Sixth Circuit Uses Every Tool in the Box To Build Case for Coverage for Defrauded Policyholder

July 12, 2018, we reported on the Medidata decision handed down by the Second Circuit in which the court found coverage for a claim resulting from social engineering fraud. We suggested the ruling in Medidata lacks persuasive power due to its unusual factual circumstances and atypical policy language. The Sixth Circuit’s decision in American Tooling Center, Inc. v. Travelers Casualty & Surety Co. of America, No. 17-2014, 2018 WL 3404708 (6th Cir. July 13, 2018), will have more persuasive power, but due to…
Continue reading...

Fourth Circuit Weighs in on the Evolving Law of Standing in Data Breach Litigation to Hold that Misuse of Stolen Data Confers Standing

While data breach lawyers wait for the U.S. Supreme Court to more clearly define when a hack confers standing on the individual whose personally identifying information (PII) is stolen, the Circuit Courts of Appeals continue to choose sides over a useful standard. On June 12, 2018, the Fourth Circuit weighed in to hold that the individual has standing when the data is actually misused, such as when the hackers open fraudulent credit cards with the stolen PII, and the individual spends time and resources on…
Continue reading...

Second Circuit’s Decision Upholding Social Engineering Fraud Coverage Likely a Paper Tiger

In a case closely monitored by the insurance industry, the Second Circuit upheld in a non-precedential summary order a New York federal district court’s summary judgment finding coverage under the computer fraud coverage of a commercial crime policy. Medidata Solutions, Inc. v. Fed. Ins. Co., No. 17-2492, 2018 WL 3339245 (2d Cir. 2018). Although the policyholders are apt to tout the decision as a seismic victory, the atypical policy language and factual circumstances should greatly limit its persuasive value. As background, the insured, Medidata…
Continue reading...

Understanding the California Consumer Privacy Act (CCPA): Part One

In 2020, California Consumers will be granted new online privacy protections under a first-of-its-kind California law. A sweeping new privacy law — the California Consumer Privacy Act of 2018 (CCPA) is the nation’s toughest privacy law and could serve as a model for other states. The bill came to a vote in both houses on June 28, 2018. The assembly voted 69-0 to approve it shortly after the Senate approved it 36-0 , and was signed by Gov. Jerry Brown the same day. The CCPA…
Continue reading...

Fifth Circuit Shops for Implicit Allegations Wrongdoing Against Liquor Store Chain To Avoid Policy Exclusion

The Fifth Circuit Court of Appeals in Spec’s Family Partners, Ltd. v. Hanover Insurance Co. (No. 17-20263, Jun. 25, 2018), afforded a contractual liability exclusion a narrow interpretation to deny an insurer judgment in its favor.  The coverage litigation resulted from Hanover Insurance Company’s (Insurer) refusal to pay Spec’s Family Partners’ (Spec’s) litigation costs in connection with a payment card industry (PCI) liability dispute between Spec’s and First Data Merchant Services, LLC (First Data) following a data breach. The Spec’s credit card network had been…
Continue reading...

New York Cybersecurity Regulations Extended to Credit Reporting Agencies

This week, Governor Cuomo has directed the Department of Financial Services to issue a final regulation requiring credit reporting agencies to comply with cybersecurity regulations applied to financial service companies, previously adopted in 23 NYCRR 500, et seq. The new regulation, 23 NYCRR 201, et seq., obligates credit agencies reporting on 1,000 or more New York consumers to register annually with the DFS, and, beginning November 1, 2018, to comply the previously adopted standards, including adoption of a cybersecurity program and CISO, and other controls.…
Continue reading...

Should American Companies Be Worried About Security Risks Posed By Chinese Telecoms?

Members of Congress from both sides of the aisle recently wrote a letter to Google to express “concerns” about its strategic partnership with Chinese telecommunications companies such as Huawei Technologies, based on security risks related to state-sponsored espionage. As noted by the lawmakers, the heads of the CIA, NSA, FBI, and Defense Intelligence Agency have voiced similar concerns that smartphones made by China’s two largest manufacturers, Hauwei and ZTE., pose a security threat to American customers.  Moreover, the UK’s National Cyber Security Centre found that…
Continue reading...

Supreme Court Recognizes Expectation of Privacy Regarding Cellphone Location Data

On Friday, June 22, 2018, in a 5-4 split, the Supreme Court in Carpenter v. United Statesheld that the government usually needs a warrant to access an individual’s historical cellphone location data held by third-party carriers. The court rejected the government’s argument that an individual does not have a legitimate expectation of privacy under the Fourth Amendment concerning the location data that third-party carriers collect and keep.  This data, essentially logs of the location of cellphone towers used to route calls to and…
Continue reading...

An Insurer’s Guide to Navigating the Legal Landmines of Cybersecurity Regulation

Cybersecurity is front and center now, especially for the financial services industry which includes insurance and reinsurance companies, among others.  States and regulators are passing laws and promulgating regulations designed to protect customer data in the possession of insurers and their associates. These new statutes and regulations aimed at the insurance industry are in addition to the myriad of other requirements imposed by government for the protection of this data. Aaron J. Aisen, co-chair of the regulatory sub-practice group in the Global Insurance Services
Continue reading...

Shared InfoSec Language Fosters Shared InfoSec Goals

While most business leaders agree that cybersecurity has significant value, determining exactly where and how to spend company dollars on training and infrastructure continues to be a point of disagreement within organizations. Intelligent communication using a shared vocabulary, according to a recent Focal Point Data Risk report by the Cyentia Institute, is vital to achieving consensus, and a comprehensive security plan. As the barriers between the c-suite and IS department continue to diminish, thanks, in part, to widespread adoption of a chief information security officer…
Continue reading...