1. Beazley presentation master February 2008 Data Security & Beazley Breach Response Max Perkins October 4, 2013

2. A Brief Review of Data Breaches What is Beazley Breach Response? Beazley Breach Response Timeline Questions? Appendix Agenda 2

3. A Brief Review of Data Breaches

4. Actual release or disclosure of information to an unauthorized individual/entity that relates to a person and that: o May cause the person inconvenience or harm (financial/reputational) Personally Identifiable Information (PII) Protected Healthcare Information (PHI) o May cause your company inconvenience or harm (financial/reputational) Customer Data, Applicant Data Current/Former Employee Data, Applicant Data Corporate Information/Intellectual Property What is a Data Breach? 4

5. Improper Disposal of Data o Paper Un-shredded Documents File cabinets without checking for contents o Electronic assets computers, smart phones, backup tapes, hard drives, servers, copiers, fax machines, scanners, printers Phishing/Spear Phishing Attacks Network Intrusions/Hacks/Malware Viruses Lost/Missing/Stolen Electronic Assets Mishaps due to Broken Business Practices Rogue Employees Types of Data Security Breaches 5

6. Consumer Information Credit Cards, Debit Cards, and other payment information Social Security Numbers, ITINs, and other taxpayer records Customer Transaction Information, like order history, account numbers, etc. Protected Healthcare Information (PHI), including medical records, test results, appointment history Personally Identifiable Information (PII), like Drivers License and Passport details Financial information, like account balances, loan history, and credit reports Non-PII, like email addresses, phone lists, and home address that may not be independently sensitive, but may be more sensitive with one or more of the above Employee Information Employers have at least some of the above information on all of their employees Business Partners Vendors and business partners may provide some of the above information, particularly for Sub-contractors and Independent Contractors All of the above types of information may also be received from commercial clients as a part of commercial transactions or services In addition, B2B exposures like projections, forecasts, M&A activity, and trade secrets Many people think that without credit cards or PHI, they dont have a data breach risk. But can you think of any business without any of the above kinds of information? What Kinds of Information are at Risk? 6

7. A Simplified View of a Data Breach 7 Handling the Long-Term Consequences Managing the Short-Term Crisis Evaluation of the Data Breach Discovery of a Data Breach Theft, loss, or Unauthorized Disclosure of Personally Identifiable Non-Public Information or Third Party Corporate Information that is in the care, custody or control of the Insured Organization, or a third party for whom the Insured Organization is legally liable Forensic Investigation and Legal Review Notification and Credit/Identity File Monitoring Class-Action Lawsuits Regulatory Fines, Penalties, and Consumer Redress Public Relations Reputational Damage Income Loss

8. What is Beazley Breach Response for the Commonwealth of Virginia?

9. Network / DataLiability Insurance + Breach Response Services _____________________ Beazley Breach Response Beazley Breach Response is more than an insurance policy Based on current, state-of-the-art Beazley Information Security & Privacy Insurance Notification/Credit or Identity Monitoring indemnification is replaced with Privacy Breach Response Services Integrated Breach-Handling Services using top industry experts and vendors Privacy Breach Response insurance has a limit of coverage that is separate from and in addition to the third party limit of liability A comprehensive solution to the risks of security breaches, data loss and unauthorized disclosures A unique insurance product tailored to the needs of data owners, including higher education, healthcare, retail and other consumer-facing organizations

10. Insuring Agreement A o Information Security and Privacy 1. theft, loss or unauthorized disclosure of personally identifiable non-public information or third party corporate information 2. failure of computer security to prevent a security breach 3. failure to timely disclose a breach 4. failure to comply with privacy policy 10 Beazley Breach Response

11. Insuring Agreement B o Breach Response Services 1.Computer forensics to determine existence and cause of breach. Includes costs of a PCI Forensic Investigator, when applicable to the suspected incident 2. Legal fees to determine the applicability of and actions necessary to comply with breach notice laws or in responding to credit card system operating regulation requirements (PCI) 3.To provide notification to individuals required to be notified under a breach notice law or if a potential risk of financial, reputational, or other harm exists to the individuals 4.Call center services to the notified individuals 5.One year credit or identity file monitoring and reasonable third party admin costs associated with program 6.Access to educational and loss control information 11

12. Insuring Agreement C o Regulatory Defense and Penalties Claims expenses and penalties insured is obligated to pay because of a claim in the form of regulatory proceedings – (HIPAA, HiTech) Insuring Agreement D o Crisis Management and Public Relations Public relations and Crisis Management Expenses incurred as a result of a the publication or imminent publication in a newspaper, radio or television broadcast of a covered Claim under the policy. Insuring Agreement E o PCI Fines and Costs Indemnity coverage of PCI Fines and Costs (Defined Term) 12

13. Beazley Breach Response: Pre-Breach Education and Services Dedicated Breach Response Services team: breaches are very different from liability claims Hand-picked vendors: expertise makes a big difference for breach outcome, higher education organizations are note expected to have the in-house expertise to respond to a breach Beazley insureds are encouraged to activate services when they think have a breach, because little breaches can turn into big problems if they arent handled properly It only takes one phone call or email (bbr.claims@beazley.com) to activate services What Else Makes Beazley Breach Response Different?

14. Policy Holder Services from ePlace Solutions, Inc. through nodatabreach.com to provide Data Security Risk Management services such as: o Training and Awareness programs o Animated Staff training Programs o HIPAA Compliance Tools o On-Line Compliance Materials – quick tips, links to statutes and regulations updates o Expert Support from consultants and attorneys on data security issues including Healthcare & HIPAA compliance issues Contractual Considerations Data Breach Prevention Issues Data Security Best Practices and Corporate Policies Computer Forensic Issues Data Breach Prevention Guidance Pre-Breach Response Services 14

15. Alex Ricardo - Breach Response Services - Broker/Client Outreach Specialty Lines Alex joined Beazley in April 2011 Graduated from Stevens Institute of Technology, BE Engineering Worked in privacy sector for 15 years Certified Information Privacy Professional (CIPP/US) Based in Beazley's New York City office. He is responsible for assuring BBR Insureds take full advantage of the professional services made available to them to reduce their risk & liability profile prior to or in the event of a privacy breach incident. Pre-Breach Response Services Continued 15

16. Dedicated Internal Breach Response Services Focus Group lead by Katherine Keefe, Esq. o 25 years practicing lawyer with extensive experience in data privacy and security issues and related regulatory matters. o Team responsible for providing breach response services to policyholders immediately following the report of a suspected data breach o Development of Beazleys risk management services designed to minimize the occurrence and impacts of data breaches. o Client Advocacy during breach that is separate from claims staff handling regulatory and liability matters Post Breach Response Services 16

17. Beazley Breach Response Timeline

20. Questions?

21. Appendix Best Practices – Breach Preparedness & Prevention Best Practices – Breach Response Management

22. 22 Best Practices – Breach Preparedness and Prevention Encryption of Portable Devices PCI-DSS Compliance Data Segregation Data Mapping Log Files Data Loss Prevention (DLP)

23. 23 Best Practices – Breach Preparedness and Prevention Background Screening Program Pre-Arrange Breach Response Services e-Learning Initiative Written Data Breach Incident Response Plan Tabletop Exercises Legislative updates

24. 24 Best Practices – Breach Response Management Retain Outside Counsel Notify Correctly vs.. Quickly Outside Call Center When Appropriate Reputational Risk Advisor When Appropriate Investigate – Investigate – Investigate Leverage External Resources – Privacy Counsel, Forensics

25. Max Perkins Underwriter; Specialty Lines Beazley Two Liberty Place t: +1 (215) 446 8446 50 S. 16 th Street, Suite 2700 c: +1 (336) 549 9999 Philadelphia, PA 19102 e: max.perkins@beazley.com For More Information: www.beazley.com The descriptions contained in this broker communication are for preliminary informational purposes only. The product is available on an admitted basis in some but not all US jurisdictions through Beazley Insurance Company, Inc., and is available on a surplus lines basis through licensed surplus lines brokers underwritten by Beazley syndicates at Lloyd's. The exact coverage afforded by the product described herein is subject to and governed by the terms and conditions of each policy issued. The publication and delivery of the information contained herein is not intended as a solicitation for the purchase of insurance on any US risk. Beazley USA Services, Inc. is licensed and regulated by insurance regulatory authorities in the respective states of the US and transacts business in the State of California as Beazley Insurance Services (License#: 0G55497).