A wrong answer can give your carrier grounds to dispute a claim or try to rescind the policy, which means treating it as if it was never issued. Whether that succeeds depends on your policy, your state and how much the wrong answer mattered.
The case every owner should know
In July 2022, Travelers asked a federal court to rescind a cyber policy it had issued to International Control Services after a ransomware attack. Travelers alleged the company had misrepresented how far it used multifactor authentication, and that MFA protected its firewall but not a server. In August 2022, the company agreed to let the court rescind the policy, according to Lockton's summary of the case.
The case ended by agreement, so it doesn't set a rule for everyone. It does show how a single MFA answer can become the center of a dispute after an attack.
What a carrier generally has to show
According to attorneys at Miller Nash, in most states an insurer seeking rescission must prove three things:
- You misstated or left out information
- The information was material, meaning it could have affected whether or how the carrier covered you, or what it charged
- The carrier relied on the incorrect information
Does an honest mistake count?
It can. The same article explains that some states require an intent to deceive and others don't. Don't assume "we didn't mean it" will protect you.
What to do if you think an answer is wrong
- Don't ignore it, and don't wait for your next renewal.
- Find out what's actually true and document it.
- Close the gap if you can.
- Talk to your broker and your attorney about whether and how to correct the answer.
How to avoid it next time
Involve the people who actually run your systems, and tie every answer to evidence before anyone signs. Here's how to prove your Cyber Insurance Renewal answers are true.
This is general information, not legal or insurance advice. Laws vary by state and outcomes depend on your policy, so talk to your attorney and broker about your situation.
Not sure your answers would hold up?
Cyber Insurance Renewal Readiness makes sure the controls behind your answers actually exist, before the underwriter looks.
See Cyber Insurance Renewal Readiness