CUNA Mutual Group Proprietary Reproduction, Adaptation or Distribution Prohibited © 2014 CUNA Mutual Group, All Rights Reserved. Understanding Cyber Insurance Connecticut Cybersecurity Basics Conference Jonathan Moore, CIC, CRM, AAI Corporate Property and Casualty Specialist, East Region September 14, 2015

What is the risk? Data – Personally Identifiable Information –Name, SSN, DOB, Biometric info, etc. –Electronic data –Hard (paper copy) data –Corporate confidential info –State and federal laws apply

Let’s analyze the exposure Add up these numbers… –Number of members –Number of former members –Number of employees –Number of former employees –Joint owners (that are not counted as members) –Indirect applications – that do not count as members

Who’s causing the loss at CUs? Source: Beazley Insurance Company, Inc. – 1300 CU’s protected by Beazley.

What are we worried about? Cyber thieves? –For CU’s, and many industries, less than 20% of losses Your staff! –Root cause of most losses Source: Beazley Insurance Company, Inc. - Since 2009, have handled almost 3000 claims.

Controls IT – fraud prevention software/hardware, encryption, etc. Staff training - “don’t do…”, managing passwords, etc. Testing staff Website reviews Purchase a cyber policy

What can I get covered? Standard - $1-10m liability policy –Sublimits ($100k-$500k) for legal, call center, forensic, mailing, credit monitoring, public relations –Erodes the liability limit Enhanced - $1-$10m liability policy –Insure a number of records separately with NO dollar limit to cover the notifications, call center and credit monitoring –Separate coverage limit for legal, forensic, public relations expenses –These do not erode the liability limit Compare each policy for limit structure and service level.

Disaster recovery assistance Type A – here’s your money (after you pay for the loss), have a nice day! –Mostly reimbursement type policies Type B – here’s a good company that we suggest. Call them to help you recover. –Both reimbursement and pay on behalf Type C – let us help you manage through the recovery process, we will line up everything for you. –Pay on behalf –Keeps cost low, efficient, vested interest Evaluate the experience level with handling claims and recovery assistance with each carrier review.

What we’ve seen Full breaches –Accidentally lost back up –Clicked on link, malware exposed later Other breaches –Marketing campaigns –Statements going to wrong people –Accidental s –Rogue employees

QUESTIONS?? Thank You!