A vendor emails your accounting team with updated payment instructions. The invoice looks legitimate, the amount is correct and the message appears in an existing email conversation. Your team sends the payment. Days later, the real vendor asks why it has not been paid.
A system was breached, and the loss event begins with one email, but the questions that follow reach well beyond the IT department. Can the bank recover the funds? Was a vendor account compromised? Did anyone gain access to company or employee personal identifiable information (PII)? Who investigates the breach, who communicates with the vendor and which insurance policy responds?
As we recognize Cybersecurity Awareness Month, it’s important to note that the scenario above can be expensive if not planned for in your insurance strategy. Put simply, cybersecurity is risk management. It calls for controls that make an incident less likely, a plan for keeping the business operating and insurance that fits the losses the company could face.
What is cyber insurance?
Cyber insurance is coverage designed to help a business respond to certain losses arising from a cyber incident. Depending on the policy, it may help pay for forensic investigation, legal guidance, data recovery, notification costs and lost income during a covered interruption. It may also address claims brought by others after a privacy or security breach. These are often described as first-party costs and third-party liability.1 (Federal Trade Commission)
Privacy liability deserves particular attention. A company may hold customer records, employee information (PII) or other sensitive data that could expose it to claims if that information is compromised. HR, finance and technology leaders should know what data the company has, where it is kept and which vendors can access it.
Cyber coverage should be reviewed as a standalone part of the company’s insurance program and not simply an addition to the general insurance strategy, i.e., a business should not assume that a provision added to another policy provides the same protection as a dedicated cybersecurity policy. Even within a dedicated policy, coverage for fraudulent transfers like the one above, business interruption or an incident at a vendor may have its own terms or lower limits to coverage.
Why should executives care?
A CEO may need to make immediate decisions about operations, customers and public communications. A CFO must assess lost revenue, recovery expenses and the company’s ability to absorb an uninsured loss. A CTO leads the technical response and needs to know how to engage outside specialists without delaying containment. An HR executive may need to protect employee information, address payroll disruption and communicate with the workforce.
Those responsibilities intersect. If systems stop working or are breached, the company still needs to pay employees and serve clients. If a fraudulent payment goes out, the bank and insurer may need prompt notice. If data is exposed, the company’s legal counsel may need to assess notification duties. The FTC recommends assembling a response team that can include leadership, technology, legal, operations, HR and communications.2 (ftc.gov)
A small event can create a large bill
Consider that a hypothetical business email incident can results in losses of $75,000 to $100,000. The initial loss might be a diverted payment as above. Investigation, legal work and interrupted operations could add to it. (This is an illustration, not an average claim amount or a promise that insurance would cover the total.)
Cybercrime has become an organized business. Criminal groups can buy stolen credentials or tools and divide the work of gaining access, committing fraud and moving funds. A convincing email may be only one step in a larger scheme as they attack a company multiple ways beyond the initial fraudulent transfer.
That is why external and internal controls both matter. A company can require multifactor authentication and secure its systems while also requiring an independent callback before changing a vendor’s bank details. Note: A reply in the same email thread does not independently verify a payment change.
Start with one question: If a cyber incident happened tomorrow, would your leadership team know whom to call first and what your insurance is designed to cover?
Next installment: Cyber Insurance, a checklist
Author: Todd Keenan
Sentinel’s Cybersecurity Practice and Portal
