Experiencing a deluge of cyber breach incidents and claims, the insurance industry has responded in earnest by upping its cyber liability product offerings. But with the market still in its relative infancy, is there clarity around coverages and expectations? Cyber risk is real. But the risks faced by each organization can be quite nuanced. Carriers are racing to keep up with evolving risks while at the same time attempting to create insurance products that are both helpful and profitable. Along the way, there are bound to be misunderstandings and, inevitably, issues. 

Examining cyber risks

Ransomware is a very hot issue right now, so let's start by considering the case of a business income loss claim coming from a hospital that suffered a ransomware attack. The entry for the attack happened when an employee of a software provider to the hospital accidentally exposed their credentials. The bad actor who picked up the credentials seized the opportunity to perform a ransomware attack, incapacitating the hospital for a period of time. The hospital files a business interruption (BI) claim with their insurer, but E&O coverage also comes into play on the software provider whose employee made an error in exposing their credentials. It wasn't intentional or malicious. It was an innocent mistake. How are damages calculated, and who holds the liability?