For anyone plotting the evolution of cyber risks, the last phase of cyber-attacks was dominated by breaches that resulted in lost or stolen personal or financial data that could then be monetized. The current phase is different. “We have observed a significant increase in the number of disruptive breaches that our clients are dealing with,” says Charles Carmakal, Vice President at Mandiant/FireEye. “These involve destruction, extortion, or public shaming.” How are organizations dealing with this shift? “It’s catching many organizations off guard. Most don’t have a playbook for dealing with extortion,” Carmakal says. “While they may have thought about a ransomware situation, that’s different from the more common type of extortion we are seeing these days, where a threat actor threatens C-level executives or corporate board members with the release of sensitive information.” “Many organizations assume the default is they wouldn’t give into the demands, but when in the middle of a crisis too often the decision is made to pay the threat actors,” he says. “So it’s important to consider what your organization will do in this situation. For example, who will be involved in the decision-making process? Organizations should play out an extortion scenario so they have a plan when faced with real demands.” How can organizations better test the efficacy of their security capabilities? Many organizations conduct penetration testing [...]

Is a drug company that's sued in connection with the manufacture, promotion and distribution of opioids covered by its insurer for defense costs? According to Laura A. Foggan and Michael Lee Huggins of Crowell & Moring, LLP, that determination will come down to whether, in the relevant state, an accident takes place when either the act or the injury was unintentional, or whether an accident occurred if only the act was unintentional. This definition will vary by state, Foggan and Huggins wrote in California Litigation, published by the Litigation Section of the California Bar earlier this year. South Carolina may permit coverage if "either the act or the injury was unintentional," they explained. In Liberty Mutual v. J.M. Smith, the Fourth Circuit held that if a drug company failed to identify and alert regulatory agencies of suspicious drug orders, then there may be a duty to defend. But in California, the Crowell & Moring attorneys wrote, with that state's definition of "accident" a state appellate court in Travelers v. Actavis held that a "deliberate act is not an accident, even if the injury is unintentional, unless the injury was produced by an additional, unexpected, independent, and unforeseen happening." In that case drug company Actavis allegedly engaged in deceptive marketing in order to sell more opioids and reap more profits. According to Foggan and Huggins, the [...]