Cyber insurers 'generous' in interpretations

Australian cyber liability insurers have been “generous in their interpretations of policies”, Brisbane-based Minter Ellison special counsel Leah Mooney told the NZILA conference.

“Australian insurers are paying claims and want to make sure clients are not burnt in the early stages” of the uptake of cyber policies, she said.
It was “a prudent investment” for corporate entities. NZ-based underwriting agency Delta Insurance’s general manager Craig Kirk said many overseas companies, particularly utilities with big potential business interruption costs, were buying large cyber risk programs.

“It’s a relatively new market, but there are more losses to come,” he warned. The exposure of names of people using the Ashley Madison website was cyber liability’s “poster event” and attracting class actions from US and Canadian subscribers. A team of “hacktivists” stole sensitive information naming subscribers to the site that encourages people to have extramarital affairs and disclosed it.

The event was “groundbreaking because of its size”, Mr Kirk said.

He said the Lloyd’s City Risk Index, which analyses the potential impact of various risks for 301 cities around the globe, had cyber risk “neck and neck” with earthquake risk for Auckland. “Most [organisations] would be insured for earthquake, but very few for cyber risks,” he said.

Mr Kirk said cyber liability policies were available in the NZ market but how policies responded was largely untested. NZ’s regulatory framework was “outdated”. The Privacy Act was implemented before social media existed and, although a 2011 review recognised the need to upgrade, “it’s down the priorities scale”.

Ms Mooney said Australian regulators expected boards to take cyber risk seriously and failing to buy cyber risk policies may become a D&O policy exclusion.

The Office of the Australian Information Commissioner’s powers were “quite frightening”, but it had so far taken “a softly, softly approach”. She said mandatory breach notification was coming in Australia and would “increase the uptake of cyber risk insurance”. “If you get the right policy [the insurer] will manage breach responses for you.”

Mr Kirk said cyber polices were “probably as cheap now as they ever will be” and insureds should “buy now before claims start rolling through”. Ms Mooney agreed, saying “jump on board now”.

They said claims paid so far in Australia and NZ had been for first party losses, rather than third party losses. Most cyber risk policies covered both.