Hunton Andrews Kurth insurance partner Michael Levine was recently interviewed by LegalTech News concerning Ohio’s recent adoption of the National Association of Insurance Commissioners’ (NAIC) Insurance Data Security Model Law. The law, modeled after the New York State Department of Financial Services Cybersecurity Requirements for Financial Service Companies Act, seeks to provide a framework for states to address risks and develop cybersecurity guidelines for insurance companies. Ohio became the second state, after South Carolina, to adopt the model law. As Mike explained in the article, the statute provides policyholders with an added layer of protection against disclosure of sensitive and confidential information that may be held by insurers operating in the state.

A link to the article featuring Mike’s comments can be found here.

New cybersecurity rules for insurance companies licensed in South Carolina are set to take effect in part on January 1, 2019. The new law is the first in the United States to be enacted based on the data security model law drafted by the National Association of Insurance Commissioners. The law requires licensed insurance companies to notify state insurance authorities of data breaches within 72 hours of confirming that nonpublic information in the company’s (or a service provider’s) system was “disrupted, misused, or accessed without authorization.” The breach reporting requirement is in addition to notification obligations imposed under South Carolina’s breach notification law and applies if the insurance company has a permanent location in the state or if the breach affects at least 250 South Carolina residents, among other criteria. The 72-hour notice requirement takes effect January 1, 2019. Continue Reading Cybersecurity Rules for Insurance Companies to Take Effect in South Carolina

The head of Hunton Andrews Kurth’s insurance practice, Walter Andrews, was interviewed earlier this week by ABC 7 (WJLA) concerning the need for cyber insurance and the benefits that it can provide to government contractors and other businesses that are impacted by a cyber event.  Andrews explains the diverse spectrum of benefits that are available through cyber insurance products, but cautions that a serious lack of uniformity exists among today’s cyber insurance products, making it crucial that policyholders carefully analyze their cyber insurance to ensure it provides the scope and amount of insurance they desire.

Continue Reading Hunton Insurance Head Interviewed Concerning the Benefits and Hidden Dangers of Cyber Insurance

A California federal court found coverage under AIG’s general liability policy for the defense and indemnity of email scanning suits against Yahoo!. Those suits generally alleged that Yahoo! profited off of scanning its users’ emails. Because the allegations gave rise to the possibility that Yahoo! disclosed private content to a third party, the court found that the suit potentially fell within the coverage for “oral or written publication, in any manner, of material that violates a person’s right of privacy.” Thus, AIG’s duty to defend was triggered.

The court also found that AIG had a duty to indemnify for Yahoo!’s settlement in the email scanning suits. One key question was whether the settlement amount paid as attorneys’ fees to plaintiff’s counsel constituted damages under the policy. The court concluded that they were, based on the fact that the plaintiffs sought attorneys’ fees under a statute and on its finding that Yahoo! would reasonably expect that those fees would qualify as damages.

Yahoo! had also alleged that AIG acted in bad faith in its claims handling because AIG had denied coverage for the first two lawsuits and then ultimately acknowledged such an obligation with respect to the third lawsuit and in so doing had cited exclusions that were not a part of the policy. The court found that issue was one for a jury to decide.

This decision is another example that valuable cyber coverage for defense and indemnification may be available under general liability policies. Of course, whether there is coverage will depend on the particulars of the claim and the insurance policy.

Hunton Andrews Kurth insurance practice head, Walter Andrews, recently commented to the Global Data Review regarding the infirmities underlying an Orlando, Florida federal district court’s ruling that an insurer does not have to defend its insured for damage caused by a third-party data breach.

Continue Reading Hunton Insurance Head Comments On Hotel Data Breach Coverage Dispute

As reported yesterday in Business Insurance, Lloyd’s of London underwriters have agreed to insure digital currency storage company, Kingdom Trust Co., against theft and destruction of cryptocurrency assets.  The cover comes after almost a decade-long search by Kingdom Trust for insurance to cover its crypto-assets.  According to the BI, Kingdom Trust sees the availability of insurance as a key factor in bringing institutional investors into the marketplace by dispelling concerns about lack of traditional safeguards in the emerging crypto-asset space.

Continue Reading Lloyds Jumps Into The Cryptocurrency Market, Insuring Part of Kingdom Trust’s $12 Billion Assets

The Sixth Circuit has rejected Travelers Casualty & Surety Company’s request for reconsideration of the court’s July 13, 2018 decision, confirming that the insured’s transfer of more than $800,000 to a fraudster after receipt of spoofed e-mails was a direct loss” that was “directly caused by” the use of a computer under the terms of ATC’s crime policy.  In doing so, the court likewise confirmed that intervening steps by the insured, such as following the directions contained in the bogus e-mails, did not break the causal chain so as to defeat coverage for “direct” losses.

Continue Reading Sixth Circuit Declines Reconsideration of American Tooling Center’s “Spoofing” Win

The Second Circuit has rejected Chubb subsidiary Federal Ins. Co.’s request for reconsideration of the court’s July 6, 2018 decision, confirming that the insurer must cover Medidata’s $4.8 million loss under its computer fraud insurance policy.  In July, the court determined that the loss resulted directly from the fraudulent e-mails.  The court again rejected the insurer’s argument that the fraudster did not directly access Medidata’s computer systems.  But the court again rejected that argument, finding that access indeed occurred when the “spoofing” code in emails sent to Medidata employees ended up in Medidata’s computer system.

Continue Reading Second Circuit Stands By Medidata “Spoofing” Decision

In a recent article appearing in Florida’s Daily Business Review (available here), Hunton Insurance Recovery Practice team head, Walter Andrews, explains why phishing and whaling scams should be covered by insurance.  In the article, Andrews notes that recent appellate decisions support policyholders’ reasonable expectations of coverage and reject insurers’ contentions that social engineering losses do not result directly from the use of computers.  Andrews goes on to explain that should a company find itself a victim of a phishing or whaling attack, it should carefully assess its insurance coverage to determine whether it applies to the loss, including under both traditional insurance policies and specialized cyber insurance products, and not be dissuaded by their insurers’ initial denial of coverage.

On Monday, a Nevada federal court held that U.S. Fire Insurance Co. (“U.S. Fire”) need not cover its insured, CP Food and Beverage, Inc. (“CP”), a strip club, under its commercial crime policy for a scheme perpetrated by its own employees that resulted in the theft of money from CP customers. A copy of the decision can be found here.

Continue Reading Las Vegas Strip Club Left Exposed After Determination Of No Coverage