First-party coverage refers to expenses that an organization incurs directly as a result of a cyber attack, such as the cost of data restoration and recovery, business interruption, and damage to computer systems or networks. First-party coverage can also include the cost of hiring a public relations firm to manage reputational damage or the cost of legal fees for notifying affected customers or regulatory authorities.

• • Loss or Damage to Electronic Data – Covers the cost to replace or restore electronic data or programs damaged, destroyed or stolen in a data breach, whether the data belongs to your firm or someone else. Losses must result from a covered peril such as a hacker attack, a virus, or a denial of service attack. Policies may also cover the cost of hiring experts or consultants to help preserve or reconstruct data.
  • Loss of Income and Extra Expenses – Covers income losses you suffer and extra expenses you incur to avoid or minimize a shutdown of your business after your computer system fails due a covered peril. Some policies, including the Hartford and Travelers policies cited above, cover dependent income losses. These are income losses you sustain when your network provider’s system has been breached.

• • Cyber Extortion – Applies when a hacker breaks into your computer system and threatens to commit a nefarious act like damaging your data, introducing a virus, initiating a denial of service attack, or releasing confidential data unless you pay a specified sum. Coverage typically extends to any extortion payment you make and expenses you incur in responding to the demand.
  • Notification Costs – Covers the cost of notifying parties (voluntarily or as required by law) affected by a data breach. May also cover the cost of providing credit monitoring services and establishing a call center.

• • Damage to Your Reputation – Some policies cover costs you incur for marketing and public relations to protect your company’s reputation following a data breach. This coverage may be called Crisis Management.

Third-party liability coverage, on the other hand, covers claims made by third parties against an organization for damages arising from a cyber attack, such as lawsuits filed by customers or partners for breach of contract, negligence, or failure to protect sensitive data. Third-party coverage can also include the cost of regulatory fines and penalties or the cost of credit monitoring services for affected customers.
 

• Network Security and Privacy Liability – Covers claims against your firm for negligent acts, errors or omissions that result in a denial of service attack, unauthorized access, introduction of a virus, or other security breach of your computer system. Also covers claims alleging you failed to properly protect sensitive data stored on your computer system. The data may belong to customers, clients, employees or other parties.
• Electronic Media Liability – Electronic media liability insurance covers lawsuits against you for acts like libel, slander, defamation, copyright infringement, invasion of privacy or domain name infringement. Generally, these acts are covered only if they result from your publication of electronic data on the Internet.
• Regulatory Proceedings – Covers fines or penalties imposed on your firm by regulatory agencies that oversee data breach laws. Also covers the cost of hiring an attorney to assist in your response to a regulatory proceeding