4 ms·

I'm on the bank's side of the lawsuit based on what I read in this article. They were covered under "computer and electronic crime" insurance. If the hacks don'

I'm on the bank's side of the lawsuit based on what I read in this article. They were covered under "computer and electronic crime" insurance. If the hacks don't fall under that coverage, what would?

swarnie_ 8y ago
I've seen similar insurance claims invalidated because the company couldn't prove then had taken reasonable steps to prevent an attack. The fact there were two similar incidents 8 months apart tells me there was a fundamental security issue which wasn't addressed correctly.
- mattnewton 8y ago
  That seems a bit like a catch 22 to me - if you get hacked enough, it must be your fault, so no payout.
  - jrhurst 8y ago
    Wait. How is this a catch 22? There is no. "In order to do Y you must first do X. But in order to do X you must first do Y"
    - shawabawa3 8y ago
      In order to get paid you must be hacked, in order to be hacked it must be your fault, if it's your fault you can't be paid
      - fundingshovel 8y ago
        That's not what this is staying at all though. It's saying "In order to get paid you must show you took reasonable precautions not get hacked AND get hacked." It's pretty hard to argue ignoring a known issue for 9 months is taking reasonable precaution. I don't see how that's any different then not paying when someone falls on because of broken steps you knew about and didn't fix, which would be pretty common.
jessaustin 8y ago
I'd like to see some big payouts on that, just to get those silly riders off every blessed insurance estimate I ever receive. "It's a vacant building with no internal walls or floor! It's not going to get hacked!" I don't understand why these riders are all on basic real estate insurance, rather than specifically on e.g. business liability or whatever.
runciblespoon 8y ago
> I'm on the bank's side of the lawsuit based on what I read in this article Did you read this bit: ‘The second exclusion in the C&E rider negates coverage for “loss involving automated mechanical devices which, on behalf of the Insured, disburse Money, accept deposits, cash checks, drafts or similar Written instruments or make credit card loans . . ..”‘’ And never lose the opportunity to blame 'Russian' hackers. “Foregenix .. determined the hacking tools and activity appeared to come from Russian-based Internet addresses .. according to the bank Verizon’s forensics experts concluded that the tools and servers used by the hackers were of Russian origin” They're clever enough to hack a bank but not clever enough to disguise their IP address.
- dyarosla 8y ago
  Or they disguised the IP addresses to look like Russian IPs? Although I'm no hacker- anyone know hard that would be to do?
  - darkstar999 8y ago
    Easy enough by using a VPN and/or compromised Russian machines.
  - monocasa 8y ago
    If you're going to build a botnet, it'll probably mainly be a bunch of Russian and Chinese machines. They've got the most WinXP instances still running without hardly any updates.
- darkstar999 8y ago
  That rider sounds to me like the ATM itself has to be compromised. It wasn't. The hack was upstream and the ATM was just doing what the network rules told it to.
  - zokier 8y ago
    No, it just says that the ATM must be involved in the loss, they need to be the cause or the source of the loss. And I think it is pretty well arguable that ATMs were involved in this case, even if in relatively minor role.
pjc50 8y ago
For years people were arguing that the "free market" way to get companies to actually care about IT security was to do it through their insurance premiums: companies with poor practice should be charged more. It sounds like that's come to pass now.
- ergothus 8y ago
  Does this show it's come to pass at all? It's possible, but the only evidence we have is that insurance companies want to avoid the payout, not that poor practices impacted premiums at all. Given what I've seen from security audits of the past, particularly when influenced by non-security professionals (such as the accountants in this scenario, both the insurers and the insured), I have little faith that if insurance companies dictate the practices that we'll get actual useful security increases, but plenty of extra bureaucratic hoops that will result in the same "productivity vs security _risk_" dilemma we have now, except the CBA changes to "is the hit to our productivity worth this hoop compared to the cost our lawyers would involve to prove this hoop was unnecessary or unrelated times the likelihood that it comes up"
  - slededit 8y ago
    An unpaid claim is only slightly worse than higher premium. Bank management wants to sleep soundly on that pile of money they're holding.
- 0xfeba 8y ago
  From one example? Hardly. What about Equifax?
raesene9 8y ago
The insurance company has a pretty strong financial incentive to try and minimize their loss here, so I'm not surprised they're trying. That said if too many "hacking insurance" policies fail to pay out, business are going to be less keen to use them.
zokier 8y ago
> If the hacks don't fall under that coverage, what would? The things actually specified in the contract, taking account the exclusions?
bdhess 8y ago
If the attackers had gotten the money out via wire transfers, then that would presumably be covered. The attackers likely avoided that route because it would be easy to trace. That’s likely the same reason that the insurance policy has special treatment for debit card/ATM incidents, because those sorts of transactions are more difficult to trace and therefore have a higher risk classification.

I'm on the bank's side of the lawsuit based on what I read in this article. They were covered under "computer and electronic crime" insurance. If the hacks don't fall under that coverage, what would?

swarnie_ 8y ago

I've seen similar insurance claims invalidated because the company couldn't prove then had taken reasonable steps to prevent an attack. The fact there were two similar incidents 8 months apart tells me there was a fundamental security issue which wasn't addressed correctly.

mattnewton 8y ago
That seems a bit like a catch 22 to me - if you get hacked enough, it must be your fault, so no payout.
- jrhurst 8y ago
  Wait. How is this a catch 22? There is no. "In order to do Y you must first do X. But in order to do X you must first do Y"
  - shawabawa3 8y ago
    In order to get paid you must be hacked, in order to be hacked it must be your fault, if it's your fault you can't be paid
    - fundingshovel 8y ago
      That's not what this is staying at all though. It's saying "In order to get paid you must show you took reasonable precautions not get hacked AND get hacked." It's pretty hard to argue ignoring a known issue for 9 months is taking reasonable precaution. I don't see how that's any different then not paying when someone falls on because of broken steps you knew about and didn't fix, which would be pretty common.

jessaustin 8y ago

I'd like to see some big payouts on that, just to get those silly riders off every blessed insurance estimate I ever receive. "It's a vacant building with no internal walls or floor! It's not going to get hacked!" I don't understand why these riders are all on basic real estate insurance, rather than specifically on e.g. business liability or whatever.

runciblespoon 8y ago

> I'm on the bank's side of the lawsuit based on what I read in this article Did you read this bit: ‘The second exclusion in the C&E rider negates coverage for “loss involving automated mechanical devices which, on behalf of the Insured, disburse Money, accept deposits, cash checks, drafts or similar Written instruments or make credit card loans . . ..”‘’ And never lose the opportunity to blame 'Russian' hackers. “Foregenix .. determined the hacking tools and activity appeared to come from Russian-based Internet addresses .. according to the bank Verizon’s forensics experts concluded that the tools and servers used by the hackers were of Russian origin” They're clever enough to hack a bank but not clever enough to disguise their IP address.

dyarosla 8y ago
Or they disguised the IP addresses to look like Russian IPs? Although I'm no hacker- anyone know hard that would be to do?
- darkstar999 8y ago
  Easy enough by using a VPN and/or compromised Russian machines.
- monocasa 8y ago
  If you're going to build a botnet, it'll probably mainly be a bunch of Russian and Chinese machines. They've got the most WinXP instances still running without hardly any updates.
darkstar999 8y ago
That rider sounds to me like the ATM itself has to be compromised. It wasn't. The hack was upstream and the ATM was just doing what the network rules told it to.
- zokier 8y ago
  No, it just says that the ATM must be involved in the loss, they need to be the cause or the source of the loss. And I think it is pretty well arguable that ATMs were involved in this case, even if in relatively minor role.

pjc50 8y ago

For years people were arguing that the "free market" way to get companies to actually care about IT security was to do it through their insurance premiums: companies with poor practice should be charged more. It sounds like that's come to pass now.

ergothus 8y ago
Does this show it's come to pass at all? It's possible, but the only evidence we have is that insurance companies want to avoid the payout, not that poor practices impacted premiums at all. Given what I've seen from security audits of the past, particularly when influenced by non-security professionals (such as the accountants in this scenario, both the insurers and the insured), I have little faith that if insurance companies dictate the practices that we'll get actual useful security increases, but plenty of extra bureaucratic hoops that will result in the same "productivity vs security _risk_" dilemma we have now, except the CBA changes to "is the hit to our productivity worth this hoop compared to the cost our lawyers would involve to prove this hoop was unnecessary or unrelated times the likelihood that it comes up"
- slededit 8y ago
  An unpaid claim is only slightly worse than higher premium. Bank management wants to sleep soundly on that pile of money they're holding.
0xfeba 8y ago
From one example? Hardly. What about Equifax?

raesene9 8y ago

The insurance company has a pretty strong financial incentive to try and minimize their loss here, so I'm not surprised they're trying. That said if too many "hacking insurance" policies fail to pay out, business are going to be less keen to use them.

zokier 8y ago

> If the hacks don't fall under that coverage, what would? The things actually specified in the contract, taking account the exclusions?

bdhess 8y ago

If the attackers had gotten the money out via wire transfers, then that would presumably be covered. The attackers likely avoided that route because it would be easy to trace. That’s likely the same reason that the insurance policy has special treatment for debit card/ATM incidents, because those sorts of transactions are more difficult to trace and therefore have a higher risk classification.