First-Party Cyber Coverage: The Business's Own Loss vs. Claims Against It

Introduction

A single cyberattack can cost a business money in two separate ways.

• The business's own costs. It pays experts to find the intruder, repairs its damaged files, and loses sales while its systems are down.
• Claims from other people. Someone else, such as a customer, a business partner or a government agency, says the business harmed them and demands money or other action.

Insurance gives these two problems different names. The first is first-party loss, meaning the insured business's own loss. The second is third-party liability, meaning the business may be legally responsible to pay someone else. Both can come from the same attack, but they are paid for different reasons and under different parts of a cyber policy.

One question will sort most cyber costs: Is this money paying for the business's own loss, or answering a demand someone else made against the business?

What You'll Be Able to Do

By the end of this lesson, you should be able to:

• Sort a cyber cost as first-party loss or third-party liability, even when both come from the same event.
• Tell breach-response legal and computer expert costs apart from the cost of defending a claim.
• Tell restoring data to its condition before the breach apart from paying to improve the system.
• Trace a cyber business-interruption loss through the waiting period and the restoration period, then apply a stated retention.
• Explain why putting a cost in the right category does not, by itself, mean the policy pays for it.

Before You Start

This lesson builds on two earlier lessons:

• Commercial property: build the package, classify the loss taught you to sort a business's loss before asking about payment.
• Business income and extra expense: trace the interruption taught you to follow lost income and extra costs over time.

For what makes someone legally responsible to another person, see Recognize negligence and other bases of liability.

About the sample policy. This lesson uses one insurer's published specimen (sample) cyber form, Travelers CyberRisk Coverage, form CYB-16001, edition 01-19, as its worked example. Other insurers' cyber forms can use different names, triggers and definitions. When this lesson says "the sample form," it means that form only. All businesses, people and dollar amounts are fictional.

First Party vs. Third Party: Whose Money Problem Is It?

First party means the insured business itself. The insured is the person or business the policy protects. First-party coverage pays for the business's own losses and expenses. No outsider has to complain first.

Third party means someone outside the insurance contract, such as a customer, vendor or government agency. Liability coverage responds when a third party holds the business responsible for harm. The business is not asking to be repaid for its own damage. It is answering someone else's demand.

The sample form uses a defined word for that demand: a Claim. In plain English, a Claim is a formal demand made against the insured over an alleged wrongful act. Examples include:

• a written demand for money or other relief
• a lawsuit
• an arbitration or similar dispute process
• a written request to extend or waive a legal filing deadline

A government investigation or administrative action, called a regulatory proceeding, counts as a Claim only under the form's Regulatory Proceedings agreement, and only once it is formally commenced against the insured for a Wrongful Act (in the sample form, a Media Act or a Privacy And Security Act). The form lists the commencing steps: the filing of charges, the filing of an investigative order, the service of a summons, or the service or filing of a similar document. An agency simply looking into a matter, without one of those formal steps against the insured, is not yet a Claim under the sample form.

How the Sample Form Splits Its Promises

Each payment promise in a policy is called an insuring agreement: a paragraph stating what the insurer will pay for and what event must happen first. The sample form groups its insuring agreements like this:

Liability insuring agreements (claims against the business): - Privacy And Security - Media - Regulatory Proceedings

First-party insuring agreements (the business's own loss): - Breach Response: for example, notification costs, computer and legal expert costs, data restoration, betterment, cyber extortion and public relations. - Business Loss: for example, business interruption. - Cyber Crime: for example, computer fraud and funds transfer fraud.

Worked Example: One Break-In, Two Columns

Basin Ridge Supply, a fictional wholesaler, finds out that an intruder got into its order system. The intruder corrupted the order database and viewed customer account records. Over the next two months, Basin Ridge faces five costs:

1. An outside forensic firm investigates how the intruder got in.
2. A technician restores the order database from backups.
3. Basin Ridge loses profit while orders can't be processed.
4. Six weeks later, a customer's attorney sends a written demand for money, saying the exposed records harmed the customer.
5. Basin Ridge's lawyer responds to and defends against that demand.

Sort each cost by asking who suffered the loss being paid for and whether an outsider made a demand:

• Items 1–3 are first-party. Basin Ridge is paying to investigate, repair and survive its own disruption. No outsider demanded anything.
• Items 4–5 are third-party liability. The customer's written demand is a Claim. The lawyer's fees exist only because of that Claim.

Why this works: The event (the break-in) does not decide the category. The reason for the payment does. One attack produced both kinds of cost.

Change one fact: Suppose the customer never sends a demand. Items 1–3 are unchanged, and the liability column is now empty. First-party costs do not depend on anyone suing.

The tempting mistake: "Customers were affected, so this must be third-party." Suppose Basin Ridge pays to mail notices and offer credit monitoring to affected customers. Those people benefit, but no one has made a Claim. Basin Ridge is paying its own response costs. The sample form lists these as Privacy Breach Notification Costs under the first-party Breach Response agreements. Who benefits from a payment is not the test. Ask whether a third party made a demand against the business.

Now sort three costs yourself.

A fictional dental office's patient scheduling files are encrypted by malicious software. Classify each cost as first-party or third-party:

• (a) The office's lost profit during the two days it can't book appointments
• (b) A former patient's lawsuit claiming the office failed to protect their records
• (c) The office's cost to send letters to patients whose records may have been viewed

Two Kinds of Lawyer Bills: Breach Response vs. Defense

Lawyers can appear on both sides of a cyber event, so the type of lawyer is not a reliable sorting clue. The sample form separates their bills by the task.

Computer And Legal Expert Costs pay for helping the business respond to the breach itself. In plain English, these are reasonable fees for services recommended and provided by an approved provider (a service provider the insurer has approved in writing) to:

• investigate whether a breach happened and what caused it
• find out whose confidential information was lost, stolen, viewed or disclosed
• contain or stop a breach still in progress
• certify the system meets payment-card security standards, if a breach caused noncompliance (only the first certification)
• provide legal services to respond to the breach

Defense Costs pay for handling a Claim against the business. These are reasonable fees for investigating, defending, settling or appealing a Claim.

The sample form's definition of Computer And Legal Expert Costs specifically leaves out Defense Costs. The two cannot be merged.

Worked Example: Same Law Firm, Two Jobs

After Basin Ridge's break-in, an approved law firm advises Basin Ridge on how to respond: what happened, whose data was involved, and what steps to take. This is breach response, so it is first-party Computer And Legal Expert Costs.

Six weeks later, the customer's demand arrives, and the same firm answers it. This work is Defense Costs, on the liability side.

What changed the answer: The firm didn't change. The task did. Before any Claim exists, legal work responding to the breach is first-party. Once a third party makes a Claim, work investigating, defending or settling that Claim is defense.

A fictional print shop is hacked. Classify the two lawyer bills described below:

• An approved attorney helps the shop determine which customers' payment details were exposed.
• A state agency files an investigative order against the shop for an alleged Wrongful Act involving its handling of customer data, and the shop hires counsel to respond to it.

Restoration (Putting It Back) vs. Betterment (Making It Better)

Two sample-form agreements cover computer work after a breach. They pay for different things.

Data Restoration: Back to How It Was

Restoration Costs put damaged data and software back to the condition they were in immediately before the breach. They do not upgrade it. In plain English, these are reasonable amounts the business pays, with the insurer's prior written consent (permission in writing before the cost is incurred), to:

• restore or recover damaged or destroyed programs, software or electronic data in the business's computer system, or
• determine that the data or software cannot reasonably be restored.

The Data Restoration agreement applies only to costs directly caused by a Security Breach that is Discovered during the policy period.

• Security Breach (in plain English): someone gets into the business's computer system without permission, someone uses permitted access to cause intentional harm, a denial-of-service attack floods the system, or a virus is introduced into it.
• Discovered: the moment a senior officer first learns facts that would lead a reasonable person to assume the business has suffered, or will suffer, a first-party loss. The listed officers are the CEO, CFO, chief information security officer, risk manager, in-house general counsel, or someone in an equivalent role.

Restoration Costs specifically do not include:

• costs to design, update or improve how programs or software work
• costs to recreate work product, research or analysis
• costs for programs, software or data the business had no license to use
• the business's own wages, benefits or overhead

Betterment: A Separate, Conditional Promise

Betterment Costs pay for hardware or software that improves the system after a breach. In the sample form this is a separate insuring agreement with its own conditions:

• The breach has been stopped or contained and resulted in covered Computer And Legal Expert Costs.
• The approved provider that responded found a weakness that caused or contributed to the breach, and recommends improvements to prevent a repeat.
• The business pays for the improvements, with the insurer's written consent, within 90 days after the recommendation or by the end of the policy period, whichever comes first.

The declarations may also require the business to pay a percentage of betterment costs itself. The sample form calls this a coparticipation percentage.

Worked Example: Restore vs. Upgrade

After the break-in, Basin Ridge spends $3,200, with the insurer's prior written consent, to recover its corrupted order database from backups. The owner also wants to replace the old order software with a newer version that has better features, for $7,600.

• The $3,200 fits the definition of Restoration Costs. It puts the data back to how it was immediately before the breach.
• The $7,600 is not a Restoration Cost. Improving the software is specifically left out of that definition. It could be considered only under the separate Betterment agreement, and only if:
• the business bought that agreement (it shows a limit on the declarations)
• an approved provider identified the weakness and recommended the fix
• the insurer consented in writing
• the timing and other conditions are met

Change one fact: Suppose there was no break-in. Basin Ridge simply decides its old software is outdated and plans a redesign. There is no Security Breach, so the Data Restoration trigger is not met. Redesign is also outside the definition of Restoration Costs. This is a business choice, not a cyber loss.

The tempting mistake: "The breach exposed the old system's weakness, so the policy owes the business a better system." Restoration returns the business to its pre-breach condition. Paying for improvement takes the separate Betterment promise, with its own conditions.

A fictional architecture firm suffers a virus that destroys project files. It wants coverage for three costs:

• (a) recovering the files from a backup service
• (b) having staff redraw a set of plans that were never backed up
• (c) a technician's work confirming that one corrupted archive cannot be recovered

Which of these fit the sample form's definition of Restoration Costs?

Cyber Business Interruption: Lost Income While Systems Are Down

Business interruption coverage pays for income a business loses because its operations are interrupted. You traced this idea for physical damage in Business income and extra expense: trace the interruption. The sample cyber form has its own version with its own triggers and definitions. Don't assume it works exactly like a property form.

What Has to Happen First

The sample form's Business Interruption agreement pays when an interruption is directly caused by one of these, Discovered during the policy period:

• a Security Breach that totally or partially interrupts the business's computer system
• a System Failure, if the declarations make that trigger apply (it has its own limit, which sits inside the business interruption limit). In plain English, a System Failure is an accidental, unintentional and unplanned total or partial interruption of the insured business's computer system that is not caused by a Security Breach or by a total or partial interruption of a third party's computer system or network.
• the business voluntarily shutting down its own system, if reasonably necessary to reduce the loss from a breach in progress

What Counts as the Loss

The sample form's Business Interruption Loss has two main parts:

• Income Loss: pretax net profit the business did not earn, plus net loss it incurred, because of the event. Continuing normal operating expenses and payroll are part of that calculation.
• Extra Expense: reasonable extra costs, incurred with the insurer's written consent, that come from the event, are above normal operating costs, are meant to reduce income loss, and would not have happened without the event.

Both must fall within the Period of Restoration. That period:

• begins after a Wait Period ends. The Wait Period is a stretch of time at the start of the interruption, set by the policy, during which interruption losses are not counted.
• ends at whichever comes first: the end of the restoration period shown on the declarations, or when operations have been back at their pre-event level for 24 consecutive hours.

Two further points:

• If the interruption lasts beyond the Wait Period, Business Interruption Loss can also include Accounting Costs: a forensic accountant's fees to calculate the income loss.
• Business Interruption Loss does not include loss from harm to the business's reputation. The sample form handles reputation harm under a separate agreement.

Worked Example: Trace the Interruption, Then Apply the Retention

Stipulated policy assumptions (fictional, for this exercise only): - Business Interruption limit: $50,000 - Wait Period: 12 hours - Restoration period on the declarations: 60 days - Business Interruption retention (the amount the business pays itself before the insurer pays, similar in effect to a deductible; see Calculate deductibles, limits and coinsurance): $2,500 - The Security Breach was Discovered during the policy period, and no exclusion applies.

Facts: Basin Ridge's order system goes down Monday at 8 a.m. because of the break-in.

• During the first 12 hours, Basin Ridge loses $1,100 of profit.
• After that, it loses $9,000 of income (calculated as the form describes) until operations run at their normal level for 24 straight hours, which is well inside 60 days.
• With the insurer's written consent, it rents a temporary cloud server for $1,500 to process urgent orders.

Step 1 — Leave out the Wait Period. The $1,100 lost in the first 12 hours falls before the Period of Restoration begins, so it is not counted.

Step 2 — Add the parts of Business Interruption Loss. Income Loss $9,000 + Extra Expense $1,500 = $10,500

Step 3 — Apply the retention. Under the sample form, the insurer pays only after the business has paid the retention. $10,500 − $2,500 = $8,000 paid by the insurer, which is within the $50,000 limit.

Check: The business bears $1,100 (Wait Period) + $2,500 (retention) = $3,600 of the $11,600 total lost and spent. The insurer pays $8,000. And $3,600 + $8,000 = $11,600.

Change one fact: Suppose Basin Ridge rented the server without the insurer's written consent. The $1,500 then doesn't meet the definition of Extra Expense. Business Interruption Loss would be $9,000, and the insurer would pay $9,000 − $2,500 = $6,500.

Another changed fact: Suppose the system went down because an employee installed a routine update incorrectly, with no intruder involved. There is no Security Breach, so the first trigger doesn't fit. Coverage would depend on whether the policy's System Failure trigger applies, which means checking that definition and the declarations.

The tempting mistake: "Any outage is covered from the first minute." The sample form requires a listed trigger and does not count the Wait Period. Its Period of Restoration also ends once operations have run at the normal level for 24 consecutive hours, so it is not open-ended.

Try this one. Basin Ridge's interruption also causes a customer to miss its own deliveries. The customer sends Basin Ridge a written demand for its lost profits. Is that customer's lost profit part of Basin Ridge's Business Interruption Loss?

Sorting a Cost Is Not the Same as Coverage

Getting the category right tells you which part of the policy to read. It does not tell you the insurer will pay. In the sample form, these also matter:

• Only selected agreements apply. The declarations page summarizes the policy, including which coverages were bought, their limits and retentions. The sample form applies only the insuring agreements that have a limit shown there.
• Triggers and timing. Liability agreements require a Claim first made during the policy period (or an applicable extended reporting period). First-party agreements require the event to be Discovered during the policy period, with some agreements also allowing an extended reporting period.
• Conditions in the definitions. These include approved providers, written consent (prior written consent for some costs), and reasonableness.
• Exclusions. These are policy provisions that remove certain losses from coverage.
• Limits. There is an aggregate limit for all loss, a limit for each insuring agreement, and some smaller limits inside other limits. For example, the System Failure limit sits inside the Business Interruption limit.
• Retentions. When several retentions apply to the same event or related events, the sample form says the business pays no more than the largest one. Betterment is the exception to this rule.

Example: A fictional retailer's declarations show limits only for Privacy And Security and Data Restoration. A breach takes its website down for three days. The lost sales are still correctly classified as a first-party business interruption loss. But no Business Interruption limit appears on the declarations, so under the sample form's rule that agreement does not apply.

Practice on Your Own

Use the sample form's terms as taught above. Assume a fictional business in each item.

1. After a breach, a fictional bakery hires the insurer's approved forensic firm to stop an intruder who is still copying files. Is this first-party or third-party, and which kind of cost is it?

2. A fictional travel agency pays for credit monitoring for customers whose data was exposed. Two months later, one of those customers files a lawsuit. Classify the credit monitoring and the lawsuit.

3. After a breach, a fictional accounting firm wants coverage for (a) restoring client spreadsheets from backup and (b) installing a new firewall it has wanted for years. No approved provider has recommended the firewall. Under the sample form, which cost fits Data Restoration, and what would the firewall need?

4. Stipulated assumptions: - Business Interruption limit: $25,000 - Wait Period: 8 hours - Restoration period on the declarations: 90 days - Business Interruption retention: $1,000 - The trigger was met, and no exclusion applies.

A fictional online shop's systems go down. Its losses are: - $1,200 of profit lost during the first 8 hours - $6,400 of Income Loss afterward, until operations are back at the normal level for 24 consecutive hours - $900 of Extra Expense, approved in writing, for manual order processing - $2,000 of sales lost weeks later because of bad publicity about the breach

What Business Interruption Loss counts, and what does the insurer pay?

5. A fictional clinic's declarations show limits only for the three liability agreements. After a breach, the clinic spends money restoring its patient database. Is this a third-party cost? Does the sample form's Data Restoration agreement pay it?

What to Remember

• First party means the business's own loss and response costs. Third party means someone else's Claim against the business. One cyber event can produce both.
• Sort by the reason for the payment, not by the event or by who benefits.
• Breach-response expert costs (investigate, identify affected data, contain, respond legally) are first-party. Defense Costs (investigate, defend, settle or appeal a Claim) are liability-side. The task decides, not the lawyer.
• Restoration returns data and software to their pre-breach condition. Improvements fall outside Restoration Costs and need the separate, conditional Betterment agreement.
• Cyber business interruption in the sample form needs a listed trigger. It counts Income Loss and Extra Expense only during the Period of Restoration, which begins after the Wait Period, and it leaves out reputation harm.
• Classification tells you where to look. Coverage still depends on which agreements are on the declarations, plus triggers, conditions, exclusions, limits and retentions.

Practice next: Take any cyber scenario and list every cost. For each one, ask two questions: whose loss is this, and has anyone made a demand against the business? Then check which insuring agreement, if any, was selected for it.