Reputational harm cover
Cover compensating the fall in profit a company suffers when customers turn away after a publicized cyber incident, distinct from crisis communication costs.
After a data breach or a highly publicized attack, a company may lose customers long after its systems are back to normal: subscribers cancel, prospects walk away, partners suspend orders. This loss is not classic business interruption, which ends when activity becomes possible again; it stems from mistrust. Reputational harm cover compensates it. It compares the company's profit over a given period, often six to twelve months after the incident becomes public, with what it would have been without the incident, and pays the difference attributable to the negative publicity. It usually requires the incident to have been made public, by the press, social media or a regulatory notification, and excludes declines due to other causes. It differs from crisis management costs, communication advice, press relations, which appear in almost every cyber policy and aim to limit the harm rather than compensate it. The product is hard to price and to settle: isolating the effect of reputation among the causes of a revenue fall requires contestable forensic accounting. That is why it remains offered under narrow sublimits, with a time deductible.
Textbook case: an online bank suffers a data breach widely reported in the press. Its systems work normally, but account openings drop 30 percent for nine months. The forensic accountant appointed puts the lost margin attributable to the incident at 1.2 million euros, which the cover pays within its limit.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.