By: James R. Denlea
Many of us have read about the Solar Winds Orion enterprise network attack. It may well be months, if not years, before the damage assessment to the Department of Homeland Security; State Department; Office of the President; and Fortune 500 companies, can be fully completed.
Accordingly, New York State’s Department of Financial Services (“DFS”) has issued a warning, that the failure of any business or organization to develop a “rigorous and data driven approach to cyber risk,” could result in both serious and unforeseen consequences. This is true both for insurers as well as corporations and organizations.
As to insurers, DFS warns that they must take great care in underwriting these risks, as many insureds use insurance as a cost effective substitute for improving cybersecurity. As such, the insurer runs the risk of actually increasing cyber risk, as the insured will not upgrade their defenses, but simply seek to pass any losses on to the insurer. Unnecessary coverage disputes can also arise from policies that do not specifically rule cyber risk coverage, in or out, of the specific policy at issue. As a result, Errors and Omissions, General Liability, and even Product Liability policies have been drawn into the dispute as to whether an insured has cyber risk protection.
Yet the concerns do not end there. According to the most recent FBI Internet Crime Reports, there was a 37% annual increase in ransomware attacks, which directly caused a 147% increase in associated losses. This raises the question as to who should be responsible for paying the ransom, the insurer or insured. Surprisingly, the answer may be neither, because the payment may be prohibited by the U.S. Treasury’s Office of Foreign Assets Control (“OFAC”).
The Treasury Department has taken the position that ransom payments on behalf of any victim, including financial institutions, cyber insurance firms, and companies performing digital forensics and incident responses, not only encourage future attacks, but may very well violate OFAC regulations, resulting in significant sanctions.
Because a victimized entity may never know if the attack was precipitated by anyone on the Specially Designated Nationals and Blocked Persons List (“SDN list”), the best course of action is to make no payments, without consultation with and clearance from, OFAC and the Financial Crimes Enforcement Network (“FinCEN”). Applications for license to make payments are reviewed on a case-by-case basis, “with a presumption of denial.”
Essentially, protection of an organization can be distilled to three basic elements. First, make sure that your data has all available cyber protection software. It would be prudent to engage professional cyber risk experts to perform testing, to ensure the adequacy of your defenses. Second, to insurers, make sure that your underwriting department fully understands the anticipated risks associated with insuring an entity, with specific policy language and recommendations, to both minimize risks and clarify exposure. Third, should an attack occur, make sure that all involved decision makers take no action, until the proper authorities are contacted. While your organization may regard the risk of attack as slight, given the increased incidence of attacks, the rise in associated losses, and the order of magnitude of damage, it is long past time to address this existential risk to your organization.
The Firm is pleased to announce that Jeff Carton has completed his training and is now a Member of the American Arbitration Association’s National Roster of Arbitrators, including its Panel of Arbitrators for large, complex, commercial disputes.
Congrats, Jeff!
Hudson Valley Magazine has released its 2021 list of the top lawyers practicing in the Hudson Valley and we’re thrilled to see our partner, Jeff Carton, included for his excellence in the field of Commercial Litigation. This prestigious list includes many of the best legal professionals in the Hudson Valley, as voted on by their peers.
“It is a privilege to be chosen for this honor,” said Jeff Carton, “especially when it is from recommendations of your peers. More importantly, it’s great to see the breadth and depth of legal talent that calls Hudson Valley “home.” It’s a reflection of just how many experienced lawyers there are in our community.”
Happy New Year; we made it! While there are still many COVID-related challenges to overcome, the new year brings with it tremendous promise and opportunity. With that in mind, we’re pleased to share with you a few of the victories we celebrated at year’s end, and our unwavering optimism for the year ahead.
Stay safe (and healthy), and best wishes for 2021!
In a stunning rebuke of a large, regional health care system and hospital, the New York State Public Health and Health Planning Council (“PHHPC”) credited our complaint that the hospital “committed an improper practice” in terminating a physician’s medical staff privileges and membership. The PHHPC directed the hospital to reconsider their actions in light of the Council’s determination, marking a significant victory for (and vindication to) our physician client. Congrats to Jim and John for championing our client’s cause.
The widow of a famous music manager, and co-founder of an independent record label, defeated her late husband’s business partner’s motion to dismiss her claims to the on-going royalty payments being made in connection with the label’s recording artists and their publishing rights. Justice Lawrence H. Ecker (Westchester County) denied the defendant’s motion to dismiss the complaint concluding, in part, that the Company’s prior tax filings identifying the widow as an officer and shareholder of the company estopped the defendant from taking a contrary position in the litigation. Congratulations to Joe on his hard-fought victory..
On December 15, 2020, the Honorable Lawrence E. Kahn, United States District Court Judge for the Northern District of New York, granted Final Approval of the nationwide class action settlement reached on behalf of Ford F-Series pickup truck owners. The Court’s ruling was the culmination of a nearly four year battle concerning the alleged failure of F-Series door latches to lock/latch properly in sub-freezing temperatures.
Congrats to Jeff for his selection as a Panelist to the American Arbitration Association’s National Roster of Arbitrators. Jeff successfully completed his training in Arbitration Fundamentals and Best Practices for New AAA Arbitrators and will now be eligible to serve as an Arbitrator in Commercial Disputes submitted to the AAA.
Best Lawyers in America has selected the firm as one of the best in 2021 in the area of Commercial Litigation.
Welcome back, Amber, who returns from maternity leave!
Congrats to our co-founder and partner, Jeff Carton, for being recognized in the recently published 2021 edition of Best Lawyers for his excellence in the field of Commercial Litigation.
Candidacy for Best Lawyers is based on professional excellence, with consistently high marks from clients and peers.
We’re delighted to see our colleague recognized with such an honor !
