Slashdot Mirror
Mondelez, the US Food Company That Owns Oreo and Cadbury Brands, Sues Zurich in Test For Cyber Hack Insurance (ft.com)
Mondelez, the US food company that owns the Oreo and Cadbury brands, is suing its insurance company, Zurich, for refusing to pay out on a $100m claim for damage caused by the NotPetya cyber attack. From a report: The case will be the first serious legal dispute over how companies can recover the costs of a cyber attack [Editor's note: the article may be paywalled; alternative source], as insurance groups seek to tightly define their liabilities. "It's a pretty big deal. I've never seen an insurance company take this position," said Robert Stines, a cyber law specialist at the US law firm Freeborn. "It's going to send ripples through the insurance industry. Major companies are going to rethink what's in their policies." The NotPetya attack in the summer of 2017 crippled the computer systems of companies around the world, including Merck, the pharmaceuticals company, Reckitt Benckiser, the consumer group, and Maersk, the world's largest shipping group. It caused billions of dollars of damage and has been blamed by the US and the UK on Russian hackers attacking the Ukrainian government.
[...] According to the Mondelez court documents, Zurich initially worked to adjust the claim in the usual way and at one point even promised to make a $10m interim payment. But it later refused to pay, relying on an exclusion in the policy for "a hostile or warlike action" by a government or sovereign power or people acting for them. Mondelez described Zurich's refusal as "unprecedented" and is seeking $100m in damages. Both companies declined to comment on the case.
[...] According to the Mondelez court documents, Zurich initially worked to adjust the claim in the usual way and at one point even promised to make a $10m interim payment. But it later refused to pay, relying on an exclusion in the policy for "a hostile or warlike action" by a government or sovereign power or people acting for them. Mondelez described Zurich's refusal as "unprecedented" and is seeking $100m in damages. Both companies declined to comment on the case.
If I left my front door open with a sign that said 'come take my stuff' I expect the insurance company would fight me too.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Definitely don't need to know Zurich's position on the matter, thanks for omitting it
Insurance company refusing to pay with some feeble excuse?
Happens all the time, they speculate on being not sued because it would be too much hassle for the customer, or said customer cannot afford a lawyer, or whatever. A bunch of crooks as bad as banks. I have sometimes heard bankers called "banksters", but "insuranksters" would also fit.
C - the footgun of programming languages
I don't know why any insurance company would offer hacking insurance. It is right up there with "terrorism insurance" or giving life insurance to military servicemen in terms of likelihood that you'll get hit with a payout demand.
As a IT professional with over 30 years experience, specializing in Computer Forensics and penetration testing (Whit Hat hacking), I can say with complete honesty and knowledge that I would never pay for hack insurance, nor should anyplace that has an I.T. shop. You have experts in your shop so get out of their way and let them do their stuff.
Anytime a company has hack insurance, that tells me their management doesn't trust the I.T. staff or tries to micro manage everything or they have no clue what they are doing. If I were a black hat hacker, that's the first companies I would go after.
Thos of us with lots of experience don't even use anti-virus because we know what we are doing and how to avoid things like that.
NotPetya largely used EternalBlue to exploit unpatched Windows computers.
If Mondelez had simply kept reasonably upto date with Windows Updates, the damage would have been highly limited, or possibly non-existent. The fact that they claimed damages of $100M means that countless computers were not upto allowing the malware to infect them over their network.
I hope Zurich wins, because in the same way that insurance companies are not expected to pay out for accidents as a result of a clearly unroadworthy automobile, insurance companies should not be expected to pay out for damages due to grossly negligent IT practices.
it's not rocket science.
If you must be connected to the net, use more than one firewall. All outside webbrowsing should be forced through a proxy.
It's simple to shore things up. Insurance Companies suck . Lawyers Suck. Black Hat Extortionists Suck.
It should be legal for anyone to get even with them...
Here we are in the 21st century and companies are still clearly confused on how expensive using IT really is. They cheap out and then act surprised when there is a hack.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
If I left my front door open with a sign that said 'come take my stuff' I expect the insurance company would fight me too.
Nice strawman you have there.
That's not what happened and you know it. The question will (should?) come down to whether reasonable duty of care was exercised on the part of the plaintiff and whether the insurance contract was violated by failure of the plaintiff to take reasonably expected security measures and to implement them with reasonable competence. All modern systems have security holes so perfection is not a reasonable expectation.
That you have to sue someone to get any reasonable claims which is pretty much what you would have to do if you didn't have insurance. The catch is without insurance at least you can put your premium money towards a good attorney.
I don't know why any insurance company would offer hacking insurance.
You can insure anything profitably provided you can charge adequately high premiums. To do that you need to have data about the likelihood of an incident and the financial burden that will result.
It is right up there with "terrorism insurance" or giving life insurance to military servicemen in terms of likelihood that you'll get hit with a payout demand.
Evidently you aren't an actuary. Have you actually looked at the risk tables for those activities? The insurance companies have. Yes military service is a dangerous job but you can be assured that fact is priced into the premiums they pay. Insurance companies aren't staffed by idiots and unlike you they actually do the math to figure out the risk/reward for writing a policy. Expected payouts are priced into the model.
Many comments didn't seem to pick up why Zurich is refusing:
Zurich asserts the attack was done by some foreign government in a hostile or warlike manner, which is excluded from coverage.
The prime suspect in this case would be Russia.
It's very common to exclude damages from war in insurance contracts. With foreign nations doing state sanctioned or organised hacking, this becomes very favourable for Zurich. They basically say, we cover only damage from script kiddies, not from foreign secret services waging a cyberwar against the USA.
Whether Mondelez' are incapable buffoons or they left their doors open with a writte invitiation to plunder them isn't really what this is all about.
When contracts come up for renewal, insurance company liability will be spelled out and priced in.
Company seeking renewal: What's this clause about not covering cyber events?
Insurance agent: On that's standard now. However, if you want coverage, we'll be glad to sell you a rider, for $MUCHMORETHANYOUPLANNEDFOR.
Company seeking renewal, after shopping around and finding all financially-sound insurance companies are either not covering cyber events or charging a lot to cover them: Um.....
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The recent news blaming a 20 yo in his parents' bedroom for the hack of sensitive data about German politicians which was originally blamed on 'state actors' has confused the situation a great deal.
https://www.theguardian.com/wo...
It also reminds us that at least some states aren't bothering to defend themselves properly.
I was just wondering how you can file a claim regarding a hack which almost definitely was due to having piss poor security.
I have worked with national banks who whine about being hacked when they pretty much just leave the door open.
Rule 1) Cisco, Checkpoint, Pali Alto; etc:.. they do not sell security solutions. They sell overpriced door locks that keep the honest people honest.
Rule 2) If your company actually got hacked or suffered losses due to a hack, it almost certainly is because you spend too much money on security experts and not nearly enough on security.
Hold the vendor accountable. Sue Oracle for your Solaris distribution being bugged and flawed. Sue Cisco for their iOS having security holes. Sue Microsoft and VMware. Why we donâ(TM)t because we sold out years back and installed Linux in our datacenters and now the only people held accountable are ourselves. Nicely done!
It was cyber hackers! With cyber hacks! Cyber hacking!
As if that ment anything. It doesn't, but then that's not important. Dropping scarewords a lot, is important to these reporters.
"All modern systems have security holes" and they shouldn't. It's that simple. If that doubles the cost of software then so be it.
"Double the cost"? HAHAHAHAHAHA... Oh wait, you were serious? Even if it were possible to get perfect security with no holes (it isn't and never will be) it would cost FAR more than double to get even close. The cost of security isn't some linear function. And if you increase the cost too much then the computer system becomes too costly to justify in the first place.
You can argue they didn't do enough to rise to a reasonable duty of care. It is completely ridiculous to argue that perfect security is even possible much less expected.
WONDERFUL! Two times zero is still zero (you're using open-source freeware, right?)
Accountant here. Just because the software doesn't have a license cost doesn't mean it is free (as in beer) to use. Still got to pay IT their salaries to install, support, train, and administer. I assure you they get justifiably cranky if you don't send them a paycheck regularly.
I've never liked Oreo cookies.
“.. the ability of the developers within a given enterprise to use and rely on open source at scale is dependent on its acceptance by that enterprise’s legal department .. The end result is the policies which countless developers operate under today which specify which licenses are approved and which are not.” RedMonk
“The debate over whether the war exclusion could have applied to NotPetya demonstrates that if insurers are going to continue including the war exclusion on cyber insurance policies, the wording should be reformed to make clear the circumstances required to trigger it. Absent that clarification, insurers and insurance buyers must default to the Law of Armed Conflict, including rulings that might be more than a century old, to discern between the categories of criminal activity and warlike actions. As for the latter, all precedent indicates that NotPetya simply didn’t reach that level.” link