This is correct.

I disagree. I think a cyber exclusion is not necessary in property policies. You made the point itself: direct physical loss. Cyber insurance fits the niche here, and perhaps an optional coverage or endorsement for gl policies makes sense.

But you should not expect that cyber damage would be implicitly covered in a gl or property policy (imho). Unless there is legislation demanding it, in which case an exclusion would need to be added in order to implicitly sell a gl policy with no cyber component.

Exclusions are generally the result of some legislation that makes previous policies more ambiguous. See: recent cannabis exclusions. Since the government has been toying with the laws around the legality of cannabis, it's no longer assumed that it is illegal to produce and thus policies which previously did not cover it now "may" unless an exclusion is present.

Cyber has never been covered, as it isn't direct property loss. Unless the government defines software as a physical property, I see no reason for an exclusion.

Many are putting on silent cyber exclusions. This started happening during the pandemic.

Seriously, life is going to be a lot more bearable once people who grew up with tech are in a position to make these calls.

Not really.

The insurance policy in question was for PHYSICAL damage.

There are insurance policies you can get to protect against data loss, but the plaintiff in this case didn't have one.

It took me great effort to learn this. It involved reading the linked article. But I have suffered this hardship willingly to bring you knowledge.

It wasn't an absurd ruling thought. Do you really think the description "direct physical damage" (which the insurance was for) should apply to damage from hacks and ransomware?

You don't need to be young or old to read the policy wording to see what it covers and what it excludes.

Read the article. There is nothing in this case that hinges on some super high technology that the court just doesnt understand.

Software is not covered under the wording of that Property policy (FYI it is meant to cover tangible things like buildings and machinery and its wording is clear that it doesn't cover intangible things). Software and the like is intangible and the insurance industry has a separate product which does cover software and cyber claims (cyber policies). Just because the company didn't buy a Cyber policy doesn't mean the Property policy has to cover something its wording excludes.

In insurance, if this is covered, everyone can enjoy very, very high premiums. The intent of coverage on a standard business policy is clear, if someone wants this coverage they need to purchase it, it’s a readily available coverage called Cyber Liability and Data Retention.

This court ruling would make all insurance significantly more expensive.

You should look at what the profit margins are for property and casualty carriers are in the US….they are low as fuck, many lose money. Only a few consistently make money. This isn’t health insurance, all the money goes to the brokers and agents who get paid commission without the risk and competition is terribly high. It’s not like adding coverage where none is intended won’t result in higher costs to be imposed on consumers, consumers who today often choose not to insure this exposure due to how expensive it is.

Over here the problem is not the cost of the insurance. The problem is renegotiating the price for the new one if you claimed it.

Funny thing is that almost everyone has a fire insurance, the change is like 1 out of 10.000 or something that it happens to you. Cybercrime attacks are around 1 out of 8 these days.

This was, to the company, a reasonable risk. They already had a loss, large enough that it was worth it to get lawyers and try to argue as hard as they could. Sometimes you do the math and spending thousands for a 1% shot at recovering millions of worth it.

Negligence is the correct assessment, but more often than not it's lack of understanding, but penny pinching. At least you wouldn't see them spending this much on lawyers. People get experts to make certain things are safe, but many don't understand that IT person is not a cyber security expert. For all we know this court theater was to argue they were legitimately lead to believe they were covered for this situation and therefore can point at someone else.

That said this is based on generalisms, and I've seen a lot of companies with serious mismanagement. This specific case could certainly be the case of someone who would not listen to reason or advise. All I'm stating here is, as far as I can tell, there's not enough info to be reasonably certain.

Not that I disagree, but did they know it was available?

How many different options exist? I know I didn't know that house to curb utility insurance existed as an option for years, but it does. Does having something, purely as an option that's not disclosed make it enough of a defence to not pay out? how many other options do I not know about?

That just seems like a quick way to spiral out of covering anything and coming up with little policies to cover lots of little things.

That's just more expensive and seems like a way for insurance companies to weasel out of their job while at the same time blaming the customer and trying to pull in more money.

Sounds more like insurance companies trying to weasel out of it. Creating specific policies for every little thing is just a way for the insurance companies to not pay while making more money.

“Multiple Column Menu on Larger Viewports” hacker man is back at it again

No, they said the policy defined the coverage as applying to physical loss only.

There was no assertion of value or importance.

If you think that being in compliance means that you can't be hacked, you've never worked in compliance.

Being in compliance just means that you have giant piles of paper with checkboxes that are all checked. None of those checkboxes actually enforce real security.

That wouldn't invalidate the coverage. As long as you can show your company and employees have policies and procedures in place and are being followed your claim will be approved.

Source: personal experience making a claim on a cybersecurity policy.

"I think you should owe money you don't actually owe because I say so."

Probably a good thing you're not a judge.

Cyber insurance has been around for years though to specifically cover damage from cyber crimes. Like homeowner's insurance covers many things that can happen to your home, but some forms of loss/damage require specific coverage. It's no-more bad faith than than.

Cyber insurance may be priced differently by company based on the specific digital risk and whatever mitigating factors the company have in place (software, hardware, security policies), like physical insurance may be priced differently for physical mitigating factors (fences, locking mechanisms, cameras, security personnel).

There is no bad faith here but the intent of a property policy is not to cover cyber claims. There is no “cyber” in Basic 1 or 2, Broad, or Special. Most property policies have a cyber exclusion on them by this point.

I'm glad you're not a Judge as they made the correct ruling here. The company did not have breach insurance.