Working from home and increased cyber risk – Will my insurance cover me?

Here is a typical question on this topic.

Hi Allan,

We are fielding many questions regarding employers with staff operating from home at this time, and what cover they may have. In particular Cyber – if the employer has a cyber policy does it automatically extend to the employee, whilst working from home?

Looking at the [name of insurer withheld] policy, the definition of insured includes employee whilst acting on behalf of the employer, so I am assuming it does (for the this policy anyway), however would cover also extend to the employees personal computer system (if using) where a hacker gained access to the employees personal data, bank details, cyber extortion, etc.?

Tony [surname and email provided]

In answer to your first question, in the case of this insurer, which is the one that LMI insure with, we wrote to the insurer via our broker and notified them of the potential change in our operations and how we were going about it. The word back was that our insurance would remain in place, including for those working from home.

Turning now to risk management, I would be very loath for any client to be allowing anyone to be using personal computer relating to confidential data or financial translations.

If an employee had no choice, you would need to check the machine was not already compromised and that the same level of security as at the place of employment was in place, such as fire walls and the like.

Clearly, the cyber criminals are not taking a holiday during this period and arguably we may have more out there than normal, with people losing their honest job and being stuck at home.

There are reports that cyber attacks have increased with many targeting those working from home, either with dodgy emails or apps.

One big risk is that with remote communication, phishing and whaling attacks –which are basically false emails claiming to be from the boss– to make a payment, are more likely to get through.

Everyone needs to be vigilant.

An employer needs to make sure all the data comes off the home computer at the end of all of this, as well.

As part of our Business Continuity Management Plan, we had tested working from home for some of our employees prior to COVID-19 happening.

Appreciating the potential for this to be as big as it was, we started testing working from home one department at a time. The power of a business continuity plan was that neither our CEO, Steve Manning, or I, had to think of doing this while we were in England. It started happening and we were told afterwards, that was an enormous relief to us.

We needed to purchase a couple of laptops, but there was a run on them and so we could not get our standard specification. However, what we were able to get was sufficient to allow us to put on all our cyber security stuff.

No staff is to use their own computer for LMI tasks, and certainly not banking: full stop.

If a client is doing something different to the norm, I believe the normal rules of disclosure apply and the underwriter should be advised in advance.

That way everyone knows what is going on and you do not have a fight after the event.

I hope this helps.