Alberta Lawyers Indemnity Association (“ALIA”) is implementing universal cyber insurance for all lawyers who participate in ALIA’s mandatory indemnity program (“Subscribers”). Coverage commences December 31, 2022.
The cyber coverage policy—to be provided by a global insurer and administered by ALIA—is designed to protect Subscribers, their law firms and their clients by giving Subscribers and their law firms quick access to critical resources needed to respond to cyberattacks. It will also cover claims for network security and privacy breaches brought against Subscribers and their firms.
Subscribers and their law firms will not need to submit individual insurance applications or go through an (often onerous) application process to receive this coverage. The coverage will be provided seamlessly and automatically to all Subscribers and their law firms. The annual premium for the first 12 months will be $265 per Subscriber and will be invoiced by ALIA with the 2023–2024 annual levy payment due by June 30, 2023.
In approving the cyber coverage program, the Law Society of Alberta Benchers and ALIA’s Board recognized the importance of universal cyber coverage to protect Subscribers, their law firms and their clients. Lawyers are attractive targets to cybercriminals due to the sensitive, confidential client information stored in the computer systems they use. Cybercriminals seek to extort or steal this information through ransomware and other malware. Cyberattacks can cripple computer systems and block access to files and information, interrupting professional services and exposing client information to criminals. Attempted attacks against Subscribers and their law firms are reported to ALIA regularly, some of which are successful and none of which are covered by the ALIA Group Policy. Every other province except Quebec has implemented some form of mandatory cyber coverage.
ALIA’s research shows that, despite their support for it, many Subscribers tend not to purchase cyber coverage. Cyber insurance can be challenging to purchase, as most cyber insurers have an onerous application process, including network security requirements that can often be challenging to meet. Furthermore, due to increased losses, the cost of cyber coverage has been increasing and some insurers are hesitant to provide coverage to law firms. ALIA’s November 2021 Subscriber survey found that two-thirds of the Subscribers who responded would be interested in including cyber and/or social engineering coverage in ALIA’s indemnity program.
Without insurance, expert resources needed to manage a cyber breach can be difficult to access in an emergency. The cyber program will ensure that all Subscribers have 24/7 access to cyber expertise in the event of a security breach to help restore professional services and reduce exposure to claims for client losses. It will also provide liability coverage for claims arising from cyber incidents. The coverage includes first-party coverage for breach response costs, including cyber extortion, and third-party coverage for claims against Subscribers or their law firms for security or privacy breach. While the financial limits under the cyber coverage program are modest, universal coverage ensures that all Subscribers will have access to the critical breach response resources required to manage a cyberattack.
After many months of research, ALIA, assisted by its broker, Aon Reed Stenhouse Inc. (“Aon”), selected Zurich Insurance Company Ltd. (“Zurich”) to provide the universal cyber coverage program (the “Zurich Policy”). Zurich is one of the top insurers in Canada for cyber risk and currently underwrites cyber programs and provides 24/7 claims service. In addition, Zurich agreed to accept all Subscribers into the program without requiring an onerous application process, meaning all Subscribers and their firms will have coverage.
ALIA intends to continue the cyber program indefinitely. That said, pricing and availability of future policies will depend on the program’s loss history and the cyber coverage market. ALIA endeavours to deliver a high-quality indemnity program in which Subscribers have access to appropriate coverage at a reasonable price and over the past eight years has reduced the levy by 42 per cent. While the cyber coverage will result in a modest increase to the levy, it ensures that all Subscribers have cyber coverage and access to critical resources needed to manage a cyber breach.
Subscribers have an essential role to play in the cyber coverage program’s continuing success by ensuring they practice good “cyber hygiene” to reduce or eliminate cyberattacks. Practicing cyber hygiene includes implementing network security controls to improve online security to mitigate cyber breaches and conducting cyber security awareness training.
ALIA has arranged support for Subscribers to improve their cyber hygiene. The cyber coverage program includes access to regular cyber security seminars that ALIA will host with experts from Aon and Zurich. Topics will include education on best practices to protect Subscribers and their firm from cyberattacks.
All Subscribers must read the Cyber Coverage FAQs to understand what the cyber coverage program does and does not include. Subscribers should also review the Zurich Policy coverage and limits, which information is available to Subscribers through the Law Society of Alberta’s Lawyer Portal.
