how a attorney defends a client insurance claim of a cybersecurity claim

by Prof. Jaylan Wilderman 7 min read

After a cyber incident, insurance defense involves a combination of class-action lawsuit handling, management of regulatory fines and penalties, minimizing reputational damage and limiting income loss. Carriers have approved lists of defense attorneys; however, they will sometimes allow off-panel defense attorneys as well.

Full Answer

Who is the defense counsel in an insurance case?

Feb 25, 2021 · Claims of bad faith present unique challenges for insurers (and their counsel) with respect to attorney-client privilege: if the insurer’s state of mind is …

Does attorney-client privilege exist in the claims adjustment process?

Feb 25, 2021 · This attorney-client privilege issue has recently spread to a new battleground, and one which is common practice for insurance counsel: authoring denial letters. To address waiver under these circumstances, some courts have continued the majority rationale by reinforcing the distinction between the attorney’s legal advice and the insurer’s ...

What is the Attorney's duty of confidentiality to the insured?

An Insurance Defense Attorney's Dual Client Problem. What has been called the "eternal triangle" in insurance defense practice is more aptly termed the "eternal conundrum." Under certain circumstances, an insurer is obligated under a liability insurance policy to designate and compensate an attorney for defense of its insured. Unless otherwise ...

Can an insurer's lawyer continue to represent the insured?

May 16, 2016 · The key question before the Washington Supreme Court was whether Farmers could redact (delete or withhold) information under the attorney-client and work-product privileges. The Cedell Court created a presumption that no attorney-client privilege exists in the claims adjustment process where the insured raises a first-party bad faith claim. Put ...

What is duty to defend on an insurance policy?

The “duty to defend” means that, when you timely report a potentially covered claim against you: The insurer must appoint and pay for defense counsel to defend you against the claim, unless you select your own counsel.Dec 31, 2020

Is Cyber Liability a claims made policy?

Cyber policies are virtually always written on a claims-made basis, and they often include a threshold requirement of the existence of a breach (or reasonably suspected breach) that is first discovered during the policy period.

Is cyber insurance claims made or occurrence?

Like D&O and other professional liability policies, cyber policies are written on a claims made and reported basis. The events that trigger coverage must take place and be reported to the cyber insurer during the same one year period that the policy is in effect.May 31, 2016

Does cyber insurance cover negligence?

Generally speaking, Cyber Insurance policies do NOT cover: Negligence: When it comes to cyber risk, ignorance isn't bliss—it's negligence.Jan 7, 2021

Does an insurance company waive attorney-client privilege?

By contrast, some courts have held that under certain circumstances, the insurer waives its attorney-client privilege by relying on legal advice—even without actually invoking the “advice of counsel” defense. The Supreme Court of Arizona summarized the underlying rationale as follows:

Does an insurer waive counsel?

In cases involving claims of bad faith, courts are relatively clear that an insurer waives its attorney-client privilege when it expressly invokes the “advice of counsel” defense, which generally provides that “when an insurer’s actions are in conformity with advice given to it by counsel, the insurer’s actions are taken in good faith, and thus the essential element that an aggrieved insured must demonstrate in establishing insurer bad faith is nullified.” [1] However, courts are less united on whether a waiver occurs when the insurer receives advice from its attorney when making its coverage decision, but does not expressly assert the “advice of counsel” defense .

Is an adjuster an attorney?

The adjuster was not an attorney, and therefore sought advice from the insurer’s in-house counsel, who then penned a letter (in the adjuster’s name) that reaffirmed why—under the policy and Mississippi statutes—coverage was not required. [12] . Ultimately, the insured asserted claims against the insurer for bad faith, ...

What happens if an attorney hires a vendor for cyber incident response?

Most attorneys or forensics providers today would say that if the attorney hires a vendor for cyber incident response, everything produced would fall under attorney-client privilege. The way courts are interpreting privilege, however, may be a major disruption to that line of thinking. Until there is more case law, ...

Why didn't Experian have to produce investigation documents for a data breach?

For example, a 2017 Experian case demonstrated that Experian didn’t have to produce investigation documents for a data breach because the report was ordered and prepared for their law firm as it geared up for litigation.

How is privilege established after a cyber event?

After a cyber event occurs and you notify the insurer, the first resource you’ll be directed to is your approved attorney. This is important because when you follow the right protocols, the attorney will hire all of the necessary vendor resources on your behalf.

When did Capital One disclose its forensic analysis?

In late May of 2020, a Virginia federal court ordered Capital One to disclose its forensic analysis related to a massive data breach in 2019. The court rejected the argument that the report was protected under attorney-client privilege.

Is vendor work protected under attorney-client privilege?

Traditionally, because it is the attorney who hires those vendors, not you, all vendor work products are protected under attorney-client privilege. This includes things like reports from forensics providers who evaluate how the hackers got in, if the attacks are ongoing, and other important details that companies may not want exposed. ...

Is incident report public domain?

And when faced with a data breach, they want to know that things like incident reports are not public domain. But did you know that the way you handle a cyber event can either protect sensitive data under attorney-client privilege or leave it open ...

Can forensics firms guarantee availability?

Many forensics firms are not in a position to guarantee their availability at the time of an event . In a widespread security event, such as a particularly damaging new malware strain, some security firms may be so swamped with requests for work that they simply can’t get to everyone in a short amount of time.

What should an attorney do?

1 In addition, Rule 7.2 prohibits an attorney from assisting the client in conduct the attorney knows to be fraudulent.

What is the eternal triangle?

What has been called the "eternal triangle" in insurance defense practice is more aptly termed the "eternal conundrum." Under certain circumstances, an insurer is obligated under a liability insurance policy to designate and compensate an attorney for defense of its insured. Unless otherwise specified by contract or agreement, a North Carolina insurance defense attorney has two clients, the insured and the insurer. To avoid any favoritism possibly engendered by the insurer's long term relationship with the attorney or by the insurer paying the attorney's bills, the insured is deemed the "primary" client, whose "best interest must be served at all times." RPC 92

Is an insurance defense attorney better off with separate counsel?

The theory is, where a fundamental conflict of interest exists, both the insured and insurer would be better off with separate counsel whose loyalty is not divided. The preceding section discusses an insurance defense attorney's professional duties under our Rules of Professional Conduct.

Who appoints defense counsel?

The insurer appoints defense counsel, in accordance with the policy, to defend in the name of the insured. During the course of the attorney-client relationship, the insured reveals that he and the claimant set up the whole incident to obtain insurance money under the policy. What should the attorney do?

Can an attorney subordinate the interests of the insured?

Therefore, despite the insured's "primary" designation, where the interests of the insured and insurer diverge, the attorney may not subordinate the interests of the insurer in favor of the insured. Conflicts of interest in this dual client relationship can place an attorney in a particularly thorny situation.

Can an attorney assist a client in fraud?

Most authorities agree that representation of the insured under these circumstances would violate an attorney's duty not to assist client fraud. In light of these prohibitions, the attorney must counsel the insured to rectify the fraud, and upon the insured's refusal, withdraw from representation pursuant to Rule 2.8.

Is RPC 153 confidential?

Although RPC 153 appears to hold that where clients consent to joint representation by an attorney, communications are ordinarily not confidential as impliedly authorized under Rule 4, insurance defense cases have been universally distinguished because the joint representation is not undertaken by mutual consent, but by contractual obligation.

Why is a CPA claim based on a violation of one of the unfair claim handling regulations?

A CPA claim can be based on a violation of one of the unfair claim handling regulations because even a single claim impacts the public interest. [x] Given this litigation climate, insurers should demonstrate their awareness of and compliance with Cedell from a claim’s inception.

Can a third party sue a defendant's insurer?

In such cases the plaintiff would be entitled to the claim file because the plaintiff is standing in the shoes of the insured. A third party claimant may also sue a defendant’s insurer for intentional torts such as mis representations during settlement negotiations.

Does Cedell's holding apply to third party bad faith actions?

Thus, generally it does not apply to third-party bad faith actions, where the insurer is sued by someone other than its own insured.

Does Cedell require an insurer to produce a bad faith complaint?

Cedell does not address whether an insurer needs to produce its file prior to the insured making a formal bad faith complaint. Even if the insurer elects to produce its file, in the absence of pending litigation, there is no judge available to perform an in camera review of the insurer’s withheld documents.

The breach-response lifecycle begins

A claim is initially triggered by theft, loss, or unauthorized disclosure from a legally liable organization.

The value of readiness

Concurrent with the forensic evaluation, a response plan will begin to take shape. Depending on the nature of the breach, this will involve victim notification, credit monitoring, public relations, data recovery, system hardening and implementation of new security products, services and procedures, as well as a breach coach.

Overview

Cyber liability insurance is a complicated and fast moving area of the law. This relatively new coverage is complicated and there are significant differences in the protection offered by various insurers.

Independent Insurance Advice

The Holland & Knight Cyber Liability Insurance Team assists clients in evaluating, negotiating and enforcing their cyber liability insurance policies. Our clients range from Fortune 500 corporations to small, private and not-for-profit entities, as well as boards of directors seeking assistance with their insurance programs.

Evaluating and Negotiating Effective Liability Coverage

To ensure that you are adequately protected, we start by listening to your risk transfer needs. Once we learn what your concerns are, we analyze your policy to determine whether it adequately protects you.

Maximizing Your Potential Insurance Recovery

The true test of an insurance program is how it responds to a claim. The Holland & Knight Cyber Liability Insurance Team uses its experience and established professional relationships in the market to best position your claim with the goal of securing the maximum potential insurance recovery.

Understanding Risk Management as a Whole

In addition to making sure each insurance policy provides strong protections, Holland & Knight can also review corporate bylaws, indemnification agreements and other corporate documents to make certain these documents all work together effectively with your insurance policies.

Industry Recognition for Holland & Knight's Directors & Officers and Management Liability Insurance Team

Directors & Boards magazine ranked Holland & Knight as one of the top law firms in the United States for dealing with directory liability issues in 2014. This is the eighth consecutive year Directors & Boards magazine has recognized Holland & Knight as a top law firm in this area (2007-2014).

Leading Lawyers on Your Side

Members of our team have been selected for inclusion in leading industry publications, including Chambers USA for Insurance and Best Lawyers in America for Insurance Law. In addition, Holland & Knight was recognized as 2018 Insurance & Reinsurance Law Firm of the Year – USA by Worldwide Advisor Awards Magazine.

Who said cyber crime is the greatest threat to every profession, every industry, and every company in the world?

Recently, Ginni Rometty , president and CEO of IBM stated, “Cyber-crime is the greatest threat to every profession, every industry, and every company in the world.”. For those of us in the insurance industry, that statement was further validation of the seriousness of cyber-crimes.

How much will cybercrime cost in 2021?

Cybersecurity Ventures predicts that cybercrime will cost the world $6 trillion annually by 2021, up from $3 trillion in 2015. In the United States, a Forbes article states the average data breach cost for businesses is $7.91 million.

Do carriers add coverage to package policies?

Carriers have also added coverage to package policies to address many of the needs. Since as early as the 1700s, a wide array of court decisions, regulations, opinions and training methods have refined the way the industry responds to losses.

Why are cyber insurance claims rejected?

Why cyber-insurance claims may be rejected. No matter the specialty, insurance companies want to minimize their own risk, and they look for their clients to behave appropriately. If you don't lock your back door, your homeowner's insurance provider may look at you askance if you put in a claim for a break-in, for instance.

What is cyber insurance?

The cyber-insurance market is maturing, and insurers are finding ways to assess potential clients' risk. In most cases, insurers will find a way to offer coverage to potential clients. Still, clients should deploy strong cybersecurity plans and do internal security audits.

How to prepare for cyber insurance?

Companies can best prepare for buying a cyber-insurance policy by conducting their own audits before the insurance company does . Panfilov says a good cyber-insurance risk assessment considers whether a potential customer: Has deployed perimeter firewalls and antivirus software. Uses strong and complex passwords.

What is risk audit?

Responsible insurers conduct risk audits as part of the process of underwriting an insurance policy for a new client, but the process is less involved than you might think. In other words, if a potential client wants to buy cyber insurance, most insurers will find a way to provide it.

Why do insurers reject claims?

Similarly, insurers may reject claims from covered cybersecurity clients because of poor security practices. Insurers can reject claims for a company's failure to maintain its cybersecurity systems or for failing to configure them properly, cyber-insurance experts say. Some policies don't cover social engineering attacks in which ...

Is cyber insurance cost effective?

Cyber insurance can be a cost-effective way to protect companies from “ catastrophic cyber-events ,” says Thomas Reagan, cyber practice leader at Marsh USA, a large insurance broker and cybersecurity strategic consulting firm. “I would encourage [potential] clients to dig in, to take a fresh look at cyber insurance if they haven't done it in ...

Is cyber security insurance easy?

Cybersecurity insurance is easier to get than ever, but solid security practices are a must. Here's what insurance companies look for, why claims get rejected, and what they consider red flags. If you haven't previously considered cybersecurity insurance, it may be time to do so. Insurance companies' cyber-insurance policies promise ...

How Privilege Is Usually Established After A Cyber Event

  • After a cyber event occurs and you notify the insurer, the first resource you’ll be directed to is your approved attorney. This is important because when you follow the right protocols, the attorney will hire all of the necessary vendor resources on your behalf. This includes all parties involved in the response: IT forensics specialists, the breach notification provider, a credit monitoring provi…
See more on woodruffsawyer.com

Cyber Litigation: Courts Weigh in on Attorney-Client Privilege

  • In late May of 2020, a Virginia federal court ordered Capital Oneto disclose its forensic analysis related to a massive data breach in 2019. The court rejected the argument that the report was protected under attorney-client privilege. From the Law360 article linked to above, Capital One claimed during the court hearing that “it should not be forced to turn over the analysis from cybe…
See more on woodruffsawyer.com

to Pre-Select Vendors Or Not?

  • The Capital One case points to a question we receive from clients often: Should we pre-select the vendors that we want to respond to a breach? Generally, pre-selecting the vendors you want to respond has been a useful tool in streamlining the response to a cyber incident. Particularly when it comes to IT forensics specialists, hiring a firm that is already familiar with your network and s…
See more on woodruffsawyer.com

What Next?

  • Most attorneys or forensics providers today would say that if the attorney hires a vendor for cyber incident response, everything produced would fall under attorney-client privilege. The way courts are interpreting privilege, however, may be a major disruption to that line of thinking. Until there is more case law, best practices still remain and that is to have your attorney oversee the cyber inc…
See more on woodruffsawyer.com