A recently disclosed $10 million data breach expense bill raises an issue that has been percolating the network security and privacy (NSAP) insurance marketplace for several years now. The publicly disclosed expenses involve BlueCross BlueShield of Tennesee (BCBST).
According to BCBST, in October 2009, “57 hard drives containing audio and video files related to coordination of care and eligibility telephone calls from providers and members were stolen from a leased facility in Chattanooga that formerly housed a [BCBST] call center.” And, as of June 11, 2010, the total number of current and former compromised BCBST members is 998,936. Although there has been no documented incident of identity theft or credit fraud of BCBST members as a result of this theft, BCBST has incurred to date $10 million in costs. These expenses are driven by its retention of Kroll to investigate the theft, e.g., determine which members were impacted, Equifax credit monitoring, LifeLock services, notification costs, and call center expense.
The key takeaway from incidents such as this one turns on the fact there is no lawsuit to defend – and no NSAP liability policy trigger to set in motion. The only trigger is first-party driven, namely the internal expenses incurred to deal with a data breach incident.
As with most NSAP insurance buyers, the growing number of Blues who have actually purchased NSAP insurance have agreed to sub-limits on their first-party expenses that are usually a fraction of the full liability limit. This is unacceptable given victims such as BCBST are often forced to expend millions of dollars without seeing a single lawsuit or regulatory complaint. In fact, the goal of spending so much on the front end is to avoid litigation.
The good news is that there are a few NSAP insurers who are willing to offer full limits for first-party expenses incurred as a result of a data breach. These insurers should be evaluated when looking at NSAP insurance for the first time. And, upon renewal, if your current insurer does not provide the limits you need for the expenses you are most likely to incur, either have your current broker evaluate other insurers or turn to a new broker who can help locate better options.