Slashdot Mirror
Mondelez, the US Food Company That Owns Oreo and Cadbury Brands, Sues Zurich in Test For Cyber Hack Insurance (ft.com)
Mondelez, the US food company that owns the Oreo and Cadbury brands, is suing its insurance company, Zurich, for refusing to pay out on a $100m claim for damage caused by the NotPetya cyber attack. From a report: The case will be the first serious legal dispute over how companies can recover the costs of a cyber attack [Editor's note: the article may be paywalled; alternative source], as insurance groups seek to tightly define their liabilities. "It's a pretty big deal. I've never seen an insurance company take this position," said Robert Stines, a cyber law specialist at the US law firm Freeborn. "It's going to send ripples through the insurance industry. Major companies are going to rethink what's in their policies." The NotPetya attack in the summer of 2017 crippled the computer systems of companies around the world, including Merck, the pharmaceuticals company, Reckitt Benckiser, the consumer group, and Maersk, the world's largest shipping group. It caused billions of dollars of damage and has been blamed by the US and the UK on Russian hackers attacking the Ukrainian government.
[...] According to the Mondelez court documents, Zurich initially worked to adjust the claim in the usual way and at one point even promised to make a $10m interim payment. But it later refused to pay, relying on an exclusion in the policy for "a hostile or warlike action" by a government or sovereign power or people acting for them. Mondelez described Zurich's refusal as "unprecedented" and is seeking $100m in damages. Both companies declined to comment on the case.
[...] According to the Mondelez court documents, Zurich initially worked to adjust the claim in the usual way and at one point even promised to make a $10m interim payment. But it later refused to pay, relying on an exclusion in the policy for "a hostile or warlike action" by a government or sovereign power or people acting for them. Mondelez described Zurich's refusal as "unprecedented" and is seeking $100m in damages. Both companies declined to comment on the case.
If I left my front door open with a sign that said 'come take my stuff' I expect the insurance company would fight me too.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Definitely don't need to know Zurich's position on the matter, thanks for omitting it
Insurance company refusing to pay with some feeble excuse?
Happens all the time, they speculate on being not sued because it would be too much hassle for the customer, or said customer cannot afford a lawyer, or whatever. A bunch of crooks as bad as banks. I have sometimes heard bankers called "banksters", but "insuranksters" would also fit.
C - the footgun of programming languages
I don't know why any insurance company would offer hacking insurance. It is right up there with "terrorism insurance" or giving life insurance to military servicemen in terms of likelihood that you'll get hit with a payout demand.
NotPetya largely used EternalBlue to exploit unpatched Windows computers.
If Mondelez had simply kept reasonably upto date with Windows Updates, the damage would have been highly limited, or possibly non-existent. The fact that they claimed damages of $100M means that countless computers were not upto allowing the malware to infect them over their network.
I hope Zurich wins, because in the same way that insurance companies are not expected to pay out for accidents as a result of a clearly unroadworthy automobile, insurance companies should not be expected to pay out for damages due to grossly negligent IT practices.
Here we are in the 21st century and companies are still clearly confused on how expensive using IT really is. They cheap out and then act surprised when there is a hack.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
If I left my front door open with a sign that said 'come take my stuff' I expect the insurance company would fight me too.
Nice strawman you have there.
That's not what happened and you know it. The question will (should?) come down to whether reasonable duty of care was exercised on the part of the plaintiff and whether the insurance contract was violated by failure of the plaintiff to take reasonably expected security measures and to implement them with reasonable competence. All modern systems have security holes so perfection is not a reasonable expectation.
I don't know why any insurance company would offer hacking insurance.
You can insure anything profitably provided you can charge adequately high premiums. To do that you need to have data about the likelihood of an incident and the financial burden that will result.
It is right up there with "terrorism insurance" or giving life insurance to military servicemen in terms of likelihood that you'll get hit with a payout demand.
Evidently you aren't an actuary. Have you actually looked at the risk tables for those activities? The insurance companies have. Yes military service is a dangerous job but you can be assured that fact is priced into the premiums they pay. Insurance companies aren't staffed by idiots and unlike you they actually do the math to figure out the risk/reward for writing a policy. Expected payouts are priced into the model.
Many comments didn't seem to pick up why Zurich is refusing:
Zurich asserts the attack was done by some foreign government in a hostile or warlike manner, which is excluded from coverage.
The prime suspect in this case would be Russia.
It's very common to exclude damages from war in insurance contracts. With foreign nations doing state sanctioned or organised hacking, this becomes very favourable for Zurich. They basically say, we cover only damage from script kiddies, not from foreign secret services waging a cyberwar against the USA.
Whether Mondelez' are incapable buffoons or they left their doors open with a writte invitiation to plunder them isn't really what this is all about.
Like antivirus, most of the time it's a checkbox required for some kind of compliance. My last company has insurance like this because it was the only way we could get contracts with large companies. No insurance = no sale.
When contracts come up for renewal, insurance company liability will be spelled out and priced in.
Company seeking renewal: What's this clause about not covering cyber events?
Insurance agent: On that's standard now. However, if you want coverage, we'll be glad to sell you a rider, for $MUCHMORETHANYOUPLANNEDFOR.
Company seeking renewal, after shopping around and finding all financially-sound insurance companies are either not covering cyber events or charging a lot to cover them: Um.....
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The recent news blaming a 20 yo in his parents' bedroom for the hack of sensitive data about German politicians which was originally blamed on 'state actors' has confused the situation a great deal.
https://www.theguardian.com/wo...
It also reminds us that at least some states aren't bothering to defend themselves properly.
I was just wondering how you can file a claim regarding a hack which almost definitely was due to having piss poor security.
I have worked with national banks who whine about being hacked when they pretty much just leave the door open.
Rule 1) Cisco, Checkpoint, Pali Alto; etc:.. they do not sell security solutions. They sell overpriced door locks that keep the honest people honest.
Rule 2) If your company actually got hacked or suffered losses due to a hack, it almost certainly is because you spend too much money on security experts and not nearly enough on security.
Hold the vendor accountable. Sue Oracle for your Solaris distribution being bugged and flawed. Sue Cisco for their iOS having security holes. Sue Microsoft and VMware. Why we donâ(TM)t because we sold out years back and installed Linux in our datacenters and now the only people held accountable are ourselves. Nicely done!
"All modern systems have security holes" and they shouldn't. It's that simple. If that doubles the cost of software then so be it.
"Double the cost"? HAHAHAHAHAHA... Oh wait, you were serious? Even if it were possible to get perfect security with no holes (it isn't and never will be) it would cost FAR more than double to get even close. The cost of security isn't some linear function. And if you increase the cost too much then the computer system becomes too costly to justify in the first place.
You can argue they didn't do enough to rise to a reasonable duty of care. It is completely ridiculous to argue that perfect security is even possible much less expected.
WONDERFUL! Two times zero is still zero (you're using open-source freeware, right?)
Accountant here. Just because the software doesn't have a license cost doesn't mean it is free (as in beer) to use. Still got to pay IT their salaries to install, support, train, and administer. I assure you they get justifiably cranky if you don't send them a paycheck regularly.
I've never liked Oreo cookies.
“.. the ability of the developers within a given enterprise to use and rely on open source at scale is dependent on its acceptance by that enterprise’s legal department .. The end result is the policies which countless developers operate under today which specify which licenses are approved and which are not.” RedMonk
“The debate over whether the war exclusion could have applied to NotPetya demonstrates that if insurers are going to continue including the war exclusion on cyber insurance policies, the wording should be reformed to make clear the circumstances required to trigger it. Absent that clarification, insurers and insurance buyers must default to the Law of Armed Conflict, including rulings that might be more than a century old, to discern between the categories of criminal activity and warlike actions. As for the latter, all precedent indicates that NotPetya simply didn’t reach that level.” link
"Anytime a company has hack insurance, that tells me their management doesn't trust the I.T. staff ..."
Sounds right in this case:
https://www.itpro.co.uk/securi...
"Instead of a war exclusion clause, Zurich should have invoked a gross negligence clause, which is much easier to prove in this case than attribution to a nation-state, particularly considering Mondelez was hit twice by the same ransomware," he said. The "fool me once" proverb is fully applicable here: while many companies fall victims to ransomware, one of the first steps to recovery is to make sure it doesn't happen again."