Cyber insurance: What are the options?

To contain the spread of Covid-19, the majority of workforce across industries is now working from their homes. And as these individuals connect to their office servers through home internet connections, it has increased the risk of cyber threat.

According to a recent Check Point survey, on an average, 2,600 coronavirus-related (including phishing, malicious websites purporting to offer information or advice about the pandemic) cyber attacks per day are being made against organisations. Fraudsters are taking advantage of the pandemic and exploiting the situation by making individuals part with their money by either directly or indirectly accessing their OTPs or bank accounts or creating fake accounts for donations to coronavirus relief. In such a scenario, though you should be aware and vigilant in protecting your data and money, opting for cyber insurance can help ease the financial burden on you. Insurers including Bajaj Allianz General, HDFC Ergo and ICICI Lombard issue policies to protect against various cyber threats. All persons above 18 years of age can buy this policy. Insurers including HDFC Ergo offer family floater cyber policies in addition to individual policies.

The company also offers 5 per cent discount on premium, if the policy is purchased online.

A cyber insurance policy is usually valid for a year, which means, you will have to renew your policy every year.

Here is what you should know.

What’s covered?

While the coverage of cyber insurance vary with each insurer, it broadly covers identity theft, unauthorised online transaction, e-extortion (an attack with a demand for money), cyber bullying, malware attack (software designed to disrupt, damage, alter or gain unauthorised access to a computer) and phishing (an attempt to obtain sensitive information such as user names, passwords and credit card details, often pretending to be a trustworthy entity through electronic communication) and e-mail spoofing (sending emails to mislead the recipient).

Cyber insurance policies offer compensation for financial loss incurred following a cyber attack. For instance, if you, a policyholder, happen to be a victim of unauthorised online transaction, where confidential information or money is extracted without your knowledge, then your cyber insurance will cover the loss, provided, it is legally unrecoverable. But the coverage is only to the extent of your policy’s sum insured. Cyber insurance policies also cover costs incurred in prosecuting a criminal case and other legal expenses related to the cyber attack. It also covers the cost of employing an IT professional (if any) to recover the lost data and removing any harmful publication online. Insurers also offer to cover the cost of medical counselling, if a policyholder needs one post the cyber attack. In the case of a malware attack, insurers cover the costs incurred for restoration of the computer system.

General insurance policies of both HDFC Ergo and Bajaj Allianz General Insurance provide coverage for the above-mentioned cyber threats. Besides, Bajaj Allianz General’s Cyber Safe Policy provides social media cover (identity theft through any social media platforms) and cyber stalking cover. Similarly, HDFC Ergo additionally offers cover for lost wages due to time taken off from work (not more than seven days) to rectify the records on any unauthorised breach/identity theft.

On the other hand, ICICI Lombard’s cyber insurance policy, sold via MobiKwik, a digital wallet platform, covers only the financial loss and lost wages resulting from unauthorised transaction.

Take note

Cyber insurance policies come with limitations and exclusions. Most importantly, a policyholder can make claim only for one event, even if the one event, say, malware attack, triggers multiple events such as hacking, phishing or unauthorised transaction. For instance, in case of multiple events, HDFC Ergo will pay the policyholder for an event with highest liability pay-out as claim amount.

Other limits in a cyber policy vary from insurer to insurer. For instance, the Cyber Safe Insurance policy from Bajaj Allianz General Insurance comes with a sub-limit (how much the insurer pays) for each cover. In the case of phishing and IT theft, the policy liability is limited to a maximum of 25 per cent of the sum insured. In the case of e-mail spoofing, it is a maximum of 15 per cent. In all other cases (such as identity theft, cyber stalking, privacy and data breach, and cyber extortion) it is 10 per cent.

In the case of HDFC Ergo’s e@Secure cyber insurance policy, there is a waiting period of 45 days before you can claim for cyber bullying, e-extortion and damage to e-reputation. The policy has a sub-limit of a maximum of 25 per cent in case of damage to e-reputation, identity theft and email spoofing; 15 per cent in case of phishing; and up to 10 per cent for psychological counselling, e-extortion, cyber bullying and protection against digital assets from malware. However, the policy compensates full costs of legal expenses, if taken for facing the threats covered by the policy. The policy also has a minimum deductible (portion of any claim which has to be paid by the policyholder) of ₹3,500 for claims above ₹50,000.

ICICI Lombard’s policy too comes with liability limits. The policyholder pays 10 per cent as co-pay from the second claim onwards.

Other general exclusions such as exploitation through non-digital media (like print), property damage, unlawful collection of data/transaction, losses due to natural perils, war/terrorism and losses related to trading or liabilities connected to sale/purchase of transactions are not covered by most of the cyber policies in the market.

How to make a claim?

Upon discovery of the event, you should intimate the insurer, usually, within a period of seven days, either via email or phone or through agents. Once the claim intimation is received, the insurer would settle the claim within 30 days from the date of receipt of documents.

Some of the key documents that need to be submitted include completed and signed claim form, copy of FIR filed with the policy, proof that an event had happened due to which the insured has incurred a loss, and any copies such as legal notice received or issued, if any, and invoice of restoration of your device cost incurred.

COMMENT NOW