These incidents prompted many questions about online security, especially since it affected some of the most advanced and sophisticated Internet services. What does it portend for millions of establishments worldwide who can hardly expect to keep pace with skilled and determined hackers?
There is yet another question, little heard but equally pressing: What happens when an entity disrupted by a cyber attack simultaneously suffers a physical loss to property and a resulting loss of income?
Given the scope and scale of the October 2016 and May 2017 attacks, such a scenario is by no means fanciful. In fact, simultaneous losses under different policies are increasingly likely.
Business interruption claims could become a lot more complex as more enterprises purchase at least three types of first-party coverage, each with its own business interruption coverage built into the policy, endorsed onto a policy or included in a commercial package.
First, there is the standard business interruption-extra expense (BI-EE) coverage part included in a commercial property package, typically triggered by damage to property at insured and contingent locations by perils indicated on the package’s cause of loss form. (It’s possible, however, to have different property and income perils in a commercial package.)
Second, there has been a significant increase in recent decades in the number and range of organizations purchasing equipment breakdown coverage, which has its own business interruption terms and conditions.
Originally known as “boiler and machinery” insurance and primarily associated with manufacturers, equipment breakdown coverage has evolved and expanded to incorporate a vast range of electronic and mechanical equipment used in many operations, not only industrial ones.
Equipment breakdown policies typically cover loss to both the insured equipment and other property of the insured, plus related income losses and extra expenses, arising from“accidents”within the equipment such as mechanical breakdown, bursting of boilers or electrical arcing.
Third, more recently there has been a rapid increase in the number of organizations purchasing “cyber insurance,” a new and rapidly growing form of coverage that insures for first- and third-party losses arising from damage to or a breach of sensitive data on a computer network.
To date, cyber policies are mostly available from surplus lines carriers and are far less standardized than most property or equipment breakdown forms.
In general, cyber policies cover losses to data and system functionality caused by unauthorized intrusions into company networks. In some cases coverage is available for loss of income and extra...