Are you ready for Cyber Claims?

In 2022, Howden saw an astonishing 200% increase in cyber-incident notifications.  Whilst each notification gave us new insights into the diverse ways a cyber-incident could occur, equally, each also presented a myriad of outcomes depending on various factors such as the type and quantum of data affected, the extent of infiltration and/or exfiltration, as well as how the incident was managed.  

At Howden, we take each cyber claim experience seriously.  Instead of merely looking forward to the claim payment as a happy ending, we reflect on and analyse how we and our clients could have managed the claim better and can be better prepared for the next cyber claim.

Drawing on our cyber claims management experience, here are some tips which  will help make any future cyber claim process a smoother and less stressful one. 

Case Studies

Below, we share two contrasting case studies which will illustrate how cooperation by insureds and their adherence to the policy terms and conditions can make a real difference to the claim outcomes. 

Whichever industry your organisation may belong to, there is always a risk that a third party vendor you engage to manage your company’s computer system may inadvertently or negligently expose your organisation to cyber risks.  

For example, a coding error by a third party vendor can result in emails with personal data being sent to unintended recipients!  No one is immune to such situations – as was the case for a few of our clients.  Like any responsible organisation would, some of our clients immediately engaged various service firms to contain the damage and manage the potential liabilities resulting from the error.  They then turned to the insurers to claim for the fees of the hired vendors.

However, because the insurers were deprived of the opportunity to review the engagement and terms of the vendors, such as the vendors’ hourly rates and scope of work, not only did it result in claim processing delays, but some clients even had to absorb a substantial difference between the actual vendor fees charged and the vendor fees the insurers felt was reasonable based on the charge-out rates and the time spent. 

What can you learn? 

Cyber insurers typically pre-approve a panel of reputable specialist vendors to assist their insureds in the event of a suspected or actual cyber incident, and their policies typically contain a condition requiring insurers’ prior written consent for the engagement of a non-panel vendor. 

These measures facilitate expedient incident response by placing management of the cyber incident in experienced and competent hands.  This minimises not only uncertainty and confusion for insureds but also excessive erosion of their policy limits due to unnecessary remediation costs. 

Upon request, Howden can help facilitate a meeting between you and your cyber insurer to familiarise yourself with the cyber claim process and the insurer’s panel of existing vendors as soon as it is practicable following inception of your cyber policy.  Always remember, if you prefer using your own cyber incident vendors, you should seek pre-approval of these vendors prior to policy inception or as soon as that decision is made during the policy period, or in the event of a cyber-incident, your cyber insurer’s prior written consent.  

Another client of ours experienced double extortion where their confidential corporate data (including the backup copies) were encrypted and exfiltrated in return for a ransom. 

In this case, our client did not hesitate to seek guidance from their insurer, the incident response manager and Howden when required. Transparent and open communication between the various stakeholders throughout the whole claim process resulted in the insured not falling foul of the policy terms and conditions and being able to furnish the insurer with the relevant information and documents in a timely fashion.  Overall, with almost no administrative hurdles, the claim was paid in full and processed in the most efficient manner.  

What can you learn? 

When insureds work in sync with insurers, the cyber incident vendors and Howden, they increase the chances of enjoying full indemnity and faster payout under the policy. 

Confirmation of coverage doesn't mean everything is covered

In the course of handling the above and other cyber claims, we observed that insureds tend to get confused between coverage confirmation and extent of coverage.  Confirmation of coverage simply means the policy will respond to the cyber incident.  However, that does not mean every expense incurred in consequence to the incident is covered.  The extent of coverage will depend on the specific policy language.  

That is why it is important for insureds to have an honest and continuous conversation with insurers (either directly or through the IRM/Howden), throughout the claim process, on the expenses to be incurred and the scope of work to be done so as to enable insurers to provide guidance on whether a certain item would likely fall within the scope of the policy.  Otherwise, insureds could end up having some of their expenses not indemnified.

We have many more of such interesting stories to share with you and continue to grow “cyber-ready” together.  Stay tuned for more!

Authored by:

John Poon Senior Director, Financial Lines Get in touch	Azlin Fathima Manager, Financial Lines Get in touch