By Tom Hagy The various risks of doing business in our digitally connected world continue to evolve.  So must the approach organizations take in confronting those risks, for failing to do so in the current risk landscape can be far more dangerous than in prior years. I spoke with Nick Galletto, Global Cyber Risk Leader at Deloitte, who traced the evolution of the dangers of doing business in a digitally connected world. Early on, our focus in the cyber risk management space was on how to protect websites from being defaced, he explained. Organizations had to make sure websites were functioning properly, that data was secure, and the integrity was maintained. Galletto went on to say that we’ve moved from an era of compliance and risk management to an era of complexity.  From an organization’s perspective, their focus was on making sure the company was compliant with new and evolving regulations, and risk management meant having policies, procedures and effective controls in place. “While compliance [...]

For anyone plotting the evolution of cyber risks, the last phase of cyber-attacks was dominated by breaches that resulted in lost or stolen personal or financial data that could then be monetized. The current phase is different. “We have observed a significant increase in the number of disruptive breaches that our clients are dealing with,” says Charles Carmakal, Vice President at Mandiant/FireEye. “These involve destruction, extortion, or public shaming.” How are organizations dealing with this shift? “It’s catching many organizations off guard. Most don’t have a playbook for dealing with extortion,” Carmakal says. “While they may have thought about a ransomware situation, that’s different from the more common type of extortion we are seeing these days, where a threat actor threatens C-level executives or corporate board members with the release of sensitive information.” “Many organizations assume the default is they wouldn’t give into the demands, but when [...]

Is a drug company that's sued in connection with the manufacture, promotion and distribution of opioids covered by its insurer for defense costs? According to Laura A. Foggan and Michael Lee Huggins of Crowell & Moring, LLP, that determination will come down to whether, in the relevant state, an accident takes place when either the act or the injury was unintentional, or whether an accident occurred if only the act was unintentional. This definition will vary by state, Foggan and Huggins wrote in California Litigation, published by the Litigation Section of the California Bar earlier this year. South Carolina may permit coverage if "either the act or the injury was unintentional," they explained. In Liberty Mutual v. J.M. Smith, the Fourth Circuit held that if a drug company failed to identify and alert regulatory agencies of suspicious drug orders, then there may be a duty to defend. But in [...]