground for potential issue spotting Use social media to continue outreach with key opinion leaders Keep internal community informed – let them know how they helped drive the process Communicate the post-crisis corporate story and plan for operational success and brand recovery by leverage strong media relations © 2013 Wilson Elser. All rights reserved.

37. IRONSHORE CRISIS MANAGEMENT SEMINAR: Employer Liability for Workplace Violence Kristin McMahon James Gannon Rhonda Barnat Frank Milliken Ricki E. Roer - Moderator Kristin McMahon James Gannon Rhonda Barnat Frank Milliken Ricki E. Roer - Moderator

38. Employee Misconduct Foradori v. Harris, 523 F.3d 477, 481 -482 (5 th. Cir. 2008) Michael Foradori, a customer at a restaurant, was confronted by Al Cannon, an older teenage restaurant employee, who was off-duty but dressed in his restaurant uniform. Cannon was angry because he thought Foradori had been hitting on his girlfriend. The manager on duty witnessed the beginning of the altercation and ordered both to go outside, but did nothing else to diffuse the escalating confrontation. In the restaurant parking lot, Cannon continued to verbally challenge Foradori. At this point, another restaurant employee, Garious Harris, a football player over six feet tall and weighing nearly 250 pounds, sprinted toward Foradori from behind and struck him with his fist in the back of his neck. Harris was running at full speed when he delivered the blow, described as a “hard punch” with a “balled-up fist.” Foradori was knocked unconscious, causing him to fall head first to the concrete surface below. Foradori suffered a broken neck and severed spine and was diagnosed with permanent quadriplegia.

39. Question: What liability does the Restaurant have over the off-duty conduct of its employees? Was the manager’s instruction to take the altercation outside sufficient to sever liability? What premise liability does the restaurant have?

40. Answer: The jury found that the restaurant operator's negligent failures to regulate, train, supervise, and control its off-duty employees on its premises were proximate causes of Foradori’s injuries. The jury returned a verdict in favor of Foradori, awarding him approximately $10 million for past, present, and future physical pain and suffering, mental anguish, and the loss of enjoyment in life. This figure consisted of $1,581,884.41 for reasonable and necessary medical expenses already incurred; $8 million for the present value of the reasonable and necessary medical expenses reasonably likely to be incurred in the future; and $1,300,000 for the present value of loss of future earnings or earning capacity resulting from his disability.

41. Employee Misconduct Doe v. Saint Francis Hosp. and Medical Center 309 Conn. 146-150, 934 (Conn.Super. July 16, 2013 ) Beginning in 1964, and continuing for decades, George E. Reardon, a physician, purported to conduct a “child growth study” on the premises of his employer, Saint Francis Hospital and Medical Center (“the Hospital”). The Hospital had hired Dr. Reardon in 1964 as a physician specializing in endocrinology. Immediately upon assuming that position, Dr. Reardon began conducting a child growth study out of his office on the Hospital's fourth floor. The study was approved by the Hospital's research committee and was funded by the Saint Francis Hospital Association. The ostensible purpose of the study was to measure the growth rates of normal children to assist in the treatment of children with abnormally low rates of growth. In fact, Dr. Reardon was a pedophile who used the so-called study as a ruse to sexually exploit hundreds of unsuspecting children. Tim Doe was one of those children.

42. Doe sues the Hospital alleging: 1)that the Hospital had negligently failed to supervise Dr. Reardon's activities in connection with the study, and 2)that the Hospital had breached the special duty of care that it owes to children in its custody. Question: What liability does the Hospital have over Dr. Reardon’s conduct?

43. Answer: Following a trial, the jury found for the plaintiff on both claims and awarded plaintiff $2,750,000.

44. Employee Misconduct Ten Broeck Dupont, Inc. v. Brooks, 283 S.W.3d 705 (Ky. 2009) Ten Broeck is a psychiatric hospital located in Louisville, Kentucky where Artemecia Brooks was voluntarily admitted as an in-patient. Prior to Brooks’ admission to Ten Broeck, a local police detective received information from an employee that a sexual predator was employed at the facility. This information was received during an investigation of a patient-on-patient rape. The police officer informed Ten Broeck's Human Resources Director that he had received a tip that an employee had lured and sexually attacked patients, and, the police detective provided the Human Resources Director with a description of the individual. The Human Resources Director did not believe that any employees fit the description and did not conduct an investigation. During Brooks’ hospitalization, an orderly named Feotis Gilbert forced Brooks to have sexual intercourse. The police detective’s description of the sexual predator matched many of Gilbert’s characteristics.

45. Question: What liability does the Hospital have over Gilbert’s conduct? What duty did Ten Broeck have: 1)to protect its patients from criminal misconduct of employees, and 2)to investigate the tip Human Resources received from the police detective?

46. Answer: Following a trial, the jury found for the plaintiff and awarded $161,000 for pain and suffering, $130,000 for future pain and suffering, and $1,800,000 in punitive damages based on Ten Broeck’s failure to undertake any investigation.

47. Premise Liability McBeth v TNS Mills, Inc., 458 SE2d 52 (SC App 1995) Alice McBeth worked the evening shift at TNS Mills. At the end of her shift, McBeth walked to her car in the fenced-in company parking lot and encountered Juanita McCravy. McCravy was not a TNS Mills employee and her presence in the employee parking lot was unauthorized. McCravy was the girlfriend of another TNS Mills employee, Craig Miller; McCravy was prohibited by TNS Mills from being anywhere on the premises due to prior incidents of domestic disturbances between McCravy and Mills which had occurred at the worksite. McCravy confronted McBeth about McBeth's relationship with Miller and, when McBeth admitted that the two had a romantic relationship, McCravy hit and stabbed her. McBeth died of her wounds.

48. Question: Did TNS Mills owe McBeth a duty to provide adequate security measures in the company parking lot from third party criminal acts? Did TNS Mills have a duty to protect McBeth from McCravy specifically, due to the company’s knowledge of her prior aggressive behavior towards TNS Mills employees?

49. Answer: The court held that there is a duty to anticipate and guard others from the criminal acts of third parties if a special relationship such as employer-employee exists between the parties. An employer can be held liable if it knows or should have known that the criminal acts of third parties could cause harm to employees, and it failed to reasonably protect employees.

50. Premise Liability Aidroos v. Vance Uniformed Protection Services, Inc. 386 Ill.App.3d 167 (Ill.App. 1 Dist. 2008) Willie Baker was terminated for theft by his former employer, Navistar International Transportation Corp. Pursuant to company policy, Baker was no longer allowed to be on company premises because he was a terminated employee. Prior to his termination, Baker had never exhibited any violent proclivities. At about 9:45 a.m. one morning, Baker parked in Navistar's visitors' parking lot and entered an unlocked door of a gate guardhouse station, carrying weapons concealed in a golf bag. Although the buildings were supposed to be locked, Baker was able to open the door and enter one of the buildings. Inside, Baker randomly shot building occupants, killing four and wounding others before killing himself.

51. Question: What was Navistar’s duty in securing the premises against third party criminal acts? Can the families of the employee victims sue Navistar based on a theory of negligent maintenance of the workplace?

52. Answer: The Court granted summary judgment in favor of the employer because the Court found that there was no duty to protect employees from criminal acts of third parties. A critical element of the Court’s analysis focused on whether the criminal acts of third parties are “foreseeable,” and in this case, where the former employee had no history of violence, there was no duty to protect employees from Baker’s unanticipated criminal activity. The Court noted that there is a duty to protect employees, when an employee is in imminent danger and this is known to the employer.

53. Co-Worker Violence Medlen v. Estate of Meyers, 476 F.Supp.2d 797, 799 -809 (N.D.Ohio 2007) One day, a disgruntled employee, Myles Myers, entered the DaimlerChrysler Toledo North Assembly Plant with a concealed shotgun, which he used to kill and wound several coworkers in a mass shooting. Meyers had worked at DaimlerChrysler for twenty-two years. His disciplinary record included written warnings for attendance violations and discipline for not ringing in his own time card. That record showed no instances of violence in the workplace. The record did indicate, however, that Meyers had had temperamental “outbursts” and on occasion been “out of control.” The record also indicated that prior to the shootings Meyers stated he was “going to get” the coworkers that he later shot.

54. Question: What liability does the Plant have over Meyer’s conduct? What duty did the Plant have: 1)to protect its employees from criminal misconduct of other employees, and 2)to protect the employees that Meyers specifically threatened? Does Workers’ Compensation preclude recovery by the injured employees (or their estates)?

55. Answer: In Ohio, as in the majority of states, an employer who negligently injures an employee in the workplace cannot be sued by the employee for such negligence where Workers’ Compensation insurance provides recovery. The statute immunizes employers from negligence claims arising from workplace injuries where the injured employee receives workers compensation benefits. However, an injured employee can circumvent the exclusivity of Workers’ Compensation by establishing that the injury did not occur within the scope of employment and that 1) the employer knew about the dangerous “process, procedure, instrumentality or condition” in the workplace; 2) the employer knew and was “substantially certain” that, if subjected to this danger in the workplace, the employee would be harmed; and 3) with the aforesaid knowledge and certainty, the employer required the employee to remain in the dangerous situation.

56. In this case, although the Court found that the Plant knew Meyers had a history of verbal outbursts, there were insufficient indications that Meyers would act violently toward his co-workers so as to impute the requisite knowledge about the risk of harm he posed to his coworkers. Based on this finding, the victims’ estates were precluded from pursuing negligence claims against the Plant, and were restricted to proceeding under Workers’ Compensation insurance for recovery.

57. Co-Worker Violence Colas v. Watermain, 295 A.D.2d 775, 776 -777 (3d. Dept. 2002) Alisha Bermudez was employed as a secretary and had been romantically involved with a coworker, Robert Giles. One day Giles, who was not scheduled to work that day, appeared at the employer's workplace and spoke briefly with Bermudez before holding her hostage and, ultimately, killing her. Bermudez’s mother subsequently filed an amended claim for workers' compensation death benefits on behalf of Bermudez’s three minor children.

58. Question: Can Bermudez’s Estate successfully claim workers’ compensation benefits? If Workers' Compensation benefits are not available, can the Estate seek damages from the Employer on alternate theories of liability?

59. Answer: In general, workers' compensation benefits apply to workplace injuries that arise out of the course of employment. Because Bermudez’s death resulted from a personal relationship conducted exclusively outside of work with an individual who coincidentally was a coworker, her estate was denied death benefits under the Workers' Compensation laws because her death did not arise out of the course of her employment. When Workers' Compensation does not apply, employees may seek to establish liability under “common law” theories of negligence.

60. Crisis Management Assistance Terrorism Presented by Jack Cloonan

61. Terrorists attack a shopping mall The Scenario

62. Two groups of terrorists storm shopping centre. Shoppers flee in panic or hide in shops and store rooms Security forces arrive 30 minutes later. A fire fight starts Hundreds of shoppers and workers escape, but others are left trapped Fighters are cornered in shopping centre supermarket overnight Army and Special forces launch assault. 15 Terrorists and between 10 and 15 hostages

64. 2002 Bali Bombings Oklahoma city bombing 2013 Woolwich attack 1973 PAN AM FLIGHT 110 Riyah Compound bombing Muna Hotel Attack 2004 Al Khobar Massacre 1998 OMAGH BOMBING LO AIRPORT MASSACRE 1995 Paris Metro Bombing 1993 World Trade Centre Attack 2003 Red Square Bombing Batasang Pambansa Bombing April 2005 Cairo Attack 2007 Tourist Attack Yemen 2008 Danish embassy Bombing 1991 Vic Bombing Spain 2007 Ankara Bombing Remembrance Day Bombing

66. Impact of Terrorism Damage to Property Loss of Life Business Interruption Duty of Care Law Suits

67. Case Studies of Civil Liability of the Land Owner and Security Provider for a Mass Shooting Incident

68. Aurora Traynom –v.- Cinemark USA Inc., 2013 U.S. Dist. LEXIS 54981 (USDC-Col. 2013) Colorado Premise Security Act pre-empts Common Law Tort principals The injured and deceased plaintiffs are found to be “Invitees” as defined by the statute Landowner must use reasonable care to protect patrons against only those dangers of which the landowner actually knew or which the landowner should have known

69. Aurora (Continued) Defendants Motion to Dismiss on the Pleadings granted, but the Judge says it’s a “close call” Factors in favor of Dismissal on the Pleadings: –the unforseeablibity of the danger of a person such as James Holmes committing a mass killing Factors against Dismissal on the Pleadings: –Some prior incidents of violence at the subject location –The back door used by Holmes was propped open and went undetected –Security did not stop the film or turn on the lights –Delays cited in calling the police –The size of the exits and the need for people to leave quickly in an emergency

70. Columbine Castaldo –v.-Stone 192 F.Supp.2d 1124 (USDC-Col. 2001) Suit brought against sheriff, school district, and individual teachers and supervisors Claims of fault were not about the subject event Claims of fault concerned multiple previous events, which plaintiffs allege put sheriff and schools on notice

71. Columbine (Continued) The Court Grants Motion on Pleadings to Dismiss Factors against Dismissal: –School and sheriffs knew of many prior acts of vandalism and threats by Harris and Klebold –School aware of violent videos and written homework submission produced by shooter –School aware of specific violent threats to school by shooters on web postings –‘in-Loco-Parentis” status of the school

72. Columbine (Continued) Factors in Favor of Dismissal: –Qualified governmental immunity –No deliberate indifference –No proximate causation under Colorado Law despite awareness by the school defendants of warning signs of potential violent behavior –Harris and Klebold were the sole proximate cause

73. Premise Where Mass Violence is Foreseeable Seron v. Malagaliati 1998 Mass. Sup. LEXIS 46 Abortion clinic in Massachusetts Shooter kills one and injures another Injured security guard sues land owner Motion for Summary Judgment denied –This is the type of facility where the potential for armed violence is foreseeable –Question of Fact as the to adequacy of security despite presence of an unarmed guard

74. Contacts and Post Orders Key Issues to Avoid in Security Industry Contracts and Post Orders “warranty of service” “third-party beneficiary status” “guarantor of safety” “crime prevention” “security consultant”

75. No Warranty of Service Land owners use market forces to attempt transfer liability to security providers Cross claims in litigation typically include cross claims or third party claims against security service providers Claims are framed in terms of a guaranteed result NEVER WARRANTY A RESULT

76. Third Party Beneficiaries New York and Majority Rule is: –Third parties, such as tenants or patrons, cannot bring their own action against a security provider unless the contract expressly provides for such a benefit –Bernal v. Pinkerton’s Inc., 52 A.D.2d 760, 382 N.Y.S.2d 769 (1st Dept. 1976)

77. Insurance and Risk Transfer Landowners also use market forces to transfer risk to the security service provider Majority and New York rule is that an entity can not be forced to indemnify another for that other entity’s sole negligence This can be modified to the extent that the landowner requires to be named as an additional insured on the security service providers policy Indemnity provisions must be unequivocal

78. Data Privacy Risk April 09, 2014

79. Panelists Kurtis E. Suhs Vice President Ironshore, Professional Risk Kurtis.Suhs@Ironshore.com (404) 845-7549 Daniel Hecht, Assistant Vice President Ironshore, Claims Daniel.Hecht@Ironshore.com (646) 826-4869 Jane Devron Executive Vice President Reputation Partners, LLC Jane@ReputationPartners.com (312) 222-9886 Melissa K. Ventrone Attorney at Law Wilson Elser Moskowitz Edelman & Dicker, LLP Melissa.Ventrone@WilsonElser.com (312) 821-6105

80. Question If you could only do one thing in preparation for a breach, what would it be?

81. Who are the victims? 37%of breaches affected financial organizations (+) 24%of breaches occurred in retail environments and restaurants (-) 20%of network intrusions involved manufacturing, transportation, and utilities (+) 20%of network intrusions hit information and professional services firms (+) 38%of breaches impacted larger organizations (+) 27different countries are represented –A plus (+) sign indicates either a 10% or greater increase from the previous year’s report –A minus (-) sign indicates a 10% or greater decrease from the previous year’s report Source: Verizon 2013 Data Breach Investigations Report

82. Causes of Data Breaches Advance Persistent Threats Internet Malware Infections Drive by downloads Email attachments File sharing Pirated software Spear Phishing DNS & Routing Mods Physical Malware Infections Infected USB memory sticks Infected CD’s and DVD’s Infected memory cards Infected applications Backdoored IT equipment

83. Causes of Data Breaches Advance Persistent Threats –External Exploitation Professional Hacking Mass vulnerability exploits Co-location Host Exploitation Cloud Provider Host Exploitation Supply Chain Partner Exploitation Rogue Wi-Fi penetration Human Error

84. Enterprise PrivaProtector 9.0 Coverage Third Party Coverage Side A Excess D&O Liability Coverage Network Security Liability Coverage Privacy Liability Coverage Privacy Breach Expenses Coverage Regulatory Proceeding Coverage Internet Media Liability Coverage First Party Coverage Digital Asset Loss Coverage Business Interruption Loss and Dependent Business Interruption Income Loss Coverage Network Extortion Threat and Reward Payments Coverage

85. Highly Protected Information (HPI) Enhancement Benefits On-Call Chief Security Officer with 1 hour free telephone consultation Data Breach Coach with 1 hour free telephone consultation Privacy Breach Expenses in addition to Policy Aggregate Notification for up to 10 million affected customers Access to Ironshore e-Risk Hub loss portal https://www.eriskhub.com/ironshore.php https://www.eriskhub.com/ironshore.php Ability to qualify for the risk mitigation credit and achieve HPI designation to reduce premium and/or Privacy Breach Response SIR

86. The Target Data Breach Is Becoming A Nightmare – 1/17/14 2 million Facebook, Gmail and Twitter passwords stolen in massive hack – 12/4/13 Facebook admits year-long data breach exposed 6 million users – 6/21/13 Florida Hospital facing class-action suit for data breaches – 4/16/13 Advocate Health Care sued following massive data breach – 9/6/13 Michaels Stores Sued After Reporting Possible Data Breach -1/27/14 Reputation: What’s at Stake?

87. Data Breach: Mitigating Reputational Risk Response (after a breach): Urgency – Don’t sit on it; Notify thoughtfully but quickly Don’t Under-React -- Resist the desire to soften the blow or underestimate the scope of the breach; Will come back to bite you Transparency – Acknowledge what you know, how you expect people to be impacted and specifically how you plan to remedy Empathy – Prepare for a range of reactions (anger, fear, frustration); Assuage fears and offer support (credit monitoring and resolution services, etc.)

88. Data Breach: Mitigating Reputational Risk Planning (before a breach): Develop a Plan – Messages/materials drafted, spokespeople identified and trained, dark site developed, roles/responsibilities defined Invest in Reputation – Build trust and a bank of goodwill

89. Questions