Increasing Risk Severity

The Internet has fundamentally changed the liability landscape in that the Internet is both global and borderless. The laws and regulations that govern this medium are not as established or they vary significantly around the world, unlike the technology that underlies it or the various business plans upon which it is being built. Even the question of venue of a cyber-related lawsuit is not clear cut and jurisdiction for such cases are not necessarily in the country, state, or province of the defendant’s operations or presence

A key point to note is that cyber liability exposure is increasing significantly in risk severity as a result of the evolving threats and the legal and regulatory environment. The key factors are:

• Identity theft is a business and heavily involves organized crime around the world.
• Constant evolution of threats and attacks, such as tricking individuals into disclosing personal information (phishing and pharming).
• Impact of vicarious liability resulting from increased outsourcing and off-shoring.
• Growing body of law concerning security and privacy;
  • Regulatory (particularly the U.S. Federal Trade Commission) enforcement actions for breaches of privacy and security as identity theft continues to grow.
  • Significant U.S. class action activity caused by the passage in 41+ states of requirements to notify customers of potential security breaches involving personally identifiable non-public information.
  • Plaintiffs can be employees and/or third parties. The costs of notification and mitigation can be in the millions of dollars.
• Derivative shareholder actions have been filed if the security breach impacts a large number of people with a significant financial exposure and negative brand implications.

Credit card associations are regulating security practices surrounding credit card information and have requirements for notice and ability to fine, among other things. Issuing banks are willing to sue the merchant or processor who caused the security breach to recover their costs to close compromised credit card accounts and reopen them.