Why Some Boards Are Looking More Closely at Cyber Insurance
March 17, 2015 — Bank statements, Social Security numbers, birth dates. Are they secure? And if they are not, are you protected?
It's time to talk about cyber insurance.
"One of the big misconceptions in real estate is that because they aren't a retail store conducting online transactions, [co-ops and condos] don't have cyber exposure. But if they store personal information, they have exposure," says Jim O'Neill of the New Empire Group, a company that offers cyber insurance for co-ops, condos, and property managers. If that data lands in the wrong hands, the co-op has liability that can cost the building thousands of dollars in legal fees and/or settlement costs.
As a result, building associations and property managers are picking up cyber insurance, since any company that keeps personal information is responsible for protecting that data. Breaches are costly and not covered under traditional protections, such as Directors & Officers liability or crime insurance.
Many insurance brokers are urging associations to add cyber insurance to their package of coverage. Boards can also reach out to companies that specialize in cyber issues. The Ponemon Institute, a Michigan-based research center, estimates that a cyber breach in the U.S. costs $200 for each compromised record. A 50-unit cooperative, therefore, would need to pay more than $10,000 if accounts are hacked. For property managers responsible for dozens of buildings, the liability multiples. Condo associations require less banking information for approval so are at a lower risk, insurance agents said, but are still at risk.
"The property managers are jumping on this coverage but the associations are saying it's the property managers' issue," says Ed Mackoul, president of Mackoul & Associates, an insurance agency that deals with real estate. Only 10 to 15 percent of the 900 associations he works with have cyber coverage, according to Mackoul. Still, two years ago, none did. "Until we see a full breach, people will think that hackers don't target them," says Mackoul.
There have been close calls though, notes Mackoul, who recently dealt with a board member who had his cell phone stolen. The thief found an e-mail from a prospective buyer with bank information, set up a dummy e-mail and tried to make a withdrawal.
Bram Fierstein, a property manager at Gramatan Management, which oversees buildings in Westchester, The Bronx, and Rockland County, added cyber coverage to his policy in December. "We are not Sony, we are not Target, we are not Home Depot, and we have firewalls. But when you see these huge corporations are being breached, you have to be prepared," he says. "I tell boards to get it as well, but it's not an easy sell. We have a policy, but it's a belts and suspenders situation."
When a management firm or association decides to buy cyber insurance, it needs to take steps to better protect the data it keeps. "The [company] needs to identify the type of information it collects, where it stores that information and in what form. Is it encrypted? Is there a backup? Is the server or computer loaded with the most recent antivirus software?" says David Menken, a lawyer who specializes in data security at Smith Buss & Jacobs.
Most insurance companies will require the client to have a data protection program and a cyber policy that outlines how employees, including boards of directors, use their e-mail, internet, computers, and network, according to Menken. The computer device must have up-to-date antivirus software and be password protected, he said. Network backups also must be updated weekly, policies show.
This process will go a long way toward protecting the information stored. "If you get fire insurance, you have to certify to the insurance company that you have a smoke alarm. If you get a smoke alarm, you'll be safer. If you go through the act of going through your data so it complies, your data is that much more secure," he says.
Adapted from "Cyber Threat" by Kathleen Lucadamo (Habitat, March 2015).
For more, see our Site Map or join our Archive >>