Will Cyber Insurance Cover Losses and Costs Related to the Salt Typhoon Campaign?

Reports continue to emerge about a foreign government's campaign to hack U.S. telecom and internet companies. Worse still, the U.S. government reportedly has not been able to remove the hackers from these companies and networks. The hacks, which have been called the Salt Typhoon campaign, have been described as the “worst telecom hack in our nation’s history – by far,” a senior U.S. senator. 

One recommendation has been for users to rely on encryption for messages and calls until the campaign has been eradicated. There have been no predictions about a timeline to end the event.

Beyond encryption, what can companies consider doing to protect against financial losses, costs, and potential liabilities? Looking at cyber insurance policies would be a good start.

Cyber insurance policies can differ from insurance company to insurance company. A strong cyber insurance policy should offer coverage for the following:

1. Costs to investigate the matter: A strong cyber insurance policy should cover the costs of hiring a forensic expert to determine whether the insured has suffered a data privacy event and/or network security failure
2. Costs to terminate and remediate the matter: Again, a strong cyber insurance policy should cover the costs of having a forensics team eliminate the attack and clean and bring systems back online
3. Costs to engage attorneys to advise about privacy and other obligations: A best practice is to run an investigation through counsel who can advise about legal obligations under law, regulation, contract, and common law
4. Coverage for business interruption-related losses: Ideally, a cyber insurance policy includes coverage for lost business income and extra expenses arising out of the data privacy and/or network security event

A best practice is for companies to contact their carriers sooner rather than later. Conscientious insurance adjusters will welcome contact by their insureds so that they can help the insured work to terminate and remediate an event. But companies should be mindful that some insurance carriers have denied coverage – for claims that should be covered – by taking the position that the insured waited too long to give notice.