Recent events highlight the on-going cyber perils that plague organizations and individuals globally. This is an opportune time to take inventory of your cyber insurance protection.

Late last week saw two different (and daunting) cyber perils unfold on the same day. The first was a massive computer disruption that occurred after an update on certain Windows systems went awry. According to an announcement by the CEO of CrowdStrike:

• The outage was caused by a defect found in a Falcon content update for Windows hosts. Mac and Linux hosts are not impacted. This was not a security or cyberattack.

The adverse after-effects are still being felt by many and may continue for an uncertain amount of time.

Also last week, the Los Angeles County court system not only suffered disruptions from the CrowdStrike Windows update itself, but it was targeted by a severe ransomware attack, forcing the courts to close down normal operations as they worked with their consultants to reboot systems and avoid further harm from the malware.

Next Steps for Those Adversely Impacted

The severity and frequency of these perils demand smart planning and action. In addition to bringing systems online and continuing their efforts to safeguard their computing operations, organizations should take concrete steps to assess and protect their insurance coverage rights for any losses or claims that can arise from cyber incidents such as these.

• First, assess what coverage you have. For example, many cyber insurance policies provide express protection to policyholders for “System Failures” and “Dependent System Failure.”
• Second, work with your insurance broker to identify other insurance product lines that may provide insurance coverage, as dedicated cyber insurance policies are often not the only means of protection against cyber related losses and claims.
• Third, provide notice of claims or, where applicable, notices of circumstances on all potentially relevant primary and excess insurance policies.
• ​​​​Fourth, identify specific operational impacts and track actual costs incurred for dealing with system disruptions due to the recent Windows update outage or a cyber attack. It is important to document and evidence the harm suffered, the income loss, and the costs incurred to address the needed fixes.
• Fifth, if met with insurance claim denials or efforts to sub-limit coverage to a fraction of the claimed loss amount, consider your coverage rights and whether you need assistance in a claim recovery.

Regarding this last above point, policyholders should be aware that sometimes they will have to fight to get the benefits of their insurance coverage. In an important cyber insurance decision from this year, Southwest Airlines was able to reverse a bad decision against it after it had its claim contested by an excess insurance company over a computer system failure. There, the underlying trial court had agreed with Liberty Insurance’s argument that some of its losses were not caused by the computer system failure but instead were due to the airline’s management decisions. On appeal, the United States Circuit Court of Appeals for the Fifth Circuit reversed the trial court and remanded the case for a causation analysis, indicating that there could be coverage for certain decisions taken by airline management in the wake of Southwest’s previous computer system failure and corresponding disruptions to its operations. (More information about this case is available in Risk Management: here.)

Conclusion

Policyholders must remain vigilant—both when it comes to safeguarding its systems and data, and when making sure their insurance coverage provides the protection promised when losses and claims are suffered.