1. Financial Institutions – Cyber Risk
Managing Cyber Risks In An Interconnected World
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

2. AGENDA A NEW ENVIRONMENT CYBER RISKS IN NUMBERS IMPACT & CONSEQUENCES
LOSS EXAMPLES BY COVERAGE TYPE
QUESTIONS & ANSWERS
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

3. A NEW ENVIRONMENT

4. A NEW ENVIRONMENT Privacy ~ A Heightened & Evolving Exposure
Laws & Regulations
Regulatory changes with aggressive enforcement and penalties
Failing to protect Personally Identifiable Information (e.g. employee, customer, vendor) or Personal Health Information or Corporate Confidential Information (e.g. customers, patients, members, employees) has material financial & regulatory consequences
Risk Exposure
Frequency and severity of cyber breaches has not improved with increased security spending and regulation
“Industrialization” of private or confidential data theft
Financial impact of a privacy breach can exceed $100MM
Loss Trends
Expenses & liabilities growing as underwriters are paying multi-million dollar losses
Credit card issuers/banks are suing for cost to reissue cards
Defrauded merchants are suing breached organizations
Cyber Insurance
Cost of risk transfer has decreased as more & more companies buy Cyber Insurance but there have been some recent market changes with large losses in late 2013
Insurer negotiated discounts on notification / credit monitoring services
“Cyber” Insurance has broadened to address these risks
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

5. A NEW ENVIRONMENT What’s New In Cyber World?!
New Culprits
Loosely formed groups of people who are very good at hacking and work together to do so
(e.g. Anonymous; Lulzsec)
State actors (e.g. China; Iran)
New Information Targeted
Corporate data and trade secrets
Inside information
Embarrassing information
Corporate weaknesses
New Motives
Political and ideological
Personal
War / terrorism
Revenge
“Hacktivism”
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

6. CYBER RISKS IN NUMBERS

7. 8 of 15 largest breaches of all time occurred during 2013
WILLIS BREACH STATS 2013
8 of 15 largest breaches of all time occurred during 2013
 Average records lost per breach: 
Over 383,000 in 2013 versus 83,870 in 2012
Total records breached:
822 million in 2013 versus 260 million in 2012
Other 2013 stats:
Total breaches:  over 2,100
Breaches per day: nearly 6
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

8. VERIZON REPORT 2013

9. NUMBER OF BREACHES US DataLossDB.org State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

10. CYBER RISKS IN NUMBERS A Global Exposure
Breaches by Industry Group
Source: Data Breach Investigations Report (Verizon)
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

11. IMPACT & CONSEQUENCES

12. IMPACT & CONSEQUENCES High Potential Cost of a Data Breach
Costs to comply with notification to consumers / employees, credit monitoring costs, cost of restoring data / public relations
Civil penalties and fines
Class Action suits
Legal costs:
Civil, regulatory and possibly criminal defense
Data Privacy counsel can cost over $700 p/hour; major breach involves millions in legal costs
Business Interruption Costs
Negligence
continues as the
leading cause of
data breaches
at 41%
The total average
cost of a data
breach grew to
$214 per record
The total average
cost of a data
breach event
rose to $7.2M
Malicious
attacks are the
most expensive
Increase in
Malicious
attacks indicates
Worsening
Threat
environment
Malicious or
criminal acts
causing more
breaches rising
to 31% up from
24% in 2009
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

13. LOSS EXAMPLES
BY COVERAGE TYPE

14. LOSS EXAMPLES Privacy Liability
Privacy Injury Liability
Private lawsuits as a result of unauthorized disclosure or use of private information in violation of privacy laws, government regulations or institutional policies. This coverage includes online and offline information and the cause can be by third-party custodians of information, employee mistakes or unsanctioned willful actions.
Loss Example – 40 million credit card numbers were stolen from large retailer, the resulting lawsuits from banks and customers exceeded $100 million
Privacy Regulatory Proceedings and PCI Fines
Covers defense of a proceeding or action brought by a privacy regulator and fines imposed where covered by law. Can include cover for PCI fines.
Loss Example – $2.25 million fine imposed on a drug store chain by the FTC and Department of Health and Human Services Settlement for the loss of millions of pharmacy records.
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

15. LOSS EXAMPLES Network & Content Liability
Network Security Liability
Covers claims arising from an inability to use or access your network, infection of others networks, information damage to other networks, inability of others to rely upon the accuracy, validity or integrity of their information residing on your network.
Loss Example – Hackers obtained access to debit card account records and changed limit parameters resulting in fraud and a liability of $10 million.
Content Injury Liability
Defamation, disparagement, copyright, trademark, publicity rights and content errors, etc. Covers computer readable content and can be expanded to all media
Can cover unauthorized expression and other exposures over social media sites by employees or others for whom a company might be responsible
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

16. LOSS EXAMPLES Public Relations & Response
Covers expenses incurred in responding to adverse publicity or media attention arising from a claim covered in the policy and other required response costs including:
Privacy breach-related “Duty to Notify” costs
Costs to procure credit monitoring services on behalf of customers.
Call center costs
Legal costs from responding to a breach
Response coaching costs
Forensic costs
IT security response costs
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

17. LOSS EXAMPLES Network Damages
Network Loss or Damage
Covers costs to recreate or restore network pre-loss conditions. Attacks covered include those instigated by employees.
Loss Example – A broker dealer spent more than $3.5 million to remove timed malicious code designed to bring down the network.
Business Interruption & Extra Expenses
Covers lost online & offline income, as long as your income is network dependent and the loss is caused by security breach or errors plus expenses of avoiding such a loss.
Loss Example – Professional services firm was the victim of a hacker and lost all its work on an engineering project at a cost of $10 million.
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

18. LOSS EXAMPLES Network Crime
Electronic Theft
Covers for theft via a network of money, securities, goods, services and intangible property (e.g., intellectual property).
Loss Example – Stolen credit cards numbers used to obtain goods through an online site and bank procedures are not followed preventing reimbursement form the acquiring bank
Network Extortion
Pays credible extortionist demands and response costs to demands for money against threats to release private information or bring down a network.
Loss Example – A large media company incurred significant costs responding to a hacker who showed he had access to the company’s networks and sought money from its celebrity CEO against a threat to bring the network down
State Compensation Insurance Fund
Audit Committee Meeting – February 19, 2014
Open Agenda Item 6 – Cyber Risk

19. QUESTIONS
& ANSWERS