PRODUCT: Cybersecurity liability endorsement for commercial package
COMPANY: Philadelphia Indemnity Insurance Co.
BEST RATING: A++ (Superior)
AVAILABILITY: Coverage is available through appointed agents and brokers.
FOCUS: Philadelphia Insurance, which has been underwriting standalone cyber liability insurance policies since 2009, expands coverage with a new endorsement for its commercial package policies.
Citing a 2016 Ponemon Institute study, Philadelphia Insurance says the average cost of investigating a data breach and complying with statutory notification requirements is $221 per lost or stolen record. Social engineering and phishing are typical causes of claims, says Evan Fenaroli, cyber product manager for Philadelphia Insurance Companies, who points out that insurance claims “arise less out of issues of technology or a lack of appropriate controls and procedures, but rather out of human error, mistakes or negligence.”
That means it’s not a technology problem. “It’s a people problem,” Fenaroli says, that exposes customers’ or employees’ personally identifiable information—such as such as Social Security numbers, bank account or driver’s license information, and credit and debit card data—or protected health information to breach.
Fenaroli explains that the cybersecurity liability endorsement is a “scaled-down version” of Philadelphia’s standalone cyber policy. It attaches to Philadelphia’s commercial package products, which typically provide property, commercial auto and general liability coverages.
Cyber coverage can overwhelm business owners and risk managers, but Philadelphia’s standalone product offers a full enterprise risk solution with eight coverage parts. The new endorsement, meanwhile, offers three first- and third-party coverages: security event costs, network security and privacy liability coverage, and employee privacy liability.
Compared to the carrier’s standalone cyber policy, the endorsement offers lower limits along with reduced underwriting criteria and lower premiums, Fenaroli says, noting the firm views the endorsement “as a way of expanding our options ensuring that all of our customers have adequate coverage.”
UNDERWRITING: The endorsement covers first-party expenses “an insured incurs in handling a data breach or privacy breach,” Fenaroli explains. That includes costs such as attorney fees, computer forensic experts, notification expenses, regulatory fines and penalties, and public relations services. It also covers third-party claims or lawsuits arising out of data or privacy breach, as well as employee privacy liability—claims or lawsuits from an insured’s employees for a breach of employee data.
Limits, which are combined in aggregate for the three coverage parts, are available from $15,000 up to $5 million. Most policies are capped at $250,000 of coverage. Typically, the aggregate equals the limits for any one of the three coverage parts, but Philadelphia can offer higher aggregate limits to help an insured protect against multiple breaches in a policy period.
MINIMUM PREMIUM: None.
TARGET: Available for entities in numerous classes of business which have less than $100 million in annual revenue. The endorsement can be added to most commercial package policies with GL coverage. Target markets include entertainment and recreation, habitational, health and fitness, nonprofit and human services, outdoor products, professional services, public services, real estate and sports.
COVERAGE TERRITORY: DC and all U.S. states, except AK, LA, NY, MA and VA.
CONTACT: Evan Fenaroli, cyber product manager; Philadelphia Insurance Cos., 1 Bala Plaza, Suite 100, Bala Cynwyd, PA 19004; 610-617-6710.
Ronimarie Acord is an IA contributor.
