Cyber Attack on CDK: A Case Study
The recent cyber attack against mostly car dealerships through a third party is a very good case study in how cyber attacks work and what the response is from clients, third parties, and insurance companies. The attack hit the company CDK, which provides technical platforms for new car dealerships. These platforms help manage their sales, service, and parts departments, along with paperwork, scheduling, and accounting. Since these dealerships rely on CDK, one cyber attack against this company affected 15,000 car dealerships, many of which were effectively shut down for about a week. They couldn’t sell or work on cars, and while some found workarounds using old-school pen and paper, many were just out of business.
Post-Attack Legal and Insurance Processes
Now that the cyber attack is over, CDK eventually resolved the issue. Whether they paid a ransom or handled it internally is unclear. The legal process has begun, with some dealerships now filing insurance claims for the damages and losses incurred, such as lost sales or extra overtime expenses. The success of these claims depends on what their insurance policies cover. While having cyber liability insurance is beneficial, some policies only cover individual company hacks, not third-party breaches. Additionally, business interruption insurance may not apply unless there is physical damage to the premises, which a hack typically isn’t.
The Importance of Understanding Your Insurance Coverage
It’s crucial to understand your insurance coverages, especially with the growing risk of cyber attacks. Many commercial lines insurance policies are complex, with various layers of coverages, endorsements, and exclusions. In today’s environment, the biggest risk to most companies is a cyber attack, not traditional threats like a building burning down or a hurricane. While general liability policies might include some cyber coverage, they often have limitations and exclusions. Therefore, it’s important to consider a standalone cyber liability policy, compare coverage differences, and discuss with your agent or broker what is excluded. Knowing what you are and aren’t covered for is vital, so you’re not surprised when something happens.
Evolving Risks and the Need for Adequate Coverage
Cyber liability and cyber attacks are relatively new risks, making the insurance landscape for these issues an evolving one. It’s essential to know what your responsibilities will be if there’s a loss or claim. You should decide whether it’s worth spending the money on certain coverages, as long as you’re aware of the risks you’re assuming.
