September 18, 2018

Where to Find the Risks Technology Viruses, SQL Injections, DDoS attacks Structural vulnerability Social Media / Networking Phishing Internal Rogue employees Careless staff Regulatory SEC, FTC, state attorneys general 47 State Breach notification laws NIST Cybersecurity Framework HHS, HIPAA & HIPAA HITECH Identity Theft Red Flags Rule Foreign Laws General Data Protection Regulation Old School Laptop theft Dumpster diving External Customers Authors, producers, publishers, competitors Business associates Vendors / Suppliers Foreign and domestic organized crime Hackers / Hacktivists 2

Threat Vectors Simplified 3

The Value of Your Data Of the following, which is the least valuable type of data on the black market? Healthcare information (names, birth dates, insurance policy numbers, diagnosis codes) Credit card data Twitter username and password Social Security Number and date of birth (but no name) 4

The Value of Your Data Of the following, which is the least valuable type of data on the black market? Healthcare information (names, birth dates, insurance policy numbers, diagnosis codes) Credit card data Twitter username and password Social Security Number and date of birth (but no name) 5

Third Party Coverages Description Coverage Overview Coverage Part Third Party Coverages Description Privacy Liability Defense and liability for failure to keep information private or for failure of others that you have entrusted with information to keep it private (ex. pension actuary, data storage facility, credit card processor). Also includes liability for not properly notifying of a privacy breach. Coverage has expanded to include corporate confidential information and non-computer related information. Likely Claimants: Customers, employees Security Liability Defense and liability for failure of systems to prevent spread of virus or a denial of service to those that rely on systems due to a failure in network security. Likely Claimants: Customers Media Liability Online or Full Media? Defense and liability for libel, slander, disparagement, misappropriation of name or likeness, plagiarism, copyright infringement, negligence in content to those that relied on content. Likely Claimants: Authors, producers, publishers, competitors Technology Errors & Omissions Defense and liability for failure of technology products to perform their intended purpose or the failure to render technology services as intended. 6

First Party Coverages Description Coverage Overview Coverage Part First Party Coverages Description Breach Response Costs The following costs resulting from a privacy breach: To hire computer forensics investigator To hire a law firm to identify statutory obligations to notify affected individuals/regulators To provide notifications To setup a call center To offer of fraud monitoring to those impacted individuals Crisis Management / Public Relations Expenses Costs of public relations firm due to privacy or security incident. Regulatory Defense / Fines & Penalties Costs Costs to defend an action by Attorneys General, FTC, Office of Civil Rights or other regulators due to a privacy breach. Can also include associated fines & penalties. Likely Claimants: Attorneys General, FTC, OCR PCI-DSS Assessments A written demand you receive from a card association or acquiring bank for a monetary assessment of a fine or penalty due to your non-compliance with PCI Data Security Standards. 7

First Party Coverages Description Coverage Overview Coverage Part First Party Coverages Description Business Interruption / Extra Expense Loss of income or extra expense due to system shut down from security failure. Waiting period applies. Coverage extension also available for accidental outages or unplanned outages. Dependent Business Interruption An entity not owned, operated or controlled by you that you depend on to conduct your business. Data Restoration Costs incurred to replace, restore, or recollect digital assets from written records or from partially or fully matching electronic data records due to their alteration, corruption or destruction from a network operations security failure. Cyber Extortion Costs of consultants and extortion monies for threats related to interrupting systems and releasing private information. 8

First Party Coverages Description Other Insurance and Cyber Risk Coverage Part First Party Coverages Description Crime/Fidelity Coverage Coverage for first party funds stolen as a result of a hacking incident or social engineering. Directors and Officers Liability Shareholder suit as a result of harm to a company from a network security incident. Property Damage Coverage/Bodily Injury/General Liability A hacking incident that results in physical damage or bodily harm. 9

Data Breach Timeline Discovery First Response External Issues Actual or alleged theft, loss, or unauthorized collection/disclosure of confidential information that is in the care, custody or control of the Insured, or a 3rd for whom the Insured is legally liable. Discovery can come about several ways: Self discovery: usually the best case Customer inquiry or vendor discovery Call from regulator or law enforcement Forensic Investigation and Legal Review Forensic tells you what happened Legal sets out options/obligations First Response Public Relations Notification Remedial Service Offering External Issues Income Loss Damage to Brand or Reputation Regulatory Fines, Penalties, and Consumer Redress Civil Litigation Long-Term Consequences 10

A GROWING THREAT ENVIRONMENT Companies Continue to be Exposed to Cyber Risks Sony suffered a breach in its video game online network exposing names, addresses and possibly credit card data belonging to 77 million user accounts in what is one of the largest-ever Internet security break-ins. JP Morgan Chase was subject to 76 million Data Records breached and Staples reported over 1 million payment cards were stolen. Criminals access the personal details and Social Security numbers of more than 70 million people—the biggest health-care data theft to date. Wells Fargo, Bank of America, Citi Group and JP Morgan Chase were affected in a series of cyber security attacks that affected millions of customers. Target reported a major data breach and warned that up to 110 million records, including debit / credit card info were compromised. Ebay was subject to 145 million User Data Records breached TJX Companies was hacked, exposing credit cards and transaction details for 94 million records. A flaw in Pinterest site’s API exposed users’ email addresses – 70 million records were affected. July 2008 January 2012 March 2013 October 2013 January 2014 April 2014 September 2014 December 2014 January 2007 September 2011 September 2012 March 2013 December 2013 May 2014 October 2014 February 2015 1.1 million payment cards exposed A data breach targeting Michaels – a national chain of arts and crafts stores – impacted more than 3 million customers. Over 24 million customers were impacted in massive security breach. Zappos CEO issues letter and urges all customers to change their passwords. Adobe announces that a hack of company systems exposed customer names, IDs, encrypted passwords, and debit/credit card info impacting 152 million records. Sony reported over 47,000 employee records, personal emails and documents were breached. Facebook experienced a glitch during testing of a new design that exposed 80 million records of users’ birth dates. Evernote is hacked and requests 50 million users to change their passwords. Multiple breaches impacting millions of payment cards and store locations, 56 million Payment cards and over 1,500 locations breached among this group of companies. Marsh FINPRO Cyber Practice

Breach Scenario Hackers are able to exploit a weakness in Big Box’s system through a facilities management vendor with less sophisticated controls and IT. Hackers install in Memory-Scraping Malware at many of Big Box’s POS terminals designed to capture unencrypted, plain text, credit card data prior to it being encrypted. Malware is designed to target Track 1 and Track 2 data – includes: a cardholder's name, card number, expiration date, and the card's three-digit security code (enough information to replicate a credit card) 12

Breach Scenario CEO to Risk Manager: What type of costs (1st party) and liability (3rd party) could we incur as a result? How will we pay for it all? Big Box’s direct 1st party costs: -Investigation: Computer forensics -Legal: Regulatory requirement ; Managing PCI investigation -Notify affected customers -Public relations firm, to deal with PR fallout -Overtime for Big Box employees -Possible lost sales due to consumer backlash. Do we have Insurance for this? -Yes, under a typical Security & Privacy insurance policy (aka Cyber insurance) the above is typically covered except for employee overtime and lost sales. 13

Breach Scenario What type of liability (3rd party) could we incur as a result? How will we pay for it all? PCI Assessments: (Specific PCI coverage under Cyber policy) a. “Fines “for non-compliance with PCI DSS b. Case Management Fee/Investigation c. “Assessments”: Cost of heightened fraud monitoring; card reissuance. Consumer class action: (Covered under privacy liability portions of a Cyber insurance policy) Regulatory action: investigation/defense of a regulatory action, resulting from an alleged violation of a Privacy Law. 14