Equifax’s insurance is deemed inadequate against breach

NEW YORK: Equifax Inc’s insurance against cyber breaches is likely inadequate to cover the credit-reporting company’s costs tied to one of the biggest hacks in history, according to a source.

The company holds a policy that would probably cover US$100mil to US$150mil, with costs shared by carriers in the London market and elsewhere, said the source, who asked not to be identified discussing a private contract. Though Equifax’s eventual expense may not be known for years, it could be multiples higher than the insurance payout, given what the company has disclosed and the costs at hacking victims like Yahoo and Target Corp, it said.

“Equifax carries cybersecurity, crime, general-liability and other lines of insurance, and we have begun discussions with our carriers regarding the incident,” a spokesperson said by email Saturday.

The company has offered free credit-monitoring to victims after reporting Thursday that a breach affected 143 million people, revealing Social Security numbers, drivers license data and birth dates. The Atlanta-based company now faces multiple state and federal investigations, and a proposed multibillion-dollar class action lawsuit was filed against Equifax. In its annual report, the company addressed the limits of its insurance protection tied to cyber risks.

“Our property and business interruption insurance may not be adequate to compensate us for all losses or failures that may occur,” Equifax said in the filing. “Also, our third-party insurance coverage will vary from time to time in both type and amount depending on availability, cost and our decisions with respect to risk retention.”