The Dark Overlord hack stands at the intersection of a number of prominent issues in the modern world: terrorism, cyber warfare, confidentiality and privacy. On New Year’s Eve, 2018, a group of hackers calling themselves Dark Overlord stated they had hacked confidential legal files related to the insurance litigation that followed the 9/11 attacks. The hackers demanded a ransom from the law firm from whom the information was stolen. Apparently, the ransom was paid but the law firm breached the terms of the ransom by reporting the breach to law enforcement. Now the hackers have threatened to sell the information online through the dark web.
It seems not a week goes by these days without news breaking of another massive data breach affecting hundreds of millions of people. At the end of November 2018, Marriot, the global hotel chain, announced they had been hacked and the personal information of five hundred million preferred customers had been exposed to criminals. What’s worse, Marriott announced the original data breach occurred over four years ago, leaving people unknowingly at risk for identity theft during that time.
Within the context of cyber security, one most always discusses the subject in exponentials; Whether considering the number of breached records, the amount of damage, or the size of data leaks. What was groundbreaking three years ago in volume will seem quaint by the end of the year. A host of news stories regarding the 2013 and 2014 data breaches at Yahoo Inc. over the past few months have underlined this aspect of the conversation about cybersecurity. It serves as a stark reminder that companies need to keep an eye on their cyber risks and seriously consider purchasing cyber insurance if they have not done so already to survive this increasingly harsh ecosystem.
The clash between the stringent privacy requirements of HIPAA and the known vulnerability of most cyber systems creates a host of anxieties for most modern medical care providers. The Health Insurance Portability and Accountability Act requires that medical providers and insurers take reasonable precautions to ensure that the medical information of their patients remains private. At the same time, it is increasingly apparent that almost all cyber information systems have at least a few vulnerabilities, even if only through their users, and few systems can withstand a dedicated, concentrated cyber assault.
Wire transfer fraud claims resulting from cyber attacks have increased dramatically over recent years, and companies are losing millions of dollars in these attacks. As is common when a new business risk develops, organizations look to their insurance policies to help cover their losses. As we have shared in previous examples, the coverage is not always adequate.
The extent of coverage for a company that has been a victimized may be sparse, and the costs of any breach are ongoing. Consequences of a fraudulent wire transfer depend not just on the specific wording in the policies a business has purchased, but as seen in the following instances, also being upheld differently in different states.
What Is GDPR?
The General Data Protection Regulation or GDPR is a set of laws created with one ultimate goal: to protect the personal data of people in or from the European Union (EU). The critical point here is that the individual’s nationality or residence is irrelevant- just whether they are in or from the EU. This law has forced the hand of many businesses to adopt the regulations into their practices for data collection- most commonly seen on websites. The GDPR became effective on May 28, 2018, but many businesses are still catching up due to inertia in changing procedures and practices.
Whether to purchase cyber risk insurance remains a big question for many companies. Recent studies have shown that only a quarter of U.S. companies currently have cyber risk insurance despite more than half of companies stating they expect to suffer a breach within the next year. These positions seem inapposite, but they appear to stem from doubts about the effectiveness and the extent of cyber coverage given its price.
Another major data breach at an American company worth billions of dollars has served to heighten cyber security concerns in businesses of many sizes in many countries. Equifax announced in September 2017 that a massive theft of data from their system had occurred. The failures of Equifax's cybersecurity team resulted in hackers obtaining the personal information of over one hundred and forty-five million of the people whose credit history Equifax tracked.
In the popular imagination, major cybersecurity events involve an elite hacker (or a group of them) employing a singular genius to crack complex computer codes and steal vital secrets or millions of dollars. The reality is that most hackers use a set of tools available for sale for shockingly small amounts of money. “Hacker schools” in places like Brazil and Russia can train someone who is relatively computer illiterate to use those simple tools to exploit vulnerabilities and gain access to sensitive information, whether it be trade secrets or personally identifiable information useful for committing identity theft.
The last few months have seen a series of high profile ransomware attacks strike businesses across Asia, Europe, and North America. Large numbers of businesses have seen significant losses as a result of these attacks. Losses have stacked up, and companies without cyber insurance are now facing hefty bills.