The cyber loss that lands in a policy that never mentions it

Silent cyber is almost always told from the property side, because that is where it was discovered and where the amounts are spectacular. That is an incomplete view, and it leaves out the lines where the silence is thickest today. A claim arising from an IT incident does not only land in a property policy: it can land in a general liability, directors' liability, professional indemnity or crime policy, and none of those four has been reread as much as property policies have.

General liability is the first and broadest case. A third party whose personal data has leaked, a customer whose business stopped because the insured could no longer deliver, a partner whose network was reached by a path through the insured: those claims are directed against the insured, they look for a liability policy, and many general liability contracts say nothing about cyber. The question then shifts onto notions written for something else: is there damage, is it physical, financial, consequential or not, and is a third party's data property.

Directors' liability forms the second case and it is of another nature, because the claim there bears not on the incident but on its handling. A director is blamed for having underinvested in security, delayed notifying an authority, poorly informed a board or communicated inaccurately to the market after the attack. The operative fact is therefore not technical, it is decisional, and a directors' policy excluding cyber by a general clause would find itself excluding a management fault because its subject was IT, which is rarely the drafted intention.

Professional indemnity is the third case, and it concerns every company that renders a service to others. A provider whose service stops, a software publisher whose product served as the path, a host whose customers lost data: the claim is contractual, it bears on a service badly performed, and the IT incident is only the cause. Many of those contracts cover professional fault without distinguishing its cause, and therefore find themselves answering for a cyber loss without ever having named it, which is silent cyber in the full sense.

The fourth line is crime, and it deserves isolating because it produces the most frequent litigation by volume. Does a payment diverted after an email impersonation fall under the crime policy, which covers misappropriation of funds, or the cyber policy, which covers the consequences of an intrusion. Often no intrusion took place: nobody entered the system, somebody wrote a convincing email. The two policies may then pass the file back and forth, one on the ground that no system was breached, the other on the ground that the payment was deliberately ordered by an employee.

One observation should be drawn from those four cases, worth more than their list. Silent cyber outside property policies almost never appears as a flat refusal: it appears as a discussion between two of the same insured's insurers, each pointing at the other, while the file does not settle. The cost to the insured is therefore not only the risk of being uncovered, it is the delay, and eighteen months of delay on a fragile cash position produces a harm of its own that nobody indemnifies.

The useful step is consequently different from the previous lesson's. On a property policy, one reads a clause. On these four lines, one reads an articulation: which policy responds first, which comes in addition, and what happens when the two insurers characterize the same facts differently. An order-of-settlement clause, a shared definition of loss, or simply placing two covers with the same insurer are often worth more than an extra extension, because they remove the argument rather than adding an amount.