Third-party liability, and what the policy does not repair

The first two parts of a cyber loss concern the insured: what it spends responding, what it loses by not operating. The third concerns other people, and it obeys an entirely different logic because it is not quantified at the time of the loss. A data breach opens claims that will arrive over years, before different jurisdictions, brought by people who do not know each other. It is a long-tail item grafted onto an instantaneous event, and that is what makes it hard to reserve for and to cover.

Two exposures the word liability covers must first be separated, and they have almost nothing in common. The first is civil: individuals whose data leaked, or corporate customers whose business was interrupted, claim compensation. The second is regulatory: a supervisory authority opens a procedure, asks for explanations, and can impose a sanction. Both run in parallel, on different timetables, and what the insured says to one can serve the other. Coordinating those two fronts is work in its own right, and it belongs to response costs as much as to liability cover.

On the civil side, the difficulty is not the unit amount but the number. The prejudice of a person whose address and telephone number leaked is small and sometimes hard to establish; multiplied by thirty thousand, it becomes a serious matter, and it attracts collective action mechanisms that vary greatly from country to country. Policies ordinarily cover damages and defense costs, often within a single limit, which produces an effect insureds discover late: a long defense consumes the cover that should pay the compensation.

On the regulatory side, precision is needed because the ground is moving. Costs of assisting a procedure, investigations and advice are covered by most policies. The fate of monetary sanctions is another matter: their insurability depends on the applicable law and varies by country, so that contracts typically cover them to the extent permitted by law, a formula that defers the question without settling it. An insured relying on that line must know it may cover nothing in its jurisdiction, and that check is made at placement.

A third exposure, almost always underestimated, comes from business-to-business contracts. A provider processing data for its customers has signed indemnity clauses with each, often drafted without a cap or with a high one, that trigger in cascade the day its systems go down. For many service companies, that contractual liability toward a few dozen corporate customers far exceeds liability toward thousands of individuals. It is measured by reading one's own contracts, an exercise nobody does before the loss and everybody does after.

Finally, what the policy does not repair must be named, because it is often the heaviest part. Customers who do not come back, reputational harm, management time consumed for months, the valuation of a company that must announce a breach during a fundraising: none of that is indemnified, and none of it is marginal. Some policies offer image restoration cover, which pays for a campaign, not for turnover. Stating that limit clearly is better than letting people believe a cyber loss ends with a check.

The discipline comes to three readings done before the incident. Check whether defense costs erode the limit or sit above it, a one-line question that changes everything on a long file. Check what the policy says about monetary sanctions and what the applicable law permits, rather than reading the clause alone. And take an inventory of the indemnity clauses given to one's own corporate customers, because that is where, for many companies, the largest exposure in the whole loss is found.