Client Information Security Helping Organizations Protect Private Client Data


Spammers will be Phishing for your Money

“On April 4, we were informed by Epsilon, a company we use to send emails to our customers, that files containing the names and/or email addresses of some [Insert company name] customers were accessed by unauthorized entry into their computer system.”

During the last couple of weeks it’s likely that you have received a similar e-mail notifying you that your e-mail address was stolen. Epsilon, one of the largest e-mail marketing companies, had its database breached and “a subset of Epsilon clients’ customer data were exposed.” According to Epsilon the breach was limited to e-mail addresses and/or customer names only. No other personal identifiable information was stolen.

The scope of the breach and the list of large customers involved, make this one of the largest security breaches of its kind. While only about 50 clients were involved they include some of the largest companies such as Citigroup, Capital One, Walgreen, Best Buy, Target, Hilton, Kroger, Tivo, US Bank, Disney, The College Board, and Marriott.


Even though the breach only included e-mail addresses and names, many security experts are concerned about the implications. Simply knowing someone's email address and their spending habits - or at least the brands with which they have some sort of relationship - may make it easy to craft a targeted and sophisticated phishing attack.

If scammers know that you have a credit card with Capital One, for example, they may send emails asking you to log into a website and provide personal information that will give them access to more data, including financial information. People do fall for these targeted “spear-phishing” attacks, because they appear to come from a company they have a relationship with.

Phishing Prevention

Phishing attacks are not uncommon, but, if you keep your guard up about where you click and what information you enter into a Website, you'll probably be safe. But phishing attacks do work, even if it's just for a small percentage of recipients. And as the breach at Epsilon has exposed tens of millions of email addresses, even that small percentage could prove to be a sizable number.

When you receive an email from any company you have a relationship with, make sure you scrutinize it fully. Look at the email address and verify the sender. Look for typos and strange URLs. But don't click on those links.

If you do get a suspicious email - particularly one with an urgent tone asking you to update your personal information - pick up the phone and call the company in question. Remember: very few (if any) companies will ask you for sensitive information via email. If in doubt, log into the company website directly and verify the request.

Explore Insurance

Any organization that maintains a database of customer information is at risk. Make sure you understand the liability you face and explore purchasing Network Security and Privacy Insurance.


Insurance for Data Breach Expenses

The vast majority of insurance agencies do not have any insurance coverage for reimbursement of the costs incurred due to a client data breach. Here are just a few of the reasons why a Network Security and Privacy (NSAP) policy makes sense for insurance agencies:

  • Coverage for data and other non-physical perils is routinely excluded under Property policies.
  • The “intentional acts” exclusion found in a standard E&O policy might eliminate coverage if the breach was caused intentionally by an employee.
  • E&O coverage may not respond at all for acts that are outside the provision of professional services.
  • Liability arising out of the destruction of electronic data is not typically covered under the standard General Liability or Property policies.
  • Crime policies generally only cover theft of money, securities or other tangible property – not information theft or the destruction of electronic data.

Don't be the cobbler with holes in his shoes! You need to take the appropriate risk management steps to protect the private client information contained within your electronic and physical files.

If that does not work, you will be glad you have separate coverage.


Colorado Casualty: “There is no coverage”

Colorado Casualty Insurance company is seeking a judicial ruling that it is not obligated to pay for costs incurred by the University of Utah in 2008 as a result of a client information breach.

On or about June 1, 2008 car burglars stole back-up tapes from the personal car of a Perpetual Storage employee containing medical billings records with sensitive personal information (including social security numbers) on 1.7 million university patients covering a time period of approximately 16 years.

University of Utah officials want Perpetual Storage, their backup storage vendor, to reimburse the cost the university incurred because of the client data breach. Not including 6,232 in personnel hours responding to the breach, the University allegedly spent over $3.2 million on:  (1) $646,149 in printing and mailing costs; (2) $81,389 for a call center that fielded over 11,000 calls within two weeks; and (3) $2.5 million for credit-monitoring services.

Colorado Casualty Insurance Company wrote a commercial package policy and a commercial liability umbrella policy for Perpetual Storage that was in effect at the time of the client data breach. Ron Sutherland of United Insurance Services was Perpetual’s insurance agent at the time and placed the coverage with Colorado Casualty.

The University has brought Sutherland and United Insurance Services into the suit as a third party claimant alleging they were “careless, negligent and made various negligent misrepresentations about Perpetual’s insurance coverage from Colorado Casualty.”

The Colorado Casualty suit does not provide any specific details on why the company feels it is not obligated to pay for this claim. Notwithstanding what the Colorado Casualty policy may actually state, the above claim would probably have been covered under most network security and data breach privacy policies currently available.

Lesson learned: It is critical for every agency to inform their client’s about the coverage limitations for any claim arising from a client data and information breach. And, they should offer to provide them with a quote for a Network Security and Data Breach Privacy policy.

Here is an article from the Salt Lake Tribune.

Do you have the proper insurance coverage for the costs of a client information breach?


Cyber Breaks, Insurance & Data Breach Response Advice

Stroz Friedberg is a consulting firm that does computer forensics, mobile phone forensics, electronic discovery and cyber crime response, operating at the intersection of law, technology and behavioral sciences. In this Insurance Journal interview David Garrett, managing director of Stroz Friedberg’s San Francisco office, explains why clients may or may not have cyber risk insurance, whether those that have the insurance actually make a claim in the event of a cyber breach, and simple steps any company can take to reduce the exposure.

You can view the interview by going here: