Kelly Castriotta, Esq.

Check out the Important update from the DFS on cybersecurity risks related to AI! While this letter specifically targets the financial industry, the potential impact of AI-driven threats stretches far beyond finance, affecting nearly every sector. AI is a game-changer in both defending against and executing cyberattacks. The DFS urges businesses to integrate AI risk management into their cybersecurity programs, enhance governance, and monitor for AI-driven risks. This is a crucial topic for all of us to consider, as cyber resilience will be key in the coming years. #CyberSecurity #AIrisks #DFSUpdate #BusinessProtection #AICyberThreats #RiskManagement #FutureOfAI #BusinessOwners #TechResilience #CyberResilience #AIinBusiness #CyberThreatPreparedness #IndustryInsight https://lnkd.in/ejaGMXKn

2

TRACKING TROUBLES. A recent order by the Federal Trade Commission imposes stiff penalties on a software provider that played fast and loose with customer data. In this episode, David provides an overview of the #FTC's enforcement action, and discusses the importance of policy wording. THE CYBER INSURANCE IMPERATIVE with David Finz. Season 6: Episode 1 Listen on Spotify: https://lnkd.in/ecmb4JpQ Listen on Apple Podcasts: https://lnkd.in/etPtbiXH SUPPORT THIS PODCAST! Follow me on Spotify to get updates of new content. #DataPrivacy #DataProtection #PrivacyLaw #CyberInsurance #TheMoreRewardingWay

5

Good news in the Cyber Insurance Market: Abundant capacity, favorable rate decreases, and broad terms and conditions, as reported by a leading wholesale broker. Stay informed: [Link to article] #CyberInsurance #InsuranceMarket #RiskManagement

4

Cyber Insurance is more important that ever. Every business has an exposure. Reach out if you would like more information on this important coverage.

4

👀 🚨 Fraud… The Problem Too Big To Handle? 🔔 💰 My best friend from high school has the distinction of having prosecuted the largest espionage case (based on digital data) in the history of The Department of The Navy - roughly 10 terabytes of digital data – think Library of Congress digitized. As my friend says, “I had a 100% conviction or death rate.” Later he spent time as a special investigator digging into insurance and Medicare fraud. Those stories are frustrating and are a nice lead into my anecdotal experience. I have been involved in detecting and delivering information to multiple Attorneys General, multiple Department of Insurance Fraud Units, the National Insurance Crime Bureau, and indirectly the FBI. When you review the FBI website, their estimate related to Insurance Fraud (excluding Health Insurance Fraud) runs $40,000,000,000+ each year, costing families $400 - $700 per year in premiums - https://lnkd.in/gDn4kJ3r. For the record, I think this number is conservative. What’s the point? When you are regularly in contact with Attorney General Offices and DOI Fraud Units, what you find is that resources are so lacking that obvious fraud is not pursued more often than it is pursued. It isn’t a lack of want but a lack of resources. Many matters with a 99% likelihood of success of prosecution will often not be pursued as DOI Fraud Units and State Police cannot keep up with matters that have a likelihood of 100% success. I recently brought a single matter to the attention of 2 different Departments of Insurance Fraud Units. The documented issues are into the millions. While fraud is clear, the authorities needed the needle to move from 99.9% to 100%. So back to the drawing board I went to close the .01% gap. (To be continued). When you’re frustrated with your inventory versus your capacity, I assure you those pursuing fraud have you beat. You’re in good company.   Have a great weekend!

11

8 Comments

Do you know about the Illinois Biometric Information Privacy Act (BIPA)? Learn about the national impact on manufacturers and what you need to do to ensure compliance Marsh McLennan Agency's latest blog. #ManufacturingIndustry #Privacy #Data #MarshMMA

2

Lloyd’s recent report, "Components of a Major Cyber Event," provides a robust framework for analyzing the factors that define and shape major cyber incidents. Interesting read.

8

🚨 Information on the CMS Proposed Ruling for the 2026 Plan Year 🚨 This 278-page document holds several implications for our industry, and here are the highlights: 1️⃣ Combatting Fraud: CMS is looking to expand its authority to quickly suspend and terminate bad actors, ensuring faster action against provable fraud. 2️⃣ Model Consent Form Expansion: A revamped model consent form will provide agents with clearer guidelines on what requires client consent—this is a win for transparency and compliance! 3️⃣ Grace Period Updates: Clients with monthly payments under $5 or a small percentage of their premium will not enter the grace period, preventing unnecessary cancellations for minor payment issues. 4️⃣ User Fee Adjustment: The proposal aims to increase the user fee from 2% to 2.5%, which supports CMS and federal marketplace operations. This also highlights the incentive for state-based exchanges. 5️⃣ Validation of Special Enrollment Period (SEP) Documentation: Starting January 2025, CMS will validate SEP documents for loss of coverage, addressing a longstanding need in our marketplace. 6️⃣ Duplicate Application Checks: To clean up the market, CMS plans to implement upfront duplicate application checks, reducing instances of bad actors submitting multiple applications. 🔔 Important Reminder: Ensure your FFM certification is completed by October 23rd to avoid being shut out of the marketplace! Your voice matters! I encourage you to review the proposed ruling and submit your comments on the Federal Register if you have concerns. Wishing you all a successful open enrollment period! Let’s navigate these changes together, and be a part of changing OUR industry for the better! #HealthInsurance #ACA #CMS #OpenEnrollment

48

1 Comment

AI is clearly being taken seriously at a broader level. 7 states adopt #AI rules for insurers to follow https://ow.ly/ignh30sBvBE

7

As AI tools become a part of everyday life for individuals and businesses, concerns over AI safety, bias and other risks will multiply. Hear more from Beth Diamond, Group Chief Claims and Litigation Officer and Melissa Collins, Claims Focus Group Leader for Third Party Liability Cyber & Tech at Beazley. #GenerativeAI #Beazley #Insurance #BusinessRisk

10

💻 Billions in Damages from CrowdStrike Outage Expected to Go Uninsured The recent global tech outage caused by a defective software update from cybersecurity firm CrowdStrike may result in billions of dollars in economic damages. Unfortunately, much of this loss is expected to go uninsured. While the event has disrupted industries from travel to finance, many businesses may find themselves unprotected due to the specific limitations in their commercial and cyber insurance policies. For companies without specific business interruption or cyber insurance coverage, this incident is a wake-up call to reassess their risk management strategies. Experts emphasize the need for businesses to evaluate their policies to ensure they are adequately prepared for future disruptions. Are your clients properly protected from similar cyber events? #CyberRisk #BusinessInterruption #InsuranceIndustry #CrowdStrike #CyberInsurance #RiskManagement https://loom.ly/WdQRIGE https://loom.ly/TRDCPE0

9

1 Comment

WHAT'S AHEAD FOR CYBER CLAIMS? In this episode, David identifies three trends to watch for in the world of cyber #Claims in the coming year, touching upon regulatory actions, dependent business interruption, and the thorny issue of insurers alleging misrepresentation in the renewal application as a basis for denying #Coverage. THE CYBER INSURANCE IMPERATIVE with David Finz. Season 6: Episode 16 Watch and listen on Spotify: https://lnkd.in/eKcrNF4F Listen on Apple Podcasts (audio only): https://lnkd.in/eFmkdUDz SUPPORT THIS PODCAST! Follow on Spotify to stay up to date with new content! #PrivacyLaw #TPRM #CyberInsurance #TheMoreRewardingWay

8

Coalition, Inc. just released their 2024 Cyber Claims Report, which details emerging cyber trends and the impact on their cyber policyholders in 2023. Ransomware grabs the spotlight. And understandably so. But there are certainly other significant cyber threats that businesses need to be aware of. Key Finding: Cyber claims originate in the email inbox - More than half of all cyber insurance claims (56%!) were the result of Funds Transfer Fraud or Business Email Compromise that originated in the email inbox. Email has proven to be an easy place for attackers to discover payment info and potentially intervene in payment processes to steal funds,” said Robert Jones, Coalition’s Head of Global Claims. Why is this important? Funds Transfer Fraud and Business Email Compromise will remain persistent threats since they’re relatively easy to execute for cybercriminals. Both can cause significant damage to businesses. The average loss from a Funds Transfer Fraud incident is more than $278,000. A well-structured cyber insurance policy can help businesses recover from these cyber threats. Cyber insurance extends far beyond addressing ransomware incidents. Cyber insurance isn't a replacement for strong network security. But in the event of a cyber breach, a comprehensive cyber insurance policy can help businesses protect their data, their network, their bank accounts & their reputation. #cyberinsurance #cyberattack #cybercrime https://lnkd.in/efS37rA5

11

The stakes have never been higher for those on the front lines of cybersecurity incidents. Recent developments in the regulatory landscape have put CISOs at risk of facing significant personal civil and criminal liability for their handling of data breaches and associated disclosures. 😱 The U.S. Securities and Exchange Commission made waves when it charged software company SolarWinds Corporation and its CISO, @Timothy G. Brown, with fraud and internal control failures related to cybersecurity risks and vulnerabilities. This marked the first time the Commission has charged a CISO, seeking substantial monetary penalties and a permanent ban on Brown's ability to serve as an officer or director in any public company. 💰 But that's not all – new cybersecurity rules by the SEC and regulations by the New York State Department of Financial Services Services (NYDFS) suggest that CISOs could face further breach-related enforcement actions. The SEC's cybersecurity disclosure rules, effective as of December 2023, oblige regulated companies and their CISOs to make timely disclosures about material cybersecurity incidents and risk management programs. 📋 Meanwhile, the NYDFS appears to be targeting CISOs in their personal capacity for company-wide cybersecurity failures. One key provision in their recently amended Cybersecurity Regulations requires CISOs of covered entities to submit an annual certification of compliance, putting their conduct under scrutiny. 🔍 So, what can companies do to protect their CISOs and other cybersecurity executives? The article suggests several best practices, including: 1. Establishing clear reporting lines and decision-making protocols 📊 2. Maintaining a robust cybersecurity framework 🔒 3. Developing and testing an incident response plan 🚨 4. Staying on top of legal and regulatory obligations 📜 5. Implementing a detailed record-keeping protocol 📝 6. Promoting a strong CISO/legal counsel relationship 🤝 7. Fostering a culture of ethical conduct and transparency 🌟 8. Securing adequate cybersecurity insurance 🛡️ 9. Providing sufficient resources, including continuing education 📚 By adopting these practices, companies can demonstrate their commitment to cybersecurity and significantly reduce the potential for personal liability among their CISOs and other key stakeholders. I'm curious to hear your thoughts on this evolving landscape. How is your organization addressing the growing personal liability risks faced by CISOs? What strategies have you found effective in navigating this complex regulatory environment? 🤔 #CyberSecurity #CISO #PersonalLiability #RiskManagement

4

A compromised reputation caused by a cyber event can swiftly erode stakeholder trust, leading to tangible, adverse effects on an organization. As we kick off Cyber Security Awareness Month, we're focusing on helping organizations build sustained cyber resilience and mitigate against the cyber risks they face today. Discover our 2024 Client Trends Report to learn what the key — and in many ways, interconnected — technology trends impacting businesses are today, and how to take advantage of them to navigate change: https://aon.io/3QjfJdG #ClientTrendsReport #ReputationRisk #CyberResilience #CyberSecurityAwarenessMonth

12

It'll be interesting to see what BI / Contingent BI claims start coming in as a result of the Microsoft / Crowdstrike outage. It has been emphasized that it was not a cyber attack or security failure. Will it then fall under coverages for system failure? Watch this space! #businessinterruption #cyberbi

19

2 Comments

👀Watch out for Maine #Privacy- with a surprising reversal on data collection opt in/opt out trends… #privacylaw #stateprivacy Someone start the #stateprivacylaw countdown.

9

This week our office issued a technical assistance advisory to insurers on the use of Artificial Intelligence (AI) in their insurance practices. It draws from the guidance the National Association of Insurance Commissioners (NAIC) adopted on AI for insurers in 2023. The TAA reminds insurers that decisions or actions impacting consumers made or supported by advanced analytical and computational technologies, including AI, must comply with all applicable insurance laws and regulations. This includes laws that address unfair trade practices and discrimination. The TAA also includes what the office considers best practices for AI use and the information and documentation that his office may request from an insurer. “Artificial Intelligence is transforming the insurance industry and how companies are doing business,” said Kreidler. “While I support innovation and the use of AI that contributes to safe and stable insurance markets, this technology may place consumers at risk for unfair, discriminatory practices. I expect insurers to minimize these risks and do right by the consumer.” #AI #Insurance #consumerprotection #fairtradepractices #computationaltechnology #artificialintelligence #NAIC #insurancetechnology #insurers #discrimination #insurancemarket #analytics

6