Earlier this year, Sony was the victim of a hacker attack that might have resulted in unauthorized release of the personal information of people who used the PlayStation Network. Now, Sony’s insurer, Zurich American, has asked a court to declare that it doesn’t have to cover the cost of defending Sony against legal claims that came as a result of the data breach.
If you, or someone in your family, was using the PlayStation Network, or Qriocity, a few months ago, then you probably remember when Sony got hacked. Sony shut down both of those services shortly after discovering that the corporation was a victim of a cyber-attack.
There was a possibility that the personal information of the people who used either of those Sony services was released when the corporation got hacked. This meant that there were a whole lot of people who might have become the victim of identity theft as a result of this data breach.
Perhaps this is why Sony decided to give all PlayStation Network members (who lived in the United States), a year’s worth of identity theft insurance coverage, for free. These policies cost $1 million dollars each.
It can be very expensive for companies to recover from a cyber-attack. This is why some corporations have purchased what is being called “cyber-insurance”. In general, this insurance policy is supposed to help a company that was hacked to pay for things related to recovering from that type of event. It could, potentially, pay for the identity theft policies that the company gives its customers. It could pay for the labor hours spend writing public apology letters, or replacing breached hardware.
The problem is that there isn’t a very clear definition about exactly what cyber insurance is for. It is so new that the specifics are still being worked out. This lack of clarity is already leading to problems.
Zurich American Insurance Co. is the company that is the insurer of Sony. Zurich American wants a New York court to officially state that Zurich doesn’t have to cover the costs of defending or indemnifying Sony against claims that are made against it in “class-action lawsuits, miscellaneous claims, or potential future actions” from any state attorney general. Zurich American may, eventually, claim that the general liability insurance that it has with Sony is not designed, nor intended, to cover digital attacks. Instead, the policy, according to Zurich American, covers “bodily injury, property damage, and personal or advertising injury”.
This dispute, and the outcome of it, will very likely affect how future cyber-insurance policies are written. This type of insurance is so new that it is not quite fully formed yet. As more companies experience attacks by hackers, it will become more clear about what the company hopes that a cyber-insurance policy will cover. It is hard to say if the insurance companies who create those policies will agree with those assessments.
Image by Justin Ruckman on Flickr