By Jeffrey\nA. Franklin, Prince Law Offices P.C.<\/a><\/p> Cyber\ninsurance policies are now standard procedure for companies seeking to shift\nsome risk in case of malware attacks and cyber hacks. In a test of the\ndeveloping cyber insurance industry, Zurich America Insurance Company is\nreportedly refusing to pay out a $100 million claim from consumer packaged good\ncompany Mondelez, which was a victim of the NotPetya ransomware attack in June\n2017. Zurich says that the NotPetya ransomware attack was an act of \u201ccyber war\u201d\nand is therefore not covered by the policy. Mondelez Int\u2019l, Inc. v. Zurich Am. Ins. Co., No.\n2018-L-11008, complaint filed, 2018 WL 4941760 (Ill. Cir. Ct., Cook Cty., Oct.\n10, 2018).<\/p> The NotPetya\nattack impacted businesses worldwide, reportedly including Ukrainian banks,\nenergy companies, airports and shipping giant Maersk.<\/p> What the Cyber Insurance Policy\nCovers<\/strong><\/p>\n\n\n\n According to\nMondelez, its cyber insurance policy with Zurich covered \u201call risk of physical\nloss or damage to electronic data, programs or software\u201d due to \u201cthe malicious\nintroduction of a machine code or instruction.\u201d NotPetya would seem to fit the\ndefinition included in the policy.<\/p> Zurich Uses \u201cAct of War\u201d Clause to\nAvoid Paying Claim<\/strong><\/p>\n\n\n\n Zurich is\ninvoking a \u201ccyber war\u201d clause claiming NotPetya was \u201ca hostile or warlike\naction in time of peace or war.\u201d Zurich argues that the cyber-attack originated\nwith Russian hackers working directly with the Russian government to\ndestabilize the Ukraine. That is what Zurich alleges constitutes \u201ccyber war.\u201d To\nsupport its case, Zurich cites official statements of national security\nofficials from the UK, Canada and Australia blaming Russia for the February\n2018 cyber attack. These and other Western governments including the United\nStates also noted that the first NotPetya attack occurred in Ukraine before\nspreading around the world. Russia has denied involvement. <\/p> Implications for Cyber Insurance<\/strong><\/p>\n\n\n\n The burden\nof proof should fall on the insurance company to prove that NotPetya was an act\nof cyber war. That will be a heavy burden. The intelligence agencies are not\nlikely to furnish proof of an attack despite their blaming Russia in this instance\nfor the attacks. Regardless of this heavy burden, many worry that other\ninsurance companies will claim that other cyber attacks or data breaches are\ndue to an \u201cact of cyber war\u201d and reject their claims as well, leading many to\nwonder just how reliable a partner the cyber insurance industry will be when it\nis needed the most by its paying customers. From the insurance\nindustry perspective, the costs of cyber attacks are skyrocketing. According to\nexperts, the NotPetya cleanup alone totaled close to $80 billion. It wasn\u2019t\njust Mondelez; it was shipping giant Maersk with losses close to $300 million, with\nFedEx also having close to $300 million in losses from NotPetya. <\/p> Things to Consider<\/strong><\/p>\n\n\n\n When\nconsidering the value of your cyber insurance policy, review the terms of the\npolicy carefully, but also consider the company issuing it and whether the\ncompany will stand behind the policy and provide the risk mitigation your\nbusiness planned for when it needs it the most.<\/p> Jeffrey A. Franklin<\/em><\/a> heads the Cyber Law group at Prince Law Offices P.C. He is also the president and Technology Committee Chair of the Berks County Bar Association and principal technology consultant with BrightLine Tech Solutions LLC. <\/em><\/p> By Jeffrey A. Franklin, Prince Law Offices P.C. Cyber insurance policies are now standard procedure for companies seeking to shift some risk in case of malware attacks and cyber hacks. In a test of the developing cyber insurance industry, Zurich America Insurance Company is reportedly refusing to pay out a $100 million claim from consumer
<\/p>\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n","protected":false},"excerpt":{"rendered":"
Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[28,9],"tags":[],"_links":{"self":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/239"}],"collection":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/comments?post=239"}],"version-history":[{"count":6,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/239\/revisions"}],"predecessor-version":[{"id":248,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/239\/revisions\/248"}],"wp:attachment":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/media?parent=239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/categories?post=239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/tags?post=239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}