Cybercrime: how insurance and liability work

There are various forms of cybercrime, ranging from cyberterrorism to WhatsApp fraud. The damage is often considerable and the perpetrators all too often remain unknown. Victims therefore try to hold others liable, such as the bank or the company where the leak took place. These are all reasons why good cyber insurance is advisable. This page describes the situation in the Netherlands.

Liability for cybercrime

In liability law there is a general and fairly simple rule: anyone who makes a mistake and causes damage in doing so is liable. The cybercriminal will therefore always be liable for the damage he causes with his criminal activities. In practice, however, it is far from easy to take cybercriminals to court. They are often masters at hiding their identity, and they also operate from countries where the jurisdiction is not exactly helpful. Moreover, foreign powers are sometimes behind them. North Korea, for example, has an army of hackers, part of the military regime, who raise money for the government. And just try taking Kim Jong-un to court.

Because of all these practical problems, it is not always realistic to pursue the real perpetrators. That is why people often look at whether someone else can be liable for the cybercrime. This entails risks for anyone who works with personal data.

Liability for cyber theft

People almost always look in the direction of data liability. Companies that work with personal data in particular can simply be expected to secure their systems adequately. Not only against hackers, but also, for example, against former employees who want revenge. The owner of a computer system who leaves his digital security doors wide open can at the very least be accused of carelessness. Especially if the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) imposes a fine, which is in effect proof that a mistake was made, victims will be able to claim compensation.

The same reasoning applies to other forms of cyber theft, such as when sensitive customer data is stolen. In that case too, the customer can try to hold the IT administrator liable for inadequate security. Either way, victims will always have to show that the IT administrator took insufficient security measures.

Causal link between damage and data breach

A practical problem is proving that the damage arose as a result of carelessness. It is not easy to show that data was obtained in this specific hack, but it is certainly not impossible.

In 2020, for example, there was a data breach at Allekabels, in which the private data of more than 3.6 million people was leaked. A number of users had created a unique email address especially for their order at Allekabels, at which they were subsequently approached. If they were then defrauded, they could clearly show that the data breach at Allekabels was at the root of it. Of course, this does not mean that Allekabels is automatically liable. Data cannot automatically be expected to be 100% secure, but the data processor must provide adequate security. The size of the database and the sensitivity of the personal data are among the factors that determine the efforts that must be made. We may therefore set higher requirements for the security systems of a banking environment than for the security of a webshop like Allekabels.

Another example can be found at Booking.com. Here, a data breach had taken place on the extranet, allowing cybercriminals to make off with the data of more than 4,000 people. They were approached by someone who pretended to be from the hotel, in order to trick them out of money. Because of this method of attack, it was clear that this fraud was connected to the data breach. Booking therefore duly compensated the damage without it having to come to court. Nevertheless, the AP still imposed a fine.

Liability for cyber fraud

The Booking.com example shows that cyber theft and cyber fraud are often closely related. First, criminals try to steal personal data in order to then defraud a third party. Having personal data to hand makes them look much more trustworthy, and the victim will be persuaded more quickly. The same applies here: anyone who does not adequately secure their IT systems can be liable for the damage caused.

The same applies, however, when no mistake was necessarily made in securing the IT system, but a mistake was made in handling the data breach. Companies are obliged to report discovered data breaches to the Dutch Data Protection Authority immediately. Where appropriate, they must also warn those affected. This warning can mean that there are no victims, or fewer. However, if a company does not report the data breach and keeps it secret, it can still be liable for the damage that cybercriminals have been able to cause, even without any IT security failures.

Whaling

In whaling, someone poses as the CEO of another company in order to gain trust. This happened at Brabantia in late 2019, for example, as a result of which bol.com was defrauded of more than €700,000. Someone had broken into Brabantia's email environment and given bol.com a changed account number. Bol.com had duly paid the invoices, but into the fraudsters' account.

In the end, it came to a court case and the question was whether bol.com's payment had discharged its debt. The court ruled that bol.com had been negligent. The email from the fraudster, the so-called CEO, was full of spelling and grammar mistakes and bol.com had never verified anything. It therefore had to pay the invoices to Brabantia again, even though Brabantia was actually the one that had been hacked (ECLI:NL:RBMNE:2021:1528).

Spoofing and WhatsApp fraud

With spoofing and WhatsApp fraud, there is not always a data breach either.

In spoofing, a fraudster imitates the identity of a bank. The aim is then, for example, that their victims think they are being called by someone from the bank. The ultimate goal is to obtain the PIN and bank account details and to empty the account.

In WhatsApp fraud, you receive a message from someone who appears to be a known sender. The fraudsters pretend, for example, to be the victim's son or daughter. They pretend to be in trouble and ask for money. Once transferred, the money is gone for good.

Liability of the bank

In these cases, people often look in the direction of the bank. They then argue that the bank did not warn sufficiently about such risks or did not take measures against the fraudsters or against the bank accounts they used.

It is true that under article 7:528 of the Dutch Civil Code (Burgerlijk Wetboek, BW), the bank must refund the amount of an unauthorised payment transaction to the payer. However, when a customer has transferred the money to a WhatsApp fraudster themselves, it is an authorised payment transaction. Rulings of the Dutch Financial Services Complaints Institute (Kifid) show that the victim has to bear the loss in this case and that the bank cannot be blamed.

When the victim did not make the payment themselves, the bank can in turn invoke the victim's gross negligence. For this reason, a victim who was grossly negligent and shared their passwords themselves will almost never be able to hold the bank liable.

Only in exceptional cases is the bank held (partly) liable. This was the case, for example, with a 78-year-old woman who had already almost been defrauded several times. On two occasions, this was avoided at the last moment. The woman's daughter therefore asked the bank to set a daily limit and to block payments to unknown accounts, but the bank said that this was technically impossible. A week later, the 78-year-old woman was called by a so-called employee of an accountancy firm. This employee said that she would get money back, but that she still had to provide personal bank details. The woman saw no risk in this and passed on all her details. She eventually lost €42,351. The committee ultimately ruled that the woman had made mistakes herself, but that the bank should also have done more to protect the victim. For example, it should have warned much more forcefully about the dangers of phishing. In the end, the committee held the bank 40% liable and the bank had to pay just over €16,900 in compensation (Kifid 5 February 2021, no. 2021-0108).

Liability for cyberterrorism

There are various forms of cybercrime. Cybercriminals do not always aim to extract money or steal data. Sometimes it is more a matter of cyberterrorism, in which systems are taken down. This can seriously disrupt the operations of a business. Deadlines may not be met, deliveries arrive late and customers no longer have access to the systems.

They too can hold the IT administrator liable for the damage, provided that the IT administrator did not adequately secure his systems. However, they can also rely on the contractual relationship. Hosts, for example, often have uptime guarantees. They guarantee, for example, that the hosted website will be online 99.99% of the time. If this is then not achieved, for example because of manipulation by cybercriminals, they can hold the host to account for it. The doctrine of force majeure and the content of the general terms and conditions also play a role here.

Liability for defective products

Finally, an IT manufacturer can be liable when its product is defective. This concerns suppliers of software or hardware with defects that allow cybercriminals to cause damage. There can be a design defect as well as a manufacturing defect. A design defect is a defect in the design, such as when a medicine has side effects or when the software design left a door open for cybercriminals. A manufacturing defect is a shortcoming that belongs not to the design but to an individual product, in other words a mistake during the production process.

A hard strict liability applies to manufacturing defects. We may expect the IT product to work properly. This is different for design defects. The public may not expect 100% security. It remains possible that internet criminals can get around security measures. The manufacturer will, however, have to take security measures to an acceptable level and provide clear information about them.

The importance of good cyber insurance

Cybercrime comes in various forms. Sometimes the IT administrator will clearly be liable, and sometimes the victim will not be able to hold anyone liable. Either way, there is one constant: the real perpetrators often remain unknown and the damage is considerable. That is one of the reasons why cyber insurance is so useful.

Business cyber insurance

Business cyber insurance covers damage resulting from cybercrime. What is and is not covered differs per insurer. In general, cyber insurance covers matters such as liability for damage to others, but also your own damage. Among other things, the costs of repairing reputational damage or the costs of stolen data are reimbursed. Loss of turnover due to cybercrime is also often reimbursed. The cover can go very far, and sometimes the insurer will even simply pay extortionists. Common exclusions are damage caused by theft of trade secrets, damage caused by patent infringement and damage caused intentionally. Also bear in mind a maximum cover per claim and per year, and a possible excess.

Private cyber insurance

Cyber insurance also exists for private individuals. These cyber insurance policies focus mainly on matters such as identity fraud, cyber extortion, loss of money in an account and reputational damage. Matters such as computer help, help with repairing reputational damage and the costs of investigating the cause and extent of the incident are also covered. There is often a limited excess, and the cover per event and per year is often considerably lower. Here too, exclusions apply. One important exclusion: damage resulting from the lack of appropriate security measures. In other words, it remains necessary, for example, to install an antivirus program on your computer.