A lawsuit between restaurant chain P.F. Chang's China Bistro Inc. and its insurance company, Travelers Indemnity Co. of Connecticut, could further define how much, if any, cyber liability coverage is included in a company's commercial general liability (CGL) policy. Whatever the outcome, companies that want to be sure they are protected against cyber-related losses may have to purchase separate cyber liability policies-and make sure those policies are broad enough to encompass the myriad ways an attack could cost the firm money, said Collin Hite, partner and leader of the insurance recovery group at law firm Hirschler Fleischer.P.F. Chang's in June confirmed it was a victim of a data breach that resulted in customer credit card and debit card information being compromised. The company filed a claim with Travelers under its CGL policy to seek payment of damages, according to the lawsuit filed by Travelers on Oct. 2 in U.S. District Court in Connecticut. Travelers earlier this month asked a federal court to rule the insurer isn't liable to pay damages because the CGL policy it sold to P.F. Chang's doesn't include losses from data breaches. P.F. Chang's is facing several class-action lawsuits as a result of the breach.
Travelers alleges the restaurant has cyber liability in a different policy it didn't sell to the chain. P.F. Chang's didn't respond to a request for comment. Insurers such as Travelers are looking for a court case to further give credence to what they have been trying to do with customers, which is to get them to buy separate cyber policies in addition to whatever coverages they already buy, Mr. Hite said. The upshot is policyholders relying on commercial general liability for cyber coverage are using a "bad risk management technique" and should initiate a thorough review of their policies to see what cyber events are covered and which aren't, he said. "Too many companies large and small have been trying to rely on traditional insurance and mistakenly believing it was going to cover these kind of losses," he said. "It's time from the policyholder side that risk managers wake up and make sure if there is a gap it is being addressed."