Cyber Security Insurance for Commercial Real Estate

Practical Law Legal Update w-002-1978 (Approx. 4 pages)

Cyber Security Insurance for Commercial Real Estate

by Practical Law Real Estate

Commercial Real Estate Cyber Risks

Commercial real estate is vulnerable to cyber criminals because of the electronic storage of personally identifiable information, intellectual property, and credit card information.

Buildings continue to incorporate newer technologies to attract desirable tenants. Part of the convenience of new technology systems is that they can be controlled remotely. For instance, most modern building systems can be accessed externally by several different parties, including:

HVAC.
Security systems.
Closed-circuit TV.
Fire alarms.
Utilities.
Servers.
Voicemail.
Email.
Fax.

Many commercial tenants also require Wi-Fi, cloud-based computing, and web-based transaction services. Retail and hospitality properties further require point of sale terminals to process credit card transactions.

Another concern is that employees likely have multiple devices (laptops, smartphones, tablets, key cards) that can easily be lost or stolen.

Each system and device potentially provides an access point for a cyber attack.

Cyber criminals have even been able to intercept and reroute wire transfers from real estate closings.

Potential Liabilities

Cyber criminals usually target small businesses where security measures are perceived to be weaker. The cost of remediating a data breach without cyber insurance can range from hundreds of thousands to millions of dollars, which would likely bankrupt most small companies.

Larger businesses can suffer damages into the hundreds of millions of dollars because of the potential for class action lawsuits.

Additionally, forensic cyber security firms can trace the source of the data breach to establish liability.

Cyber Insurance Coverage

Cyber insurance protects the insured from the costs associated with responding to a data breach (First-Party Coverage) and also from the damages and expenses arising from lawsuits against the insured following a data breach (Third-Party Coverage).

First-Party Coverage

First-party coverage addresses expenses related to actions the insured undertakes in connection with a breach. Benefits often included within first-party cyber coverage are coverage for the costs of:

Hiring professionals to assist in the investigation of, and response to, the breach.
Notifying affected persons that their information was compromised, including printing and mailing costs.
Providing credit monitoring services for affected persons.
Establishing call centers to field questions from affected persons.
Administrative safeguards, such as:
- training employees;
- establishing information portals; and
- creating security and incident response protocols.
Compensating the insured for lost income resulting from the breach.
Restoring lost data.

Third-Party Coverage

Third-party coverage protects the insured from liability to third parties allegedly resulting from a covered claim. Cyber policies may provide third-party coverage for:

Costs of regulatory defense, fines, and punitive damages.
Costs of litigation defense.
Litigation damages.

Practical Implications

All participants in the commercial real estate industry (lenders, owners, tenants, and any business that electronically stores sensitive information) should consider purchasing cyber security insurance, particularly for real estate sectors that are considered high risk.

Purchase and sale agreements, leases, and loan documents should be updated to ensure that cyber security needs are adequately addressed.

Cyber Security Insurance for Commercial Real Estate | Practical Law