Zurich Seeks to Clarify Insurance Coverage of Sony Hack Attack

Posted on Jul 25, 2011 by Sergio Ulloa (G+)

Zurich American Insurance Co. (ZAIC) is going to court to determine whether or not they are liable in underwriting or defending Sony Corporation against the subsequent lawsuits and investigations related to the devastating hacker attack and data breach that afflicted the media and electronics conglomerate earlier this year. The outcome of this legal dispute could be a harbinger for further claims as both the threats to the security of information networks and the losses related to our interconnectivity continue to escalate. How to write and police policies that protect online data has now become a contentious subject of debate in the international insurance industry. In April, Sony suffered a massive data breach when an unknown group of hackers skirted security protocols and gained access to some 100 million user accounts, potentially with corresponding credit card numbers, on the PlayStation Network. The attack was the second-largest online data breach in US history. The global video-game and movie-streaming network was then shut down again for another month as Sony reviewed its safety measures. On May 5th Sony CEO Howard Stringer apologized and offered free identity theft insurance coverage for all their US customers. The total cost of this breach and subsequent network outage is estimated to be 14 billion yen (US $178 million), not mentioning the losses related to scores of now disaffected Sony customers. While the company had agreed to payout compensation to anyone who suffered financially as a result of the incident, Sony is still being sued by a number of users and herein lays Zurich America's complaint. Investigations conducted by US state and federal regulators looking into the incident are also underway and could end-up before the courts as well. Zurich American filed suit with the state Supreme Court in New York last week, seeking 'declaratory relief' from having to defend and possibly compensate Sony over the 55 class-action lawsuits currently filed against it in the US, or any other subsequent action in response to the data breach. Each lawsuit has alleged in principal that the plaintiffs suffered damages resulting from unauthorized access to personal identification and financial information and also by an alleged delay in notifying members about the cyber attack. The most notable suit brought forward has been from an Ontario woman, filing on behalf of a million Canadian users for US$1 billion in damages. Sony has demanded Zurich American and Zurich Insurance Co. Ltd., both units of Zurich Financial Services, defend and indemnify them against this assortment of class-action claims related to the hacking scandal through their commercial general liability insurance policy written for the company as of April 1 2011. Zurich argues that its policy with Sony only covers claims related to bodily injury, property damage or personal and advertising injury and thus is not liable to indemnify the company for cyber-intrusion. According to the complaint, Zurich's policy with Sony features exclusions related to 'class-action complaints and miscellaneous claims', which would deny coverage from such a circumstance and only apply to certain subsidiaries within the corporation anyway. Sony has 30 days to respond. Sony intimated early on that the company would look to insurers to help pay for their massive network security breach. The costs associated with cleaning up their network were estimated to be US$20 per member, for a combined total surpassing US$2 billion. Zurich however wishes to clarify that while Sony could claim there was real-world property damage as a result of the network breach, the general liability insurance policy signed with them wasn't eligible to cover cyberspace attacks or theft, even if all other underlying insurance is exhausted. Sony in fact has held a separate cyber insurance policy with another company but was looking to Zurich American for help covering the expected high costs associated with defending itself against upcoming class-action lawsuits. Zurich American doesn't believe they are bound to take on such responsibilities going forward and have furthermore sued units of ACE Ltd, AIG and Mitsui Sumitomo Insurance, asking the court to declare what is in fact covered under the various insurance policies they had written for Sony. It is yet to be determined who should pay for upcoming lawsuits or how in fact the loss burden could be shared. Zurich America's attempt to extricate itself from these financial liabilities demonstrates the precarious coverage situation currently involving computer hacking and online identity theft and fraud. While Sony's balance sheet certainly has suffered, the real-world servers housing their afflicted networks have not and thus the question of whether cyber-property damage amounts to real property damage and who covers it remains. One thing is for certain though; internet security is fast becoming a large concern for businesses today. As commerce continues to move online, the gap between technological innovation and the ability to protect data offers criminals an opening to launch attacks and steal sensitive industry information. Network security is fast becoming an issue for business of all sizes. Cyber liability insurance is thus becoming a more necessary and strategically important part of any company's insurance coverage considerations. Sony's experience will certainly serve as a lesson to many and if Zurich's claim succeeds it will set a huge precedent in deciding who has responsibility over these massive online networks and the data within them. Insurance Company Mentioned Zurich Headquartered in Zurich, Switzerland, Zurich Financial Services Group is an insurance-based financial services provider with a network of subsidiaries and offices in North America and Europe and also in Asia-Pacific, Latin America and other markets. Zurich is one of the world's largest insurance groups, and one of the few to operate on a truly global basis. With 60,000 employees serving customers in more than 170 countries, our business is concentrated in three business segments: General Insurance, Global Life, and Farmers.