Download to read offline
More Related Content
Cyber Insurance CLE
- 1. NEW ORLEANS, LA 504.585.3800 PENSACOLA,FL 850.266.2300 BELLE CHASSE, LA 504.585.3800 Cyber is for Everyone Presented by Jacqueline M. Brettner & Sarah Stogner
- 2. Discussion Points • Insurance101 • Key Concepts in Insurance Coverage. • Brief Overview of: • Commercial General Liability Policies; • Excess & Umbrella Liability Policies; and • Focus on Cyber Liability Policies & Emerging Trends • Quantifying Data Breach Costs; • Recent Developments; • Affected Companies; and • Company Responsibilities Going Forward.
- 3. NEW ORLEANS, LA 504.585.3800 PENSACOLA,FL 850.266.2300 BELLE CHASSE, LA 504.585.3800 Insurance 101
- 4. Key Concepts inInsurance Coverage • Insurance policies are typically interpreted in accord with jurisdictional rules for general contract interpretation. • It is crucial to consider where your insurance policy will be interpreted in order to understand how it will be interpreted and whether or not it provides the coverage sought. • Different sections of the policy may be interpreted differently. Consider: • Coverage grant; • Undefined terms; • Exclusions; • Buy-back coverage endorsements; and • Exceptions to buy-back coverage. • Other provisions to evaluate before placement: • Governing Law provisions; • Choice of Law analyses; and • Enforcement of Arbitration provisions.
- 5. Commercial Insurance Coverage •Commercial General Liability (CGL) policies provide basic insurance coverage for businesses. Main coverages are: • Coverage A - bodily injury or property damage; and • Coverage B - specific torts. • Individual policy language varies between policy forms, however, CGLs typically come in two flavors: • “Named peril” policy, which covers only specifically listed perils; or • “All-peril,” policy, which provides coverage for all risks not specifically excluded. • Differences impact: • Scope of coverage; • Post-loss policy interpretation; and • Premium calculation. • Additional placement considerations: • Specialty insurances for specific industries, e.g., well control coverage, A/E, etc. • Buy-back coverage for particular businesses and/or manuscripted policies. • Often combined with other policies to ensure comprehensive coverage for all potential liabilities.
- 6. Umbrella Insurance Coverage •Umbrella policies provide additional coverage (“excess liability”) above the limits of the insured’s primary policy(ies). • Unlike excess insurance, umbrella policies can be applied to multiple underlying liability policies. • Umbrella policies are triggered once underlying policy limits have been exhausted. • Umbrella policies can also be triggered before the underlying policy limit is exhausted where the claim is excluded under the primary policy but covered under the umbrella.
- 7. Excess Insurance Coverage •Excess liability insurance policies provide coverage when an underlying, or primary, liability policy’s limits have been exhausted. • Excess policies can only be applied to one underlying policy. • Excess insurance can be stacked, creating a “tower” of coverage. • Excess policies are generally “follow-form” meaning they provide the same coverages and contain the same exclusions as the underlying policy • Follow form does not necessarily mean follow adjustment. • This is an emerging trend – particularly in high risk industries. It has created a great deal of uncertainty. • In the United States, excess policies and excess insurers are not regulated by the individual states in the same way primary insurers and primary policies are.
- 8. NEW ORLEANS, LA 504.585.3800 PENSACOLA,FL 850.266.2300 BELLE CHASSE, LA 504.585.3800 All Things Cyber
- 9. Quantifying Data Breaches •A 2017 Ponemon Institute study calculated the average total cost of a data breach incident to be $3.62 million. • To put that in perspective, Target’s 2013 data breach cost $252 million – before insurance and tax deductions. • While liabilities and costs can be driven by company size, businesses of all sizes and industries are vulnerable. • As of 2016, the average cost of a data breach for small businesses was $36,000. Up from $8,699 in 2012. • Adding insult to injury: • Businesses that have experienced a “material” data breach are 27.7% more likely to experience another breach in the two years following the initial breach. • Assessing cyber vulnerabilities, developing protocols to minimize risks, and reevaluating risk management programs to ensure proper risk transfer must be a top priority.
- 10. Just a fewmonths ago (Fall 2017): • Yahoo revised its estimate of the total user accounts compromised in its 2013 data breach from 1 billion to 3 billion. • NSA discloses stolen “hacking tools” from 2015 • Equifax CEO, Richard Smith, testifies before Congress: • Dealing with 4 breaches, not 1. • Questions arise as to Equifax’s delay in reporting the incidents, the reasonableness of its pre-incident security protocols, and whether or not the breaches actually provide the company with additional revenue streams. • The size of the Equifax breach, the types of data compromised, and the role Equifax plays in the U.S. economy make the incident a watershed moment. • On the horizon: • Mandatory minimum monetary damages for compromised individuals. • Statutory fines and penalties for certain industries or “too big to fail” players. • Increased federal regulation, beyond HIPAA and GLBA.
- 11. So, What AreWe Talking About? • A cyber attack can be broadly defined as a deliberate act through cyber space to manipulate, damage, or destroy computer systems or networks, industry control systems, personal computer devices, or other interconnected devices. • These attacks have the potential to create sweeping economic damage at a relatively low cost. • Recent examples also include efforts to deny access to computer networks or systems, and the encryption of valuable data held for ransom. • A data breach is a security incident in which sensitive, protected, or confidential information is copied, transmitted, viewed, stolen, or used by an unauthorized individual. • Personally Identifiable Information (PII) is frequently targeted in a data breach. PII includes an individual’s name, age, date and place of birth, social security number, telephone number, mailing and home addresses, biometric records, medical records, financial account information, among other identifying information. • Other targeted data include intellectual property, sensitive company information, client lists • Your odds of being struck by lightning this year at 1 in 960,000. Your odds of experiencing a data breach are 1 in 4. • Cyber liability policies provide coverage for liabilities associated with cyber attacks, cyber security breaches, and violations of privacy and data breach notification laws.
- 12. Cyber Liability Policies:1st and 3rd party
- 13. 1st Party Costs- Cyber Cinderella • Forensic Investigation Costs • Investigation, identification, and isolation of breach. • Legal fees to pinpoint triggered notification and regulatory obligations. • Notification Costs • Data and Industry driven. • 50-state patchwork, plus federal regulatory frameworks. • Varying notification requirements internationally – particularly in the EU • Business Expenses • Lost profits or loss of customers following a breach. • Extra expenses associated with response: • PR fees; • Legal expenses generated by vendor and other third-party contract review to identify contractual notice, indemnity and/or other obligations triggered by breach; and • Credit monitoring expenses for any individuals affected, among others.
- 14. 3rd Party Liability– The Shaggy Principle • We Don’t Buy/Sell Online • My Business is Not a Target • We Transfer Liability via IT Vendors • We Have Ironclad Security Protocols • Our CGL Covers It
- 15. Stand Alone Cyberversus Cyber Endorsements • Some insurers offer cyber liability and data breach insurance coverage via endorsement to CGLs and/or Business Owner policies. • Cost-effective, entry level option for cyber risk transfer. • Typically, geared towards first-party costs with more limited coverages for third-party liabilities. • Be careful - $50k sublimits & limited coverage • Stand alone cyber liability policies offer completely different coverages: • Network & Privacy • Internet Media • Regulatory Proceedings & Fines • Payment Card Industry/Loss (PCI)
- 16. Cyber Liability in“The Cloud” • Transferring custody of data = does not transfer liability. • Cloud based storage = does not eliminate cyber threats. • Legal obligations rests with the company that initially accepts data. • Customers may sue company who stored data with cloud provider, even though company itself was not responsible for data breach. • Cloud provider recovery generally limited to contractual amount or multiple thereof.
- 17. NEW ORLEANS, LA 504.585.3800 PENSACOLA,FL 850.266.2300 BELLE CHASSE, LA 504.585.3800 Best Practices for In-house & Outside Counsel
- 18. Company Responsibilities • Duediligence. Take reasonable steps to assess your company’s vulnerability to cyber attacks and potential liabilities associated with data breaches. • Data Type(s) & Volume • Software & Vendors • Industry(ies) & Market(s) • Technologies • Best Practices – Prevention. Partner with a IT, HR, legal, and risk management professional to: (i) evaluate potential attack/breach scenarios, (ii) create protocols to eliminate/minimize risks and detail response procedures, and (iii) re-assess your risk management program to fill any gaps in coverage. • Security & IT patches • HR components • Risk transfer • Best Practices – Response. Follow are previously implemented protocols. Work with your broker and counsel to shepherd you through the process. • Isolation • Preservation • Notification • PR • Insurance claim & adjustment
- 19. Best Practices forCyber Placement • What are the company's specific cyber risks? Professional evaluation. • Are policy limits and sub-limits adequate for existing needs? • Is there retroactive coverage for prior unknown breaches? Caution! • Is there coverage for claims resulting from vendors’ errors? • Is “loss” of data covered or just data “theft”? • What about first party property damage?
- 20. Best Practices forCyber Placement • Can cyber insurance be combined with vendor indemnities to maximize protection? Caution! • Does the policy cover data hosted by cloud providers? LOL issues! • Will the insurer offer a subrogation waiver? Business Relationships! • How does the cyber policy fit within the company’s overall insurance program? Professional evaluation. • Can more favorable provisions, limits and premiums be negotiated with another carrier? Traditionally driven by risk/company size.
- 21. Cyber Applications, Generally •chief information officer or chief technology officer; • history of security incidents and breaches; • prior threats to company’s network or website; • facts or circumstances that reasonably could give rise to a claim under a prospective cyber policy; • volume and types of data handled or maintained by the company; • security standards and regulations, and frequency of assessments; • existing network security programs, antivirus software, and intrusion testing; • prior cancelation/refusal to renew a cyber policy; • security budget;
- 22. Cyber Applications, Continued •audits of third-party service providers; • vendor contracts and policies; • practices concerning data encryption, passwords, patching and system access control; • employee hiring and training practices, and procedures around termination; • physical security controls (e.g., access cards); • existence of written, attorney-approved and updated policies and procedures concerning the handling of information; • policies governing mobile devices and social media; and • data backup procedures.
- 23. Not All PoliciesAre Created Equal • Cyber policies are written as “claims made” or “claims made and reported” policies. • Retroactive date considerations are crucial where the affecting malware can lay dormant for years before an incident is detected. • Timely reporting even more important. • There is no ISO standard cyber liability policy form. • Like any insurance policy, the key to determining coverage is in the exclusions and the exceptions to the exclusions generated from endorsements. • Drawbacks and opportunities created by lack of uniformity. • Modular coverages and sub limits can present challenges if you are unfamiliar with varied policy forms. • Looking to other policies to fill the gaps in – or take the place of – a cyber liability policy is much more difficult with cyber liabilities. • Cyber claims to CGL and other policies have been tested, and mainly rejected, by the Courts. • ISO Data Loss Liability Exclusion • Consider “buy-back” coverage with specialty endorsements and/or manuscripted policies.
- 24. Questions? Jacqueline M. Brettner brettner@carverdarden.com SarahE. Stogner stogner@carverdarden.com Business & Insurance Resources: http://www.carverdarden.com/resources
- 25. © 2 01 7 Carver Darden Attorney advertising materials. These materials have been prepared for informational purposes only and are not legal advice. This information is not intended to create an attorney-client or similar relationship. Please do not send us confidential information. Past successes cannot be an assurance of future success. Whether you need legal services and which lawyer you select are important decisions that should not be based solely upon these materials.
Editor's Notes
- #14 Forensic Investigation: On June 22, 2017, we held a forensic scoping call with Charles River Associates (“CRA”). Please review CRA’s proposed roadmap and engagement letter. If you decide you wish to retain CRA, we will engage CRA on your behalf to best protect to the extent possible the investigation in the attorney-client privilege. Legal Analysis: Applicable Law. With any data incident, we must determine what systems and data were or are reasonably believed to have been accessed or acquired in order to determine what legal obligation are triggered. Here, our legal analysis will be guided by the laws of the states of residence of the impacted individuals. State Law: Notice – Individuals. There are 48 states that have enacted data breach notice laws, which impose an obligation upon a data owner – typically defined to be the entity that owns or licenses the data at issue – to disclose to a state resident instances of unauthorized access or acquisition of personally identifiable information relating to the resident that compromises or may compromise the security, confidentiality, or integrity of that personal information. While there is some variation in the data elements protected under each state law, most states define protected information to include a resident’s name, in combination with one or more of the following: Social Security number, driver’s license/state identification number, or financial account information (such as credit, debit card, and bank account information). Certain states expand their definition of personally identifiable information to include medical information, health insurance information and usernames and passwords. In response to a breach of security of personal information, these state laws require that the entity owning the data subject to unauthorized access or acquisition notify those state residents whose personal information was impacted. Certain states have specific content requirements regarding these notices, as well as requirements on the timing of notice. Some states, such as Florida, require that notice be provided within 30 days of discovery while others require that notice be provided within 45 days of discovery. Most states, however, such as Louisiana, require that notice be provided “without unreasonable delay.” While we are unsure at this time what data, if any, has been compromised, we will look specifically at Louisiana notice law, as much of the affected data could relate to Louisiana persons or residents due to the office location. If information is determined to be compromised and it relates to individuals in other states, we will supplement this analysis. Under Louisiana law, any person that conducts business in the state or that owns or licenses computerized data that includes personal information shall, following discovery of a breach in the security of the system containing such data, notify any resident of the state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. "Breach of the security of the system" means the compromise of the security, confidentiality, or integrity of computerized data that results in, or there is a reasonable basis to conclude has resulted in, the unauthorized acquisition of and access to personal information maintained by an agency or person. Louisiana has defined “personal information” as an individual's first name or first initial and last name in combination with any one or more of the following data elements, when the name or the data element is not encrypted or redacted: (i) Social security number; (ii) Driver's license number; or (iii) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account. Here, the precise data that was obtained by the intruder, if any, has not been confirmed. These elements will ultimately determine your obligations. Upon confirmation of the data potentially subject to unauthorized access or acquisition, and the states of residence of the individuals to whom that data relates, we will provide an updated analysis outlining all of your obligations under state law. We will also prepare legally-compliant versions of all required notices for your review and approval and, as discussed further, secure appropriate vendors to assist in the individual disclosure process. State Law: Notice – Regulators. Some states require notice of an event impacting the security of protected information relating to state residents be provided to the regulator in the state, typically the state Attorney General. For example, Louisiana requires notice to the Attorney General in the event any resident is notified due to a breach of personal information. In comparison, Florida law only requires notice to the Attorney General when there is a breach of personal information impacted more than 500 Florida residents. Upon a confirmation of the data potentially subject to unauthorized access or acquisition, and the states of residence of the impacted individuals, we will provide an updated analysis outlining your regulator notice obligations under state law. If there is a duty to notify regulators, we will prepare these notices and send them out from our office on your behalf upon your approval to do so. These notices will be provided concurrent to the compliant notice provided to the impacted individuals. State Law: Notice – Consumer Reporting Agencies. In addition to notifying the affected population and state regulators, some states require notice be provided to the major consumer reporting agencies (Experian, Equifax, and TransUnion) when the security of state residents’ personal information has been compromised. We will review the data file to confirm the states involved and confirm whether the laws of the states involved require notice to the consumer reporting agencies. If necessary, we will prepare these notices, with your approval, and send them out from our office. Applicable Law – Contracts. Carver Darden may have certain policies or contractual obligations with business partners, employees, vendors, or other third parties to disclose an incident that may impact the security of Carver Darden’s systems or information. If applicable, we will review these policies and contracts, as well as representations made by Carver Darden regarding privacy that may be implied to be a contractual representation, to determine whether Carver Darden is required to report this event to any audiences and prepare any disclosures required by this material. Applicable Law – Attorney-Client Information If we determine that client information or communications subject to the attorney-client privilege may have been accessed or acquired, we will determine whether applicable legal ethics laws for the state of Louisiana (and any other applicable jurisdiction) create an ethical duty to notify clients of such incident. Additional Considerations: Mailing and Call Center Vendor. If notice is necessary, a vendor is often engaged to provide notice letter printing and mailing and external call center services for affected individuals when disclosure is being provided to a large number of individuals and/or the media, when there is an anticipated heightened interest by the media or a specific population regarding the event, or when an organization cannot handle these tasks without suffering an interruption in business operations. In addition to handling volume, call center vendors are experienced at responding to questions from individuals affected by a data privacy event. The vendors with which we work have preferred rates for Travelers-insureds. In addition, should such vendor services be chosen, we will engage these vendors on your behalf to best protect, to the extent possible, the relationship and communications in the attorney-client privilege. Regardless of whether a call center vendor is engaged, we will prepare talking points and Frequently Asked Questions for whomever is responding to inquiries regarding this event to use during such response process. Credit/Identity Monitoring. Connecticut is the only state requiring an entity to provide affected individuals with credit monitoring/repair services in certain circumstances, such as the unauthorized acquisition of name and Social Security number. California’s statute is less clear, but arguably requires the provision of such services in similar circumstances. There, the statute states “an offer to provide appropriate identity theft prevention and mitigation at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached, when the information breached includes a [Social Security Number] or [California Identification/Drivers’ License number].” While California and Connecticut are the only states with requirements to offer such circumstances, such an offer is nevertheless often made during disclosure of a reportable event in an effort to mitigate any damage that may result from unauthorized access/acquisition of the individual’s personal information. A decision to offer these services would be viewed favorably should this incident draw any regulatory investigation. If it is determined that any protected information was subject to unauthorized access or acquisition and Carver Darden wishes to offer affected individuals with access to a free monitoring product, we will engage a Travelers-approved vendor on your behalf. Document Preservation. It is important to preserve any and all information, memoranda, computerized data, network and computer logs, email server logs, paper data, reports, etc. relating to this incident, the investigation and response. It is also important that Carver Darden’s IT personnel be asked to suspend automatic data destruction routines. We will continue to work with you and your staff to ensure all necessary information is adequately preserved. Next Steps: Carver Darden Review CRA’s roadmap and determine if you would like to engage CRA for the forensic investigation. Identify any contracts in place with business partners, employees, vendors, or other third parties relating to privacy and data security and provide these policies to Mullen Coughlin for review. Identify addresses and states of residences for impacted individuals, as they are identified, if applicable. Provide a copy of Carver Darden’s policy on security incident reporting and investigation, including any incident response plan or notification plan that may be maintained by Carver Darden. Provide copies of reports, summaries, and communication relating to Carver Darden’s investigation and response to this event. Engage in document preservation efforts. Mullen Coughlin Coordinate and direct the forensic investigation. Review any applicable policies/contracts with clients, business partners, or other third parties that may impose an obligation to disclose an incident impacting the security of Carver Darden’s information. Identify applicable law and analyze the forensic investigator’s findings to determine whether this is a reportable event under applicable law. Prepare notice deliverables for Carver Darden’s review and approval, as necessary. Engage vendor services for disclosure, if necessary. Assist Carver Darden with document preservation and retention. Continue to provide Travelers with updates regarding the investigation and response.
- #16 Forensic Investigation: On June 22, 2017, we held a forensic scoping call with Charles River Associates (“CRA”). Please review CRA’s proposed roadmap and engagement letter. If you decide you wish to retain CRA, we will engage CRA on your behalf to best protect to the extent possible the investigation in the attorney-client privilege. Legal Analysis: Applicable Law. With any data incident, we must determine what systems and data were or are reasonably believed to have been accessed or acquired in order to determine what legal obligation are triggered. Here, our legal analysis will be guided by the laws of the states of residence of the impacted individuals. State Law: Notice – Individuals. There are 48 states that have enacted data breach notice laws, which impose an obligation upon a data owner – typically defined to be the entity that owns or licenses the data at issue – to disclose to a state resident instances of unauthorized access or acquisition of personally identifiable information relating to the resident that compromises or may compromise the security, confidentiality, or integrity of that personal information. While there is some variation in the data elements protected under each state law, most states define protected information to include a resident’s name, in combination with one or more of the following: Social Security number, driver’s license/state identification number, or financial account information (such as credit, debit card, and bank account information). Certain states expand their definition of personally identifiable information to include medical information, health insurance information and usernames and passwords. In response to a breach of security of personal information, these state laws require that the entity owning the data subject to unauthorized access or acquisition notify those state residents whose personal information was impacted. Certain states have specific content requirements regarding these notices, as well as requirements on the timing of notice. Some states, such as Florida, require that notice be provided within 30 days of discovery while others require that notice be provided within 45 days of discovery. Most states, however, such as Louisiana, require that notice be provided “without unreasonable delay.” While we are unsure at this time what data, if any, has been compromised, we will look specifically at Louisiana notice law, as much of the affected data could relate to Louisiana persons or residents due to the office location. If information is determined to be compromised and it relates to individuals in other states, we will supplement this analysis. Under Louisiana law, any person that conducts business in the state or that owns or licenses computerized data that includes personal information shall, following discovery of a breach in the security of the system containing such data, notify any resident of the state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. "Breach of the security of the system" means the compromise of the security, confidentiality, or integrity of computerized data that results in, or there is a reasonable basis to conclude has resulted in, the unauthorized acquisition of and access to personal information maintained by an agency or person. Louisiana has defined “personal information” as an individual's first name or first initial and last name in combination with any one or more of the following data elements, when the name or the data element is not encrypted or redacted: (i) Social security number; (ii) Driver's license number; or (iii) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account. Here, the precise data that was obtained by the intruder, if any, has not been confirmed. These elements will ultimately determine your obligations. Upon confirmation of the data potentially subject to unauthorized access or acquisition, and the states of residence of the individuals to whom that data relates, we will provide an updated analysis outlining all of your obligations under state law. We will also prepare legally-compliant versions of all required notices for your review and approval and, as discussed further, secure appropriate vendors to assist in the individual disclosure process. State Law: Notice – Regulators. Some states require notice of an event impacting the security of protected information relating to state residents be provided to the regulator in the state, typically the state Attorney General. For example, Louisiana requires notice to the Attorney General in the event any resident is notified due to a breach of personal information. In comparison, Florida law only requires notice to the Attorney General when there is a breach of personal information impacted more than 500 Florida residents. Upon a confirmation of the data potentially subject to unauthorized access or acquisition, and the states of residence of the impacted individuals, we will provide an updated analysis outlining your regulator notice obligations under state law. If there is a duty to notify regulators, we will prepare these notices and send them out from our office on your behalf upon your approval to do so. These notices will be provided concurrent to the compliant notice provided to the impacted individuals. State Law: Notice – Consumer Reporting Agencies. In addition to notifying the affected population and state regulators, some states require notice be provided to the major consumer reporting agencies (Experian, Equifax, and TransUnion) when the security of state residents’ personal information has been compromised. We will review the data file to confirm the states involved and confirm whether the laws of the states involved require notice to the consumer reporting agencies. If necessary, we will prepare these notices, with your approval, and send them out from our office. Applicable Law – Contracts. Carver Darden may have certain policies or contractual obligations with business partners, employees, vendors, or other third parties to disclose an incident that may impact the security of Carver Darden’s systems or information. If applicable, we will review these policies and contracts, as well as representations made by Carver Darden regarding privacy that may be implied to be a contractual representation, to determine whether Carver Darden is required to report this event to any audiences and prepare any disclosures required by this material. Applicable Law – Attorney-Client Information If we determine that client information or communications subject to the attorney-client privilege may have been accessed or acquired, we will determine whether applicable legal ethics laws for the state of Louisiana (and any other applicable jurisdiction) create an ethical duty to notify clients of such incident. Additional Considerations: Mailing and Call Center Vendor. If notice is necessary, a vendor is often engaged to provide notice letter printing and mailing and external call center services for affected individuals when disclosure is being provided to a large number of individuals and/or the media, when there is an anticipated heightened interest by the media or a specific population regarding the event, or when an organization cannot handle these tasks without suffering an interruption in business operations. In addition to handling volume, call center vendors are experienced at responding to questions from individuals affected by a data privacy event. The vendors with which we work have preferred rates for Travelers-insureds. In addition, should such vendor services be chosen, we will engage these vendors on your behalf to best protect, to the extent possible, the relationship and communications in the attorney-client privilege. Regardless of whether a call center vendor is engaged, we will prepare talking points and Frequently Asked Questions for whomever is responding to inquiries regarding this event to use during such response process. Credit/Identity Monitoring. Connecticut is the only state requiring an entity to provide affected individuals with credit monitoring/repair services in certain circumstances, such as the unauthorized acquisition of name and Social Security number. California’s statute is less clear, but arguably requires the provision of such services in similar circumstances. There, the statute states “an offer to provide appropriate identity theft prevention and mitigation at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached, when the information breached includes a [Social Security Number] or [California Identification/Drivers’ License number].” While California and Connecticut are the only states with requirements to offer such circumstances, such an offer is nevertheless often made during disclosure of a reportable event in an effort to mitigate any damage that may result from unauthorized access/acquisition of the individual’s personal information. A decision to offer these services would be viewed favorably should this incident draw any regulatory investigation. If it is determined that any protected information was subject to unauthorized access or acquisition and Carver Darden wishes to offer affected individuals with access to a free monitoring product, we will engage a Travelers-approved vendor on your behalf. Document Preservation. It is important to preserve any and all information, memoranda, computerized data, network and computer logs, email server logs, paper data, reports, etc. relating to this incident, the investigation and response. It is also important that Carver Darden’s IT personnel be asked to suspend automatic data destruction routines. We will continue to work with you and your staff to ensure all necessary information is adequately preserved. Next Steps: Carver Darden Review CRA’s roadmap and determine if you would like to engage CRA for the forensic investigation. Identify any contracts in place with business partners, employees, vendors, or other third parties relating to privacy and data security and provide these policies to Mullen Coughlin for review. Identify addresses and states of residences for impacted individuals, as they are identified, if applicable. Provide a copy of Carver Darden’s policy on security incident reporting and investigation, including any incident response plan or notification plan that may be maintained by Carver Darden. Provide copies of reports, summaries, and communication relating to Carver Darden’s investigation and response to this event. Engage in document preservation efforts. Mullen Coughlin Coordinate and direct the forensic investigation. Review any applicable policies/contracts with clients, business partners, or other third parties that may impose an obligation to disclose an incident impacting the security of Carver Darden’s information. Identify applicable law and analyze the forensic investigator’s findings to determine whether this is a reportable event under applicable law. Prepare notice deliverables for Carver Darden’s review and approval, as necessary. Engage vendor services for disclosure, if necessary. Assist Carver Darden with document preservation and retention. Continue to provide Travelers with updates regarding the investigation and response.
- #24 See 3-21 Appleman on Insurance § 21.01.