Cyber Liability: A Growing Concern for Contractors

PentaRisk Insurance Services Newsletter   -   Vol 2   Issue  18   -   May  2015

 

Cybersecurity attacks have become not only more numerous and diverse, but also more damaging and disruptive. Contractors are not immune from cyber-attacks, or the costs and liabilities caused by these attacks.

 

One of the single largest cyber-attacks occurred in 2013 when hackers penetrated Target Brands, Inc.'s (Target) systems using network credentials stolen from Fazio Mechanical Services. See this link for full details: http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/. Using these credentials, the hackers were able to obtain over 40 million credit and debit card records from Target customers. The initial take was that the contractor was doing monitoring work on the systems, in respect to optimal energy usage. Further investigation revealed that the contractor was performing routine electronic billing, contract submission and project management - typical tasks for any contractor. The hackers exploited this opportunity

Contractors have a unique role and exposure in possible data breaches and cyber attacks. This is due to the fact that they are often on the ground level of all new construction projects, including the development of design specifications, building information and networking systems, security systems, and HVAC systems. Contractors and their clients are becoming more interconnected via technology. From online payment systems, to sharing of specifications and bid documents, contractors are exposed to losses that are not covered by traditional insurance.

Cyber liability insurance protects you from suits alleging breaches of private information, such as employee records, credit card information, bids, financial information and other sensitive corporate data. It provides third party coverage for damage to your customers and first party coverage for the costs to restore your data and systems following a cyber attack.

The Chart below highlights some of the key coverage provided:

 

The low cost of cyber liability insurance is about the same as the fee charged by an IT recovery specialist for a few hours of time spent after a cyber attack, and monetarily eases the burden for the time necessary for you to comply with the state laws to notify affected parties. The following are some pricing indications for various sized contractors, based upon the number of employees, as well as the amount of personally identifiable information (PII) a company keeps on hand:

In addition to the coverages provided after an attack occurs, most cyber liability insurers contract with vendors at deeply discounted rates to determine current vulnerabilities. These vendors may be lawyers who can assist policyholders in the implementation of an incident response plan. They may also be software companies that can scan an insured's system for weaknesses in IT infrastructure. One insurer will even provide a shunning tool (i.e. firewall) for insureds with policy premiums in excess of $5,000.

There are numerous insurers offering cyber liability coverage, however only a few of them have the experience and broad coverage forms needed to protect contractors.