Cybersecurity Risks, Leaks, and Securities Litigation

In the wake of the Edward Snowden and Bradley Manning information leaks, it is important for companies to consider the ramifications that leaked information can mean to your enterprise when the unforeseen happens. Digital information has not only become easier to access and store but also  much easier to leak. In their search for efficiency many businesses unwittingly put themselves in a very exposed position when it comes to cyber security. The situation is exacerbated without a proper cyber-risk management strategy of proper controls, policies, and if need be appropriate methods of risk transference through insurance.

The true complexities associated with cyber – liabilities start to take form when you consider that at stake may not only be company sensitive information, private client data, and trade secrets, but also the reputation of the company and those that do business with it. A recent article in PRWeek discusses how Booz Allen is having to fight massive reputation damage in relation to the NSA leak by former employee Edward Snowden. Booz Allen quickly made a public statement – “News reports that this individual has claimed to have leaked classified information are shocking, and if accurate, this action represents a grave violation of the code of conduct and core values of our firm. We will work closely with our clients and authorities in their investigation of this matter”.

This was not enough for Wall Street as Booz Allen shares dropped Monday on news that the leaker was associated with the company. The Associated Press printed :

NEW YORK  Shares of Booz Allen Hamilton Holding Corp. (BAH) fell on Monday, after the company’s employee, Edward Snowden, stepped forward as the person who last week leaked information about secret government surveillance programs to several news media outlets.

Shares fell 76 cents, or 4.2 percent, to $17.24 in morning trading. That’s closer to the high end of the stock’s 52-week trading range of $11.85 to $19.23.

Not only did this leak cause a monumental problem to the national security of the country but we must now consider the BAH shareholders who were financially impacted due to this security breach. In October 2011, the SEC’s Division of Corporate Finance issued “Disclosure Guidance” on cybersecurity related issues. Among other things, the Guidance clarified that the agency expects companies to disclose the risk of cyber incidents among their “risk factors” in their periodic filings and also expects companies to disclose material cybersecurity breaches in their Management Discussion and Analysis. Subsequently one can expect failure to promptly disclose a cyber breach may put a company at risk of facing formal SEC investigations, shareholder class actions, or derivative lawsuits to which having applicable insurance coverage may provide protections.

Kevin LaCroix of the D&O Diary, a periodic journal containing discussions about Directors and Officers liability issues, writes:

In addition to the risk of SEC enforcement action, companies experiencing cyber breaches also face the possibility of a securities class action lawsuit. However, the memo notes, a company experiencing a cyber breach “will likely not be a target of a securities class action unless the disclosure of the breach can be linked to a statistically significant drop in the company’s share price.” In that respect, it is worth noting that several high profile companies announcing cyber breaches have not experienced a significant drop in their stock price following the announcement. (For example, recent announcements by Facebook, Apple and Microsoft that they have been the target of sophisticated cyber attacks did not affect the companies’ share prices.) Nevertheless, it seems likely that at least some companies experiencing cyber breaches or subject to cyber attacks will also suffer a drop in their share price, and “thus result in securities class action litigation.” 

Although this can be quite troubling to most enterprises, it is not news that cybersecurity risks represent a significant concern for just about every company involved in the current economy. It is becoming more obvious that discussions pertaining to cyber-liabilities and how to manage these risks in a holistic manner will be heating up over the next year as we become more aware to the associated perils.


Study Shows Cyber Insurance Utilization Low

A recent article by Anya Khalamayzer cited that based on a Willis North American reporty, more than HALF of the Fortune 500 believe their firms would be seriously harmed by a cyber-attack. With increased cloud computing adoption, more and more small to mid sized businesses are finding themselves in situations similar to their Fortune 500 counterparts. In October of 2011, the Securities and Exchange Commission (SEC) issued guidance to U.S. listed companies to provide extensive disclosure on cyber exposures.

Ann Longmore, who is an executive vice president with Willis North America and co-author of the report said “D&O liability risk may be heightened for companies that experience cyber breaches if cyber risk disclosures are deemed not to meet SEC standards and a significant loss were to occur. This may be especially true if peers have provided more detailed disclosure.” Obviously the SEC feels that companies are not doing a good job of disclosing their exposure level for cyber-liability to their shareholders.

While most companies will fall outside of the scope of the SEC guidance, it is no less important to note the damage that can be caused by a cyber attack on a middle market company. Data is one of your most important assets yet it is not covered by standard property insurance policies. The loss of critical archive data, billing files, proposals, or other hard to replace data can be a crippling blow to a company. While data security is important to many companies, it is not the only asset  that needs to be considered.  Critical electronic systems or equipment crashing can be incredibly detrimental to a business. Imagine Point of Sale systems crashing during the holiday season, or the loss of revenue associated with that system’s  downtime.

Right now, most businesses just don’t understand the perils associated with  cyber integration. Mainly this is because it is not as tangible as a fire, flooding, or employee injuries. This does not make it any less real. It is also reasonable to note that 15 percent of the Willis study group said that they do not have the resources to protect themselves from critical attacks. Usually the costliest risks are the one’s never appreciated or considered fully. This is why I implore business owners really take stock into how bad it can be if things do go south, and realistically determine the impact a liability loss would cause them.

I believe as more companies get “plugged in” we will see a rise in losses associated with these types of risks. These experiences will become part of IT consciousness  and owners, directors, and department heads will demand ways to protect themselves; it will be our job as risk consultants to educate them as to the tools available to mitigate this new and evolving risk.