The Travelers vs. ICS Cyber Insurance Case: What Happened
As the financial leader of an organization, you’ve likely always trusted in predictability. Numbers do not deceive – they simply exist, telling their story with stark honesty.
But what happens when the variables are as unpredictable as a cyber attack or a compliance misstep? Imagine, for a moment, the delicate network of our systems, each aspect reliant on the other to stay functional. Now, picture one small, overlooked error – a missed digit, an unchecked box.
This 2022 case with Travelers Insurance and ICS struck a far-reaching chord with both large and small businesses, showing how one “yes” answer on the cyber insurance application caused a cascading impact culminating in not only a denied claim, but a lawsuit and a recission of the entire cyber insurance policy.
Today’s fact: cyber insurers lost money until they changed three things: their application questions, their compliance requirements, and the scrutiny they put on the first two in the event of claim. These industry-wide changes reflect broader cyber insurance coverage concerns that every organization should understand.
Guess which one bit Travelers Insurance?
Why Accuracy in Cyber Insurance Applications Is Non-Negotiable
The courtroom drama revolving around the Travelers/ICS matter reveals a simple yet daunting truth: accuracy is paramount when dealing with cyber insurance.
Here lies the paradox – while your team may believe the answers they’re providing in the initial cyber insurance application or the renewal process are accurate, the finer details of your cyber defenses demand thorough inspection, as that is where the true risks lurk. This is especially true when it comes to MSP boundaries that leave compliance gaps exposed – areas your IT provider may never flag because they fall outside the scope of what they’re contracted to cover.
The most critical piece is this: what your company SAYS is true when the initial or renewal application is filled out must REMAIN true for the life of the policy, and you must be able to PROVE your compliance on demand as long as the policy remains in force. That proof requirement puts the spotlight squarely on IT provider accountability and MFA proof gaps – areas where many organizations discover, too late, that their vendor’s assurances don’t hold up under scrutiny.
And, if you have a cyber insurance claim, the very most critical piece is the PROOF piece. Navigating this complex landscape requires comprehensive claims guidance to avoid common pitfalls.
The MFA Compliance Failure That Cost ICS Everything
Travelers said they had multi-factor authentication in place for all critical systems. This was an inaccurate answer, and Travelers could not prove their compliance. This turned out to be a huge error with significant long-ranging financial impacts.
How Ongoing Cyber Compliance Checks Protect Your Coverage
Reflecting on the ICS ordeal, a question surfaces: how prepared are we, truly? The challenge lies not just in implementing policies but in ensuring procedural fidelity. Could regular checks and balances provide that coveted peace of mind?
What strategies can we employ to enhance not only the accuracy of our applications but the resilience of our systems?
What if our cyber defenses included a methodology in which we consistently and regularly measure the internal policies against our cyber insurance requirements? This matters more than ever when you consider the hidden data risks that void your cyber coverage—risks that often emerge from everyday tools your team is already using.
This is precisely the kind of CFO compliance responsibility that extends beyond traditional IT oversight – especially as AI adoption introduces new, often unmonitored variables into the compliance equation.
This question is especially urgent as AI tools proliferate inside organizations – how undisclosed AI use creates misrepresentation risk is a growing blind spot that CFOs cannot afford to ignore.
What if we could easily adapt to new threats, requirements changes, and real-world scenarios through our ongoing checks and balances?
Beyond the Surface: Getting and Keeping Your Coverage
We’ve seen it happen: well-meaning insurance advisors suggesting that “yes” is the right answer to every question asked in the cyber insurance application process.
Not so.
The right answer is the true answer; otherwise you risk being denied coverage due to the dreaded phrase that Travelers heard too many times: material misrepresentation. The finding was that their assertion they had MFA in place was a material misrepresentation that made it possible for Travelers to definitively deny their claim.
When the True Answer Costs More: Evaluating Your Risk
If the accurate answer will cause your premium to be higher, then you’ll need to evaluate whether that higher price is worth paying versus the cost of implementing the policies and procedures, or the technological solution, or both, including an evaluation of the potential cost if you are the victim of a cyber attack. This strategic evaluation is precisely where CFO cyber leadership in Zero Trust becomes essential for making informed risk-based decisions.
In most cases, the cost of implementing a cybersecurity solution will be far less than the cost of self-funding recovery from a cyber attack.
In ALL cases, understanding any skills gaps that exist between your internal IT support and any external IT services providers is absolutely critical. Ensuring you have the right mix of skills supporting your organization could keep something like this from happening to you.
Case Timeline: How Travelers Filed and Won Against ICS in 2022
Here’s what happened: On July 6, 2022, Travelers Property Casualty Company of America filed a complaint in federal court for rescission and declaratory relief against its insured, International Control Services, Inc. (ICS). On August 26, 2022, the lawsuit was dismissed, with judgment entered in favor of Travelers, after ICS agreed to allow the court to issue a judgment rescinding the policy.
The Outcome: Policy Rescission and Full Financial Liability
In other words, ICS ended up with no cyber insurance policy and 100% on the hook to pay every cost associated with recovery from their ransomware attack.
All because they allegedly “materially misrepresented” the extent to which they had implemented multi-factor authentication.
You can find more details on this case in an excellent post by Lockton.
Inviting Reflection and Action
As you think about your cyber insurance status, and the need to not only remain in compliance but to be able to prove that you’ve remained in compliance, consider aligning your business with an outside third party – an IT services provider with a depth of knowledge and capability about cybersecurity.
This partnership becomes even more effective when combined with cybersecurity guardrails for business leaders that ensure strategic oversight and accountability.
Choosing the Right IT Partner for Cyber Insurance Compliance
Do your due diligence, however, when selecting an outside partner. While such a relationship can help you navigate the increasingly complex waters and be an asset to you should you ever have a challenge to your insurability, not asking the right questions can lead to a less-than-productive partnership.
This case study highlights that continuously monitoring and ensuring that all security measures are properly implemented is a crucial piece of your organization’s resilience planning – and that failure to do these things can quickly poke a large vulnerability in your operational resilience framework.
Frequently Asked Questions
What is material misrepresentation in cyber insurance and what happens if you're found guilty of it?
The finding was that their assertion they had MFA in place was a material misrepresentation that made it possible for Travelers to definitively deny their claim. ICS ended up with no cyber insurance policy and 100% on the hook to pay every cost associated with recovery from their ransomware attack.
What happened in the Travelers vs. ICS cyber insurance lawsuit?
On July 6, 2022, Travelers Property Casualty Company of America filed a complaint in federal court for rescission and declaratory relief against its insured, International Control Services, Inc. (ICS). On August 26, 2022, the lawsuit was dismissed, with judgment entered in favor of Travelers, after ICS agreed to allow the court to issue a judgment rescinding the policy.
How can a company protect its cyber insurance coverage and avoid having a claim denied?
What your company SAYS is true when the initial or renewal application is filled out must REMAIN true for the life of the policy, and you must be able to PROVE your compliance on demand as long as the policy remains in force. What if our cyber defenses included a methodology in which we consistently and regularly measure the internal policies against our cyber insurance requirements?