The number of cyber attacks and data breaches has increased significantly in recent years, and public entities are not exempt. These “cyber events” include the theft or release of personally identifiable information such as Social Security numbers from a computer system, the transmission of malware from a computer to a third party or a “denial of service” attack that results in the inability to use computers or websites.

These incidents can have a considerable financial impact on a public entity, including the cost of lawsuits, crisis management and notification of the affected parties. They can also lead to a public relations nightmare.

But despite these facts, some public entities continue to believe they are not truly susceptible to a cyber event. Why?

Read related: “Corporate Identity Theft.”

Here are some of the more common misconceptions held by public entities concerning  their vulnerability:

1. “Public entities are not a target for cyber attacks.” Actually, public entities are a perfect target for cyber attacks considering the amount of confidential information in their possession. There is probably no other type of organization, other than a bank or financial institution, that stores more personally identifiable information. It’s not uncommon for a public entity to have an individual’s Social Security number, income statements, bank account numbers, driver’s license number and even credit card information. In addition, public entities typically have confidential personal medical and health information for all of their employees. 
2. “We have the latest technology and software available to protect our electronic information and systems.” The growing number of cyber attacks (more than 500 million records breached since 2005) at both large and small organizations–even those with the most sophisticated software protection–demonstrates that no organization can be sure they are not susceptible. One of the most common causes of privacy information breaches today is not hacking, but human error. When confidential information is stored outside the network system on laptops, smartphones or other electric storage devices, it can be compromised when the device is lost or stolen.     
3. “Even if our network is breached, we are covered under our general liability or other insurance policies.” General liability insurance commonly provides coverage for “bodily injury” and “property damage.”  Property damage typically means physical injury to tangible property, including the resulting loss of use of that property. However, electronic data is not tangible property and is not covered. In addition, property insurance, crime insurance and professional errors and omissions insurance do not typically provide coverage for cyber liability and notification requirement expenses. 

Read related: “FBI Says Cyber Risk to Surpass Terror Risk.”

4. “Cyber liability notification requirements only apply to commercial businesses.” Currently, in addition to federal regulations, more than 45 states have enacted legislation to protect consumer privacy. These state and federal requirements apply to for-profit and not-for-profit organizations, including public entities. Both state and federal agencies may investigate and take action against any organization that is negligent in the handling of confidential personal information.   

5. “If we had a data breach, we could handle the notification requirements ourselves.” Most public entities would have difficulty complying with state and federal notification requirements in the event of a data breach. It is also common for goodwill purposes to provide credit monitoring services and identity theft education and assistance for the affected party. Most public entities would not have the expertise and staff to provide these types of additional goodwill services for the affected party.

So how can public entities protect themselves?

First, assess the exposure. Start with a comprehensive review of the public entity’s entire computer system and safeguards, with an internal review by a dedicated individual or team, or by an independent firm specializing in computer system security evaluation. In either case, every aspect of the computer system should be analyzed to determine any weaknesses or areas of susceptibility that need to be addressed.

Once the evaluation is complete, all improvements to secure the computer system should be undertaken as soon as possible. This may include improvements and formalization of internal safety procedures, as well as the purchase of new or additional hardware and/or software to safeguard the computer system and integrity of the confidential information. 

Second, every public entity should consider pubchasing crisis management/notification expense coverage and cyber liability coverage. For first-party crisis management/notification expense coverage, the product and services available vary from carrier to carrier, but coverage for a public entity should include:

Read related: “10 Tips When Considering Cyber Insurance.”

• A computer forensic analysis to determine the cause and extent of the privacy breach
• A crisis management review and advice from an approved independent crisis management or legal firm
• Expenses associated with notifying affected parties to maintain goodwill or comply with any notification requirements imposed by law
• Call center services for credit monitoring as well as identity theft education and assistance for affected individuals.

Third-party cyber liability coverage is typically provided to protect the public entity for the following:

• Liability arising out of the unauthorized access of confidential information from the public entity’s computer system or the accidental release of confidential information from its computer system
• Liability arising out of the transmission of malware from the public entity’s computer system to a third party.  

This combination of crisis management and cyber liability coverage can help protect a public entity’s image and assets in the event of a cyber attack.

Willis Chairman and CEO Joseph Plumeri during a 2009 news conference (AP Photo/Charles Rex Arbogast)

NU Online News Service, April 12, 2:35 p.m. EST

With rates rising in many commercial-insurance lines—although not uniformly across all lines—risk managers may have to deliver unpleasant news at budget time, but they should stress the value of the products, rather than just the cost, Willis’ chief executive says.

In an introduction to Willis’ latest “Market Realities” report, Chairman and Chief Executive Officer Joseph Plumeri writes, “The role of the insurer is to make sure they survive the storms so that when their clients need them, they will be here. What insurers offer…is their own resilience.”

Plumeri adds, “We suggest that risk managers and others in charge of risk mitigation and risk transfer may benefit by taking a similar view of your own work. That, ultimately, is your job as well: ensuring resilience.”

He says that, as rates rise, risk managers should keep in mind that they have been paying less in recent years for protection, resilience “and the freedom from risk that allows you to take chances and achieve what you and your stakeholders most want to achieve.”

As for the insurance market, Plumeri says in his introduction that insurers are showing little inclination toward uniform firming seen in previous hard-market patterns. As such, he notes that while those who do not learn from history may be condemned to repeat it, “those who expect the same patterns to continue forever may be severely disappointed.”

Regarding specific lines, Willis says that in the 2011 fourth quarter, catastrophe-exposed property rates rose by an average of between 5 percent and 10 percent. 

A recent study of 2012 first-quarter property rates conducted by broker Marsh says global property rates, including in the U.S., were on the rise for both cat-exposed and non-cat-exposed properties. 

Willis’ study, though, predicts flat rates for non-cat-exposed property risks in the first quarter, and increases of between 7.5 percent and 12.5 percent for cat-exposed risks.  

Willis says that although property rates are rising in 2012, “abundant capacity and the continuing weak economy have tempered the upward pressure.” 

For the casualty market, Willis says more than 75 percent of insureds are seeing modest rate increases on renewal. Additionally, Willis says underwriters are showing less flexibility on coverage. “Gradual increases in revenues and rating exposures are putting upward pressure on premiums,” the broker says. 

Willis says it expects rates to range from flat to increases of 7.5 percent.

In workers’ compensation, Willis says about 90 percent of insureds are seeing rate increases on renewal, particularly in California and the Northeast. But Willis notes that “healthy market competition” is still creating positive premium results for many buyers. The brokerage expects rates to range from up by 2.5 percent to up by 7.5 percent.

In the commercial auto space, Willis says about 80 percent of insureds are experiencing rate increases, driven by severe losses in auto liability. “Accurate reporting of fleet by type of vehicle, good loss experience and ongoing loss control are critical to favorable renewal efforts,” Willis says. Rates are expected to range from flat to up by 10 percent.

For directors and officers coverage, Willis says price decreases are becoming less common for public-company coverages. Willis expects rates to range from down 5 percent to up 5 percent going forward. Public companies are expected to see rates range from down 5 percent to up 10 percent, while private companies can expect rates to range from flat to up by 5 percent.

How to protect personal data on devices you plan to sell

NU Online News Service, March 27, 10:39 a.m. EDT

An analysis of 2011 direct-written premiums and direct-loss ratios for property and casualty insurance makes the case for continued rate increases in the coming year, a financial analyst says.

In an analyst’s note comparing the statutory results for 2011 against 2010, Meyer Shields, a financial analyst for Stifel Nicolaus, says the direct-written premium results and direct-loss ratio results indicate both personal lines and commercial lines have reason to see increases in 2012.

For personal lines, the report says private passenger automobile-rate increases will “reaccelerate” after slowing slightly during second half of 2011.

Direct-written premium rose 1.3 percent to close to $168 billion in 2011 compared to 2010. Shields says the industry posted a direct-loss ratio of 67.5 for 2011, up 2.7 points from 2010.

He notes that market-leader StateFarm produced a combined ratio that is estimated at around 113, and released close to $1.07 billion in prior-year loss reserves.

These indicators, he says, point to rate increases in 2012.

For homeowners insurance, direct-written premium rose 3.5 percent to more than $71.6 billion for the year. The increase indicates “that rate increases—stemming from recent years’ unexpectedly high weather-related losses—are gaining traction.” Storm losses accounted for a 14.8 point increase in the direct-loss ratio to 75.8 “likely motivating continued rate increases in 2012,” according to Shields.

Finally, covering commercial lines, the industry saw its direct-loss ratio rise 8.4 points to 60, but weather-related losses do not fully explain loss deterioration for the year since losses came in areas not affected by weather, says Shields. The report suggests that the decline in the direct-loss ratio is further evidence of inadequate pricing, underscoring the need for rate increases in 2012.

Direct-written premium growth, which grew more than 5 percent in the fourth quarter and the year compared to 2010, was attributed to a combination of “economic stabilization and, increasingly, rising insurance rates.”

The report says, “We see inadequate profits—seen in the rising direct-loss ratios—as the primary catalyst for 2012 rate increases.”

Former Penn State defensive coordinator Jerry Sandusky at at the Alamo Bowl in 1999. (AP Photo/Eric Gay)

NU Online News Service, March 23, 11:58 a.m. EST

Penn State is telling subpoenaed employees to hire their own attorneys, which may be paid for by the university’s directors and officers’ insurance coverage.

The university, under the microscope since former assistant football coach Jerry Sandusky was charged with 52 counts of child sex abuse, received a subpoena in February from the U.S. attorney’s office in Pennsylvania.

This month, the state Attorney General served additional subpoenas to an unspecified number of Penn State employees, according to the university, whose general counsel says will remain anonymous unless they reveal themselves.

On its “Openness” website the State College, Pa.-based university this week released the following statement about the payment of legal fees for employees: “The university is suggesting those individuals who received subpoenas retain their own counsel and the university will agree to reimburse them for their legal expenses, as they were acting within the scope of their employment and in the interest of the university.”

“Expenses of such counsel may be paid by the university’s D&O insurance carrier.”

Penn State and its primary general liability insurer, Pennsylvania Manufacturer’s Associations Insurance Co. (PMA), have filed lawsuits against each other over legal expenses.

Penn State says its policy with PMA entitles the school to a legal defense of a civil lawsuit filed against the university regarding the allegations against Sandusky.

PMA says it has no duty to defend the university.

NU has learned Penn State is also a policyholder of United Educators, but the insurer could not comment further.

A civil suit would be filed after the criminal case against Sandusky is settled. Penn State is not immune from civil suit because it is not a state-owned school, or member of the Pennsylvania State System of Higher Education (PASSHE).

Membership here may have provided a measure of immunity under the Sovereign Immunity Act, which as a general rule, says a state entity is immune from suit.

As of Jan. 31, Penn State has spent more than $813,000 on university legal services and defense, according to its website. The university says an additional $338,545 has been spent on the legal defense of Graham Spanier, Tim Curley and Gary Schultz.

Penn State says Spanier resigned as its president last November.

Curley, the school’s athletic director, faces perjury charges related to the Sandusky case. He has been suspended.

Schultz, former Penn State vice president, also faces perjury charges.

Penn State says its bylaws state every trustee and officer of the university is entitled to be indemnified by the university for legal fees, as well as judgments, settlement amounts, fines and penalties related to actual or threatened lawsuits or investigations.  

Like what you see? Click here to sign up for Insurance Newscast daily newsletter to get the latest on insurance industry news and related information.