Cyber Insurance Market Expected to Grow

As high-profile cyber threats to data security and privacy grow, many businesses are turning to cyber insurance for protection.

Although cyber insurance has been in existence for more than a decade, the market for cyber coverage has recently begun to expand as the cost of data breaches and other cyber threats continues to grow, according to an article by Nicole Perlroth.

The average cost of a data breach hit $7.2 million last year and cost companies $214 per compromised data record, according to the Ponemon Institute. And that's just for a data breach. If a company's intellectual property is stolen, it could decimate an organization.[1]

In the past, businesses have generally been reluctant to discuss cyber and data threats publicly, and some companies have been unwilling to commit significant resources to protecting against these threats.

Despite high-profile cyber attacks at Sony, Google, Epsilon, RSA and others this year, only a third of companies surveyed by Advisen, a research group, say they have purchased a cyber insurance policy.[2]

The business risks of cyber threats have become so prominent, in fact, that the U.S. Security and Exchange Commission recently issued guidance requiring companies to disclose "material" cyber attacks and related cost to shareholders, as well as any "relevant insurance coverage."[3]

Cyber insurance protects against the "twin risks" of data privacy and security.

A comprehensive cyber insurance policy should protect against the "twin risks" of data privacy and security, according to Emily Freeman, a cyber insurance broker. Cyber insurance should provide coverage for intellectual property theft, "the cost of lost business, notification costs, credit-monitoring services, public relations and legal and investigation expenses" as well as "class-action lawsuits, regulatory investigations, civil fines and even extortion demands."[4]

Despite past reluctance by some in the business world to address cyber and data threats with insurance coverage, Perlroth's article suggests that the cyber insurance market is on the verge of considerable growth.

There are no statistics on the size of the cyber insurance industry, but Peter Foster, a senior vice president at Willis North America, an insurance broker, estimates there may be $750 million worth of premiums placed. With the recent S.E.C. measure and the frequency and severity of cyber attacks growing, Mr. Foster predicts that figure could grow by 50 percent over the next 12 to 18 months.[5]

Julie Campbell at Live Insurance News agrees, indicating that 2012 will begin a massive expansion in cyber attack insurance.[6]

This year, the world watched as many corporations – even those that are reputed to have the strongest security systems in place – experienced massive data breaches that were so extensive that their final damage total has yet to be calculated.[7]

Earlier this year, one massive cyber attack showed that small-time hackers and identity thieves are not the only significant threat to information privacy and security.[8]

Approximately 48 chemical and defense companies in the U.S. were the targets of a large cyber attack earlier this year.

Symantec Corp., a leading data security firm, announced that "approximately 48 chemical and defense companies in the U.S. were the targets of a large cyber attack" in October. The attack was traced back to China and it "has been linked to industrial espionage, as the compromised information detailed chemicals, formulas and manufacturing processes used in military and industrial ventures."[9]

1. Insurance Against Cyber Attacks Expected to Boom, Nicole Perlroth, December 23, 2011.
2. Insurance Against Cyber Attacks..., Id.
3. Insurance Against Cyber Attacks..., Id.
4. Insurance Against Cyber Attacks..., Id.
5. Insurance Against Cyber Attacks..., Id.
6. 2012 Will Begin a Massive Expansion in Cyber Attack Insurance, Julie Campbell, LiveInsuranceNews.com, December 26, 2011.
7. 2012 Will Begin a Massive Expansion..., Id.
8. The Need for Cyber Insurance Grows in Light of Recent Attack on 48 Chemical and Defense Companies in the U.S., Stephen Vagus, LiveInsuranceNews.com, November 2, 2011.
9. The Need for Cyber Insurance Grows..., Id.

Privacy Insurance and Financial Losses from Data Breach

Toby Merrill's article in the Advisen Cyber Liability Journal gives an overview of privacy insurance, also known as network security or cyber insurance, to "cover the financial losses arising from a data breach" that can also include "access to expert advice and services."

Privacy insurance has become more prominent as increases in the scope of federal and state privacy laws "continue to fuel a rise in publicly reported corporate data breach incidents."

Merrill, an Assistant Vice President in the Professional Risk division of ACE USA, warns that not all privacy insurance products are created equal:

While most policies and endorsements address both first-party and third-party exposures, there are often wide differences in coverage terms, conditions, exclusions and financial limits.

Many policies, for instance, may highlight large limits of insurance coverage for statutory notification to the affected parties of a breach and the monitoring of their credit, but fail to provide adequate financial limits or choice among the vendors providing assistance in the aftermath of a data breach.

Thanks to Nina Kallen at Insurance Coverage Law in Massachusetts for the find.

Top NAIC Officials to Scrutinize Lender-Placed Insurance

Insurance regulators focus attention on lender-placed / force-placed insurance amid allegations of monopoly and excessive premiumrates.

Both the current President of the National Association of Insurance Commissioners ("NAIC"), Kevin M. McCarty, and the NAIC President-Elect, James J. Donelon, have turned the insurance regulatory spotlight onto insurance that protects mortgage lenders and lien holders from certain property risks when homeowners allow their property insurance coverage to lapse – known as lender-placed or force-placed insurance.

McCarty intends to examine lender-placed insurance premiums and business practices.

McCarty, who is also Commissioner of the Florida Office of Insurance Regulation, intends to examine lender-placed insurance premium rates and the business practices of insurance carriers who write lender-placed insurance amid allegations of excessive rates. Two companies, Assurant, Inc. and QBE Insurance Group, Ltd., control as much as 90% of the force-placed market, according to McCarty.[1]

Donelon, also Commissioner of the Louisiana Department of Insurance, said the force-placed insurance industry is a "monopoly… that is perpetuating itself" at a recent NAIC hearing, according to an article from Bloomberg. The situation is "extremely profitable for two remaining companies in the market," according to Donelon, "Nobody is minding the store."[2]

Force-placed premiums more than tripled to $5.5 billion in 2010 from $1.5 billion six years earlier, according to New York Department of Financial Services Superintendent Benjamin Lawsky. The insurers often pay out less than 25 cents for every dollar in premiums they collect, he said, compared with about 63 cents on a typical homeowner’s policy.[3]

According to the executive director of the Center for Economic Justice, Birny Birnbaum, premium rates currently charged by force-placed insurers "are not justified when examining the companies' performance and profits over the years."[4]

Others suggest the rate increases are justified by the recent rise in foreclosures, as well as other market forces.

But John Frobose, president of American Security Insurance, suggests the increase in lender-placed insurance is justified by the recent rise in foreclosures, as well as other market forces. Because insurance carriers that write force-placed insurance have been subject to greater hazards, the associated premiums have also risen.[5]

Robert Hartwig, president of the Insurance Information Institute, suggests that the rise in lender-placed premiums has peaked. Hartwig predicted that the market for lender-placed insurance should "contract as foreclosures drop and the U.S. economy improves."[6]

Hartwig, along with the executive director of the American Bankers Insurance Association, Kevin McKechnie, defended lender-placed insurance premium rates, explaining that "carriers do not underwrite individual risks, but rather provide a portfolio of coverage to lenders where insurers are taking on risks… with virtually no information about them."[7]

Insurers also defended the higher rates they charge, saying that because the risks are primarily in catastrophe zones, higher premiums are needed to prepare for what they say is the inevitability of major losses.[8]

Nevertheless, Commissioners McCarty and Donelon, as well as other insurance regulators like Kentucky Insurance Commissioner Sharon Clark, intend to take a critical look at force-placed insurance premium rates and business practices, as well as the costs associated with the administration of lender-placed insurance placement, including the compensation paid to agents and lending institutions.[9]

The lender-placed insurance industry also faces proposed new regulations from the Consumer Financial Protection Bureau.

In addition to increased scrutiny by state-based insurance regulators, the lender-placed insurance industry also faces proposed new rules from the Consumer Financial Protection Bureau, created under the Dodd-Frank Act. The proposed new rules require servicers "to give advance notice and pricing information before charging consumers for the coverage" and "to terminate the insurance within 15 days" upon receipt of evidence that the homeowner has the necessary insurance.[10]

1. U.S. Regulators to Examine Forced-Place Insurance, Zachary Tracer and David Beasley, Bloomberg, August 10, 2012.
2. Insurance for Lapsed Borrowers Lacks Oversight: Regulator, Zachary Tracer and David Beasley, Bloomberg, August 9, 2012.
3.  U.S. Regulators..., id.
4. NAIC Promises Greater Focus on Force-Placed Insurance as CFPB Proposes Rules, By Mark E. Ruquet, PropertyCasualty360.com, August 10, 2012.
5.  U.S. Regulators..., id.
6.  U.S. Regulators..., id.
7. NAIC Promises..., id.
8. NAIC Promises..., id.
9.  U.S. Regulators..., id., NAIC Promises..., id.
10. NAIC Promises..., id.

Independent Directors Liability Insurance

Independent Directors Liability insurance is a specialized form of D&O coverage that provides liability protection for directors even when the limits of standard D&O coverage are exhausted.

The practice of insurance regulatory law is not only about compliance with the various state and federal laws and regulations that impact the insurance industry, its also about protecting your clients and their businesses.

To that end, Elizabeth Judd at Corporate Secretary has an interesting article entitled Do Directors Need Separate Liability Coverage?

IDL coverage limits are not sapped by corporate liabilities, and thus IDL is an option when all other sources of funding are depleted.

As her article details, Independent Directors Liability insurance (“IDL”) provides liability protection for directors outside the limits of the standard directors and officers (“D&O”) insurance coverage that most companies obtain. IDL is a specialized form of D&O coverage that protects only the directors, and it pays out even if the company’s D&O coverage is exhausted.

Scott Godes, counsel at Dickstein Shapiro and author of the Corporate Insurance Blog, is quoted in the article as noting that, while insurance firms have 'remarkably creative lawyers who can find ways to deny coverage or rescind the policy' when D&O claims get messy, these IDL policies are typically being marketed as nonrescindable, which could be a good sign for insured directors.

IDL coverage is an option when all other sources of insurance and funding are unavailable or depleted. IDL coverage does not cover the acts or omissions of the entity or the wrongful acts of the insiders; thus, IDL limits are not sapped by corporate liabilities, according to Godes.

For more of Scott Godes' comments about IDL, check out his Corporate Insurance Blog.

And read the full article from Elizabeth Judd:

Do Directors Need Separate Liability Coverage?
Elizabeth Judd | Corporate Secretary
May 26, 2011