Adding Insult to Injury: Is There Coverage for a Data Breach or Hacking Event that Causes Physical Damage?

If you have turned on a television recently, you have likely seen advertisements for Wi-Fi-networked appliances and devices such as refrigerators or thermostats. While these devices represent a giant leap in consumer convenience, it is not difficult to imagine hackers ex-ploiting a security vulnerability in such a device to access consumers’ personal information. Under most cybersecurity insurance policies, the manufacturer of such a device would be covered for most of the costs as- sociated with such a breach.

However, this soaring level of internet connectivity also poses a risk of physical damage to property or bodily injury as a result of a breach—a risk far less likely to be covered under a cybersecurity insurance policy. For example, a hacker could access a web-connected appliance and potentially disable its temperature controls, overheat the appliance and cause a fire, or exploit a vulnerability in a driverless car’s control system, take control of the car and crash it. The idea of hacking into web connected devices, cars, or even medical devices is not mere speculation—it has already happened.