American Oil and Gas Reporter - December 2017 - 80

SpecialReport: Insurance Update
policies. For example, a 2011 cyber attack
stole confidential exploration and bidding
data from several major oil companies.
The coordinated attack, which had been
secretly targeting energy companies for
as many as four years, utilized both traditional methods of exploiting software vulnerabilities in computer operating systems
and "social engineering" techniques such
as spear-phishing. Security and privacy
losses tied to social engineering are particularly crucial components of cyber risk
mitigation, given that they may not be
covered by traditional insurance policies.
Third-Party Cyber Coverage
As its name suggests, third-party cyber
insurance protects policyholders from liabilities to third parties harmed by cyber
attacks, and may cover civil penalties
and other costs imposed by regulators or
government agencies. Covered costs under
such policies can include defense costs,
judgments, and settlement payments, as
well as certain fines and penalties. However, third-party cyber liability policies
do not automatically provide full coverage
for all possible claim scenarios involving
a cyber liability, such as situations where
a hacking incident causes bodily injury,
property damage, business interruption
or other physical losses.
Many businesses have redoubled efforts
to protect their most important digital
assets, intellectual property and critical
infrastructure in light of recent cyber attacks targeting so-called "crown jewels."
But more traditional consumer-facing aspects of many oil and gas operations still
are being targeted by hackers.
For example, an international oil company learned that an employee of a vendor
had utilized employees' personal information to facilitate an unemployment insurance claim scam in Texas, underscoring
the importance of protecting information
in all aspects of a company's operations,
however routine. In 2014, that same company reportedly had personal information
of approximately 7,000 customers in New
Zealand and Australia stolen by online
hackers. Loss arising from data breach
claims may result in both first-party (e.g.,
recovering stolen data) and third-party
(e.g., data privacy lawsuit) losses.
Crime Coverage
Crime insurance protects policyholders
from dishonest acts of third parties, including employee theft, forgery and alteration, computer fraud and funds transfer
80 THE AMERICAN OIL & GAS REPORTER

fraud, ransom and extortion, robbery, and
counterfeiting. While not a traditional
"cyber" coverage, crime insurance has
become critical to any comprehensive
cyber insurance program because it can
protect against financial loss caused by
social engineering threats.
As oil and gas companies continue to
increase the strength and resilience of
their computer systems, many hackers
simply choose to target the one entry
point that cannot be protected with software updates: employees. Last February,
the cause of an attempted spyware infection at a Middle Eastern company was
one employee opening an infected spreadsheet, which he had received from an
elaborate but fraudulent online "person"
with whom the employee had been communicating for more than a month. Using
this persona, criminals had cultivated
social media connections with numerous
mid-level technicians, software developers,
and administrators at oil and gas, technology, and consulting companies.
Traditional liability policies may present significant coverage gaps that do not
apply to cyber-related losses, in part because cyber threats are a relatively new
phenomenon from an insurance perspective. As a result, court rulings are inconsistent about whether cyber losses are
covered under general liability policies,
differing over whether traditional terms
such as "publication" and "tangible property" apply to electronic theft or compromise of digital information.
For that reason, policyholders should
not assume that their legacy insurance
policies are adequate to protect against
claims involving cyber attacks. Furthermore,
many traditional policies now contain express exclusions for cyber-related losses.
That said, legacy policies still can
play an important role in certain cyber
claim scenarios. The inherent risk of
physical loss resulting from a cyber event
underscores the importance of minimizing
coverage gaps between traditional and
cyber insurance policies, such as where
third-party cyber liability policies contain
bodily injury and property damage exclusions. For that reason, in the event of
a loss involving a cyber event, it is
essential that the policyholder examine
potential coverage under both traditional
and cyber insurance coverage.
Common Coverage Issues
Both legacy policies (general liability,
excess liability, pollution liability and

property) and cyber-specific insurance
products may not provide adequate coverage for all risks that arise from a cyber
event. There are some challenging exclusions and other limitations to evaluate
when assessing coverage for cyber risks.
The first is environmental liability.
Liability policies of all kinds may include
various forms of "pollution" exclusions,
which bar coverage for loss arising from
the discharge or release of pollutants.
Cyber attacks on oil and gas companies
frequently pose a risk of environmental
liability, but cyber insurance policies may
limit or bar coverage entirely for claims
involving the release of pollutants. Even
where companies purchase pollution-specific coverage, the definition of a pollutant
may not adequately cover liability arising
from cyber attack-related releases.
As noted, many cyber insurance policies
also exclude coverage for claims involving
bodily injury, property damage or other
physical loss, even where such loss is
caused by a cyber event. The industry
faces significant exposures for physical
loss following hacks of drilling platforms,
pipelines, storage tanks and other equipment. Policyholders should maintain coverage for physical losses through environmental and traditional general liability
insurance to minimize coverage gaps.
Liability policies also commonly include broadly worded exclusions barring
coverage for any loss arising from "war"
or "terrorism." Many cyber attacks may
have direct or indirect ties to terrorism.
This is particularly true in the oil and gas
sector, where certain industry participants
are state-sponsored and often targeted by
extremists. Companies should attempt to
exempt cyber terrorism from these exclusions through negotiations with their
insurers at the time of program renewal.
Another common exclusion is "liability
assumed by contract," which bars coverage
for fees, indemnification or other costs
that the policyholder is obligated to pay
due to a contract. One federal district
court case rejected a policyholder's attempt
to recover fees paid following a 2013
breach in which hackers obtained and
posted on the Internet 60,000 credit card
numbers belonging to the policyholder's
customers. The court held that the fees,
which were imposed by the bank under
its servicing agreement with the policyholder, were excludable under the policy's
contractual liability exclusion. The court
reached this conclusion notwithstanding
evidence that the policyholder had ex-

American Oil and Gas Reporter - December 2017

Table of Contents for the Digital Edition of American Oil and Gas Reporter - December 2017