What you don’t know … Ordinary insurance may not protect companies in case of cyber losses

Sills Cummis’ Thomas Novak talked to NJBIZ about cyber insurance coverage for businesses, especially small- and mid-size businesses.

As seen in this article,  Novak stated, “‘I find that most smaller- and mid-sized businesses do not have cybercrime or cyber liability insurance,’ cautioned Thomas Novak, a Sills Cummis & Gross PC member. ‘Both coverages are often offered by insurers as part of a package policy in conjunction with D&O [directors and officers liability] insurance and EPLI [employment practices liability insurance]. Businesses without D&O almost never have either coverage. Even small- to mid-sized businesses that have D&O rarely purchase cyber liability. Additionally, cybercrime is often covered by crime policies, but few small- to mid-size businesses take this coverage.’

“The situation is often exacerbated because ‘most businesspeople do not like to discuss their insurance prior to a loss,’ he added. ‘As a litigator, I usually do not become involved with the situation until after a problem has occurred. Where a client has been hacked and they lack insurance, I review what would have potentially been covered had they purchased the insurance. Where they have insurance but an exclusion applies, I review other policy forms that lack or limit the exclusion so they have better protection going forward.’

“Novak and Sills Cummis represented a national nonprofit medical institution that was licensing third parties’ intellectual property to foreign entities. ‘It had a major concern about being held liable for damages if the IP was not protected or was the subject of a hack,’ he said. ‘We reviewed the various coverages available in the marketplace and ultimately negotiated a surplus lines coverage that met its somewhat unique needs. Cyber risk lays at the intersection of two different coverages: crime and cyber liability. Cybercrime is typically covered by a crime policy whereas cyber liability is covered by a cyber liability policy. Few policies cover both of these risks.’”