Cyber Liability from Mercer

CYBER LIABILITY INSURANCE

Cyber Liability is the risk posed by conducting business over the internet, over other networks, or using electronic storage technology. Cyber Liability insurance is designed to mitigate losses from a variety of cyber incidents:

  • Data breaches
  • Network damage, including third-party lawsuits due to loss of privacy

Primary cyber exposures include Personally Identifiable Information (PII), retained data, credit card theft, and business identity information claims. Attacks on your members’ computers that aren’t protected can result in the theft of PII and other information.

Through a partnership with Edgewater Holdings, LTD, Mercer Consumer has developed an integrated insurance and risk management program for Cyber Liability. The program offers access to human resources- and data management-related services which provides superior products and services through a simplified process.

  • Coverage Highlights
  • FAQs
  • Claim Scenarios
  • Coverage for damages to third parties caused by a breach of network security
  • Coverage for loss resulting from administrative or operational mistakes
  • Breach of privacy coverage — includes damages resulting from alleged violations of HIPAA, state and federal privacy protection laws and regulations
  • Customer Notification Expenses include legal expenses, credit monitoring expenses, postage, and advertising costs
  • Risk management services to assist with mitigating losses and navigating breaches

This is often a misconception by policyholders and we find that the majority of errors & omissions policies do not cover cyber or privacy breaches. An E&O policy typically limits coverage to claims arising from negligence in the performance of specifically defined services and exclude coverage for criminal or intentional acts of insured’s or their employees.

47 of 50 states require a breach to be reported to those affected if any personal identifiable information (PII) is leaked. Any company who does not report these breaches is subject to hefty fines and penalties from various state and industry regulators. If you are a firm servicing clients in multiple states, a single breach can be a costly in just legal expenses to translate the requirements of each states law. Having the proper Cyber Privacy Liability coverage in place can provide assistance and help cover these expenses.

For more information or to speak with a Client Representative, please contact our office at 1-866-486-1946.
The average cost of a data breach is $204 per lost record, with more than half of such costs attributable to lost customers and the associated public relations expenses to rebuild an organization’s reputation.1 The below examples illustrate situations in which the costs incurred to remediate a data breach were significant.

An international computer hacking group gained access electronically to the computerized cash registers of a restaurant chain and stole credit card information of 5,000 customers, starting a flood of fraudulent purchases around the world.

A regional retailer contracted with a third party service provider. A burglar stole two laptops of the service provider containing the data of over 800,000 clients of the retailer. Under applicable notification laws, the retailer - not the service provider - was required to notify affected individuals. Total expenses incurred for notification and crisis management to customers was nearly $5,000,000.

An employee of a rehabilitation center improperly disposed of 4,000 client records in violation of the center’s privacy policy. The records contained social security numbers, credit and debit card account numbers, names, addresses, telephone numbers as well as sensitive medical information. The center settled the claim with the state of Massachusetts and agreed to pay fines and penalties imposed by the state as well as extend $890,000 in customer redress funds for credit monitoring on behalf of the victims.

A home healthcare organization had backup tapes, laptops and disks containing social security numbers, clinical and demographic information, and in a small number of cases, patient financial data that was stolen. In total, over 365,000 patient records were exposed. The organization settled with the state attorney general, providing patients with free credit monitoring, credit restoration to patients that were victims of identity fraud, and reimbursement to patients for direct losses that resulted from the data breach. The organization was also required to revamp its security policies, implement technical safeguards and conduct random compliance audits.

A non-profit community action corporation printed two 1099 forms on one piece of paper. An employee was supposed to separate the forms and send each to its rightful owner. Instead, one person received both copies. The mistake sent tax forms and social security numbers to strangers. Approximately 50% of the landlords who work with the community action corporation received their forms in addition to the private information of the others.

A U.S. based information technology company contracted with an overseas software vendor. The contracted vendor left universal “administrator” defaults installed on the company’s server and a “Hacker for Hire” was paid $20,000 to exploit such vulnerability. The hacker advised if the requested payment was not made he would post the records of millions of registered users on a blog available for all to see. The extortion expenses and extortion monies are expected to exceed $2,000,000.

An employee of a private high school mistakenly distributed via e-mail the names, social security numbers, birthdates and medical information of students and faculty creating a privacy breach. Overall, 1,250 individuals’ information was compromised.

A juvenile released a computer worm directing infected computers to launch a denial of service attack against a regional computer consulting & application outsourcing firm. The infection caused an 18 hour shutdown of the entity’s computer systems. The computer consulting & application outsourcing firm incurred extensive costs and expenses to repair and restore their system as well as business interruption expenses which totaled approximately $875,000.
1Ponemon Institute, 4/2009 Global Cost of a Data Breach Study.

GET A QUOTE

Healthcare Professionals

Individual Practitioner Quote
Group Practitioner Quote

Business Professionals

Get a Quote

Law Firms

Get a Quote

Be Prepared and Protected from a Costly Data Breach. Get the coverage you need to respond quickly and effectively.

Approximately every 3 ½ seconds a new threat is unleashed by cyber criminals into the online world of the internet. These criminals can range from middle schoolers who vandalize websites to international terrorists who target a country’s defense infrastructure.

Businesses face increasingly complex information and computer security risks. If you house or store client confidential information of anything defined as Personally Identifiable Information (PII), cyber criminals have an interest in your stored data files to target, breach and obtain such information.

The Cyber Privacy Liability policy available through Mercer Consumer, a service of Mercer Health & Benefits Administration LLC, has been tailored specifically for our policyholders and is not available outside our network.

Data breaches can be incredibly costly — both in immediate hard costs and in longer-term soft costs.

RESOURCES

Provide peace of mind by offering Cyber Liability insurance.

QUESTIONS

Let us help you! Call a representative today.

1-866-486-1946

Copyright 2019 Mercer LLC. All rights reserved.
Mercer Health & Benefits Administration LLC
AR Insurance License #100102691
CA Insurance License #0G39709
In CA d/b/a Mercer Health & Benefits Insurance Services LLC. | Privacy Policy | Terms of Use