Victims get access to a licensed identity theft investigator
The opening summary says victims are given access to a licensed identity theft investigator who can give professional assistance and guide them through correcting their credit history or identity records, and says investigators can do the majority of the work required to restore an identity on the victim's behalf.
Supporting quotations
Additionally, victims are given access to a licensed identity theft investigator who can provide professional assistance and guide them through the process to correct their credit history or identity records. Investigators can do the majority of the work required to restore an identity on a victim’s behalf, providing peace of mind.
Qualifications & exceptions
The detailed policy describes the service as the Case Management Service: an identity recovery case manager assigned by the insurer to assist with communications the insurer deems necessary, with the Member's permission and cooperation. The policy also says it does not guarantee that services will end or eliminate all problems.
The Schedule shows the Case Management Service as 12 months for Surfshark One+.
Not stated here
The opening summary says "licensed identity theft investigator"; the detailed policy uses "identity recovery case manager" without stating a license requirement.
Cross-references
contrast (model-proposed): Identity recovery case manager helps with communications the insurer deems necessary — contrast: The opening summary describes investigators who can do the majority of the restoration work on the victim's behalf, while the policy defines the case manager as assisting with communications the insurer deems necessary, with the Member's permission and cooperation.
Security & Safeguards · Restriction or exception
Computing devices and connected home devices must be owned or leased and under the Member's control
A computing device is a desktop, laptop or tablet computer or a Wi-Fi router or other internet access point. A connected home device is any other electronic device that connects to the internet or other devices, including networked smart phones, thermostats, entertainment systems, appliances, smoke, fire and home security monitoring systems, and cameras. For either, the device must be owned or leased by a Member and operated under the Member's control.
Supporting quotations
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point. Such device must be owned or leased by a Member, as well as operated under the Member's control.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Smart phones;
Thermostats;
Entertainment systems;
Appliances;
Smoke, fire and home security monitoring systems; or
Cameras.
Such device must be owned or leased by a Member, as well as operated under the Member's control.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. The device definitions are used by the cyber attack, cyber extortion, fraud event and online scams definitions, and by an exclusion for devices the Member does not own, lease or control.
The connected home device list says "includes, but is not limited to".
Security & Safeguards · Context
Cyber attack and cryptojacking events are defined by device access, malware and utility overage
A cyber attack event is either unauthorized access to or use of a Member's device or system (by an unauthorized person, or by an authorized person for unauthorized purposes), or a malware attack damaging a Member's device, system or data. Malware damage does not include damage from shortcomings or mistakes in legitimate code or from code installed during manufacturing. A cryptojacking event is a cyber attack carried out to mine cryptocurrency that makes a Member incur utility bill overage expenses.
Supporting quotations
Cyber attack event means one of the following involving a computing device or connected home device:
Unauthorized Access or Use – meaning the gaining of access to a Member's device or system by an unauthorized person or persons or by an authorized person or persons for unauthorized purposes.
Malware Attack – meaning damage to a Member's device, system or data arising from malicious code, including viruses, worms, Trojans, spyware and keyloggers. This does not mean damage from shortcomings or mistakes in legitimate electronic code or damage from code installed on the Member's computer system during the manufacturing process.
Cryptojacking event means a cyber attack event carried out for the purpose of mining cryptocurrency that causes a Member to incur utility bill overage expenses.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyber Attack is among them.
Security & Safeguards · Context
Cyber extortion event and the response costs payable under it
A cyber extortion event is a demand for money or other consideration based on a credible threat to damage, disable, deny access to or disseminate content from a Member's device, system or data, or based on an offer to restore access or functionality after an attack. Cyber extortion response costs are payments made as directed in response to such an event, only when incurred as a direct result of the event and approved in advance by the insurer; the insurer may still pay unapproved costs if it determines that getting approval was not practical and it would have approved the payment if consulted.
Supporting quotations
Cyber extortion event means one of the following involving a computing device or connected home device:
A demand for money or other consideration based on a credible threat to damage, disable, deny access to or disseminate content from a Member's device, system or data; or
A demand for money or other consideration based on an offer to restore access or functionality in connection with an attack on a Member's device, system or data.
Cyber extortion response costs means any payment made as directed in response to a cyber extortion event, but only when that payment is:
Incurred as a direct result of a cyber extortion event directed against a Member; and
Approved in advance by us. However, we may pay for cyber extortion response costs that were not approved in advance by us if we determine the following:
It was not practical for the Member to obtain our prior approval; and
If consulted at the time, we would have approved the payment.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyber Extortion is among them.
The insurer decides whether prior approval was impractical and whether it would have approved.
Security & Safeguards · Context
Cyberbullying acts and the costs listed for a cyberbullying event
A cyberbullying act is harassment, intimidation, defamation, invasion of privacy, threat of violence or a similar act personally targeted at a Member and carried out wholly or partly on social media platforms. Cyberbullying costs are the listed costs that arise directly from a cyberbullying event and are incurred within 12 months after it: counseling for the victim, temporary relocation, temporary tutoring, enrollment costs at a similar alternate school (not tuition), professional cybersecurity consultation, mobile apps and monitoring software to prevent recurrence, legal expenses including content removal, and lost wages, childcare and eldercare.
Supporting quotations
Cyberbullying act means an act of harassment, intimidation, defamation, invasion of privacy, threat of violence or other similar act personally targeted towards a Member and perpetrated wholly or partially using social media platforms.
Cyberbullying costs means the following costs arising as a direct result of a cyberbullying event when incurred by a Member within 12 months after the cyberbullying event:
Costs for counseling from a licensed mental health professional for the victim of the cyberbullying event;
Temporary relocation expenses;
Temporary private tutoring;
Enrollment expenses incurred due to relocation to a similar, alternate school. This does not include tuition costs;
Professional cybersecurity consultation services;
The purchase of mobile applications, social monitoring software and web-based products when used to prevent further occurrence of cyberbullying events;
Legal expenses, including legal expenses for the removal of online content related to the cyberbullying event; and
Lost wages, childcare and eldercare expenses.
Cyberbullying event means two or more similar or related cyberbullying acts.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyberbullying is among them.
A cyberbullying event needs two or more similar or related acts and must have caused harm significant enough for the Member to report it or need treatment (defined in the next section).
Security & Safeguards · Context
A cyberbullying event needs repeated acts and significant harm
A cyberbullying event is two or more similar or related cyberbullying acts that caused harm significant enough for the Member either to report it to a school administrator or law enforcement, or to need treatment by a licensed medical or mental health practitioner who is not in the Member's immediate family. When treatment is required, the insurer reserves the right to require an independent medical exam. For this coverage the event begins on the date of the first similar or related act. A school administrator is a principal, vice principal, headmaster or dean.
Supporting quotations
Cyberbullying event means two or more similar or related cyberbullying acts. Such cyberbullying event must have caused harm significant enough for a Member to:
Report such cyberbullying event to a school administrator or law enforcement; or
Require treatment by a licensed medical or mental health practitioner who is a not a Member of the Member's immediate family. At our discretion, when such treatment is required, we reserve the right to require the Member to submit to an independent medical exam.
For the purposes of this coverage, the cyberbullying event begins on the date of the first similar or related cyberbullying act.
School administrator means a principal, vice principal, headmaster or dean.
Cyberbullying act means an act of harassment, intimidation, defamation, invasion of privacy, threat of violence or other similar act personally targeted towards a Member
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyberbullying is among them.
Security & Safeguards · Context
Data recovery costs cover a professional firm replacing lost or corrupted data, with exclusions
Data recovery costs are the costs of a professional firm hired by a Member to replace electronic data that has been lost or corrupted. They do not include costs to research, re-create or replace software programs or operating systems that are not commercially available, data that cannot reasonably be replaced (for example personal photos, movies or recordings with no electronic back-up), or data that is obsolete, unnecessary or no longer of use.
Supporting quotations
Data recovery costs
Data recovery costs means the costs of a professional firm hired by a Member to replace electronic data that has been lost or corrupted.
Data recovery costs does not mean costs to research, re-create or replace any of the following:
Software programs or operating systems that are not commercially available.
Data that cannot reasonably be replaced. This includes, but is not limited to, personal photos, movies or recordings for which no electronic back-up is available.
Data that is obsolete, unnecessary or no longer of use.
Qualifications & exceptions
This provision serves the Cyber Attack coverage, which the Schedule marks "Not Included" for Surfshark One+.
Security & Safeguards · Company commitment
Identity recovery case manager helps with communications the insurer deems necessary
An identity recovery case manager is one or more individuals assigned by the insurer to help a Member with communications the insurer deems necessary for re-establishing the integrity of the Member's personal identity. That includes, with the Member's permission and cooperation, written and telephone communications with law enforcement authorities, government agencies, credit agencies and individual creditors and businesses.
Supporting quotations
Identity recovery case manager means one or more individuals assigned by us to assist a Member with communications we deem necessary for re-establishing the integrity of the personal identity of the Member. This includes, with the permission and cooperation of the Member, written and telephone communications with law enforcement authorities, governmental agencies, credit agencies and individual creditors and businesses.
Qualifications & exceptions
This is the service behind the Case Management Service coverage, which the Schedule includes for 12 months. The insurer decides which communications it deems necessary, and the Member must give permission and cooperate.
The policy also says services depend on the Member's cooperation and are not guaranteed to end or eliminate all problems.
Security & Safeguards · Context
An identity theft event is the fraudulent use of a Social Security number or other personal information
An identity theft event is the fraudulent use of a Social Security number or other personally identifying information, including fraudulently using such information to establish credit accounts, secure loans, enter into contracts or commit crimes.
Supporting quotations
Identity theft event means the fraudulent use of social security number or other personally identifying information. This includes fraudulently using such information to establish credit accounts, secure loans, enter into contracts or commit crimes.
Qualifications & exceptions
Identity Theft Recovery applies only if the identity theft event is a direct result of a stolen identity event discovered and reported as the coverage requirements say.
Stolen identity event: theft or release of a Member's personal information
A stolen identity event is the theft, accidental release, publication or misappropriation of a Member's personally identifying information that results in, or could reasonably result in, wrongful use of the information. It includes a cyber attack, cyberbullying, cyber extortion, fraud, home title fraud, data breach or identity theft event, but only to the extent that the corresponding coverages are included in the insured program.
Supporting quotations
Stolen identity event means the theft, accidental release, publication or misappropriation of a Member’s personally identifying information that results in or could reasonably result in the wrongful use of the information.
This includes a cyber attack event, cyberbullying event, cyber extortion event, fraud event, home title fraud event, data breach event or identity theft event, but only to the extent that such corresponding coverages are included in the insured program.
Insured program means the package of products and/or services provided by the provider and shown under the Insured Programs section of the Schedule of this Summary of Benefits.
Personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of a Member.
Qualifications & exceptions
The Schedule includes only Case Management Service and Identity Theft Recovery (with the listed sublimits) for Surfshark One+; the other listed event types are marked "Not Included". The definition covers events that "could reasonably result" in wrongful use, not only completed misuse.
Cross-references
narrows (model-proposed): Cyberbullying coverage reimburses necessary and reasonable cyberbullying costs — narrows: The stolen identity event definition counts the listed event types only to the extent the corresponding coverage is included in the insured program, and the Schedule marks this coverage "Not Included" for Surfshark One+.
narrows (model-proposed): Home Title Fraud coverage pays reasonable and necessary home title fraud costs — narrows: The stolen identity event definition counts the listed event types only to the extent the corresponding coverage is included in the insured program, and the Schedule marks this coverage "Not Included" for Surfshark One+.
narrows (model-proposed): Data Breach coverage pays reasonable and necessary data breach costs — narrows: The stolen identity event definition counts the listed event types only to the extent the corresponding coverage is included in the insured program, and the Schedule marks this coverage "Not Included" for Surfshark One+.
Security & Safeguards · Restriction or exception
System restoration costs cover professional restoration of a device, not hardware, upgrades or the Member's own time
System restoration costs are the costs of a professional firm hired by a Member to restore a computing device or connected home device to its functionality before a cyber attack event: replacing or reinstalling software, removing malicious code, and configuring or correcting configuration. They do not include costs to repair or replace hardware (though the insurer may choose to pay for it if that reduces the loss payable), costs to increase speed, capacity or utility, the Member's time or labor, or costs above the replacement value of the Member's system.
Supporting quotations
System restoration costs means the costs of a professional firm hired by a Member to do the following in order to restore the Member's computing device or connected home device to the level of functionality it had before the cyber attack event:
Replace or reinstall computer software programs;
Remove any malicious code; and
Configure or correct the configuration of the Member's device or system.
Costs to repair or replace hardware. However, we may choose to pay to repair or replace hardware if doing so reduces the amount of loss payable under the policy.
Costs to increase the speed, capacity or utility of the Member's device or system.
The Member's time or labor.
Any costs in excess of the replacement value of the Member's system, including applicable hardware and software.
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Qualifications & exceptions
This serves the Cyber Attack coverage, which the Schedule marks "Not Included" for Surfshark One+.
Security & Safeguards · Company commitment
Case Management Service provides an identity recovery case manager as needed
If the coverage requirements are met, the insurer provides the Member the services of an identity recovery case manager as needed to respond to the stolen identity event. The Schedule shows this service for 12 months for Surfshark One+ and the Case Management Service and Identity Theft Recovery coverages are not subject to a deductible.
Supporting quotations
If all of the conditions listed above in 1. COVERAGE REQUIREMENTS have been met, then we will provide the Member the following coverages for loss directly arising from such stolen identity event.
Case Management Service
We will provide the services of an identity recovery case manager as needed to respond to the stolen identity event.
Identity recovery case manager means one or more individuals assigned by us to assist a Member with communications we deem necessary for re-establishing the integrity of the personal identity of the Member.
Qualifications & exceptions
The coverage applies to loss "directly arising from" the stolen identity event and only after the requirements are met. The insurer may also provide the service before determining that a covered event occurred, without admitting liability (see the conditions).
Security & Safeguards · Company commitment
Cyber Attack coverage: data recovery, system restoration, cryptojacking and future loss avoidance
If a cyber attack event occurs as a direct result of a stolen identity event, the policy summary describes four payments: necessary and reasonable data recovery costs, system restoration costs, utility bill overage expenses for cryptojacking, and future loss avoidance costs. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Cyber Attack
If there has been a cyber attack event as a direct result of such stolen identity event, then we will provide the Member the following coverages for loss directly arising from such cyber attack event:
We will pay the Member's necessary and reasonable data recovery costs.
We will pay the Member's necessary and reasonable system restoration costs.
We will pay the Member's necessary and reasonable utility bill overage expenses.
We will pay the Member's necessary and reasonable future loss avoidance costs.
Cryptojacking event means a cyber attack event carried out for the purpose of mining cryptocurrency that causes a Member to incur utility bill overage expenses.
Cyber attack event means one of the following involving a computing device or connected home device:
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. The text is printed in the summary, but for this program the Schedule says the coverage is not included.
Security & Safeguards · Company commitment
Cyber Extortion coverage: expert assistance and reimbursement of response costs
If a cyber extortion event occurs as a direct result of a stolen identity event, the policy summary describes professional assistance from a subject matter expert provided by the insurer on how to respond to the threat, and reimbursement of the Member's necessary and reasonable cyber extortion response costs. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Cyber Extortion
If there has been a cyber extortion event as a direct result of such stolen identity event, then we will provide the Member the following coverages for loss directly arising from such cyber extortion event:
Professional assistance from a subject matter expert provided by us for advice and consultation regarding how best to respond to the threat.
Reimbursement of the Member's necessary and reasonable cyber extortion response costs.
Cyber extortion event means one of the following involving a computing device or connected home device:
Cyber extortion response costs means any payment made as directed in response to a cyber extortion event, but only when that payment is:
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. Response costs are payable only when approved in advance, subject to the exception in the definition.
Security & Safeguards · Company commitment
Cyberbullying coverage reimburses necessary and reasonable cyberbullying costs
If a cyberbullying event happens as a direct result of a stolen identity event, the policy summary describes reimbursement of the Member's necessary and reasonable cyberbullying costs, which are the listed costs incurred within 12 months after the event. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Cyberbullying
If there has been a cyberbullying event as a direct result of such stolen identity event, then we will provide reimbursement for the Member's necessary and reasonable cyberbullying costs.
Cyberbullying costs means the following costs arising as a direct result of a cyberbullying event when incurred by a Member within 12 months after the cyberbullying event:
Cyberbullying event means two or more similar or related cyberbullying acts.
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Security & Safeguards · Restriction or exception
Members must avoid divulging the existence of Cyber Extortion coverage
For Cyber Extortion coverage, Members must make every reasonable effort to avoid divulging the existence of the coverage. Cyber Extortion is marked "Not Included" for Surfshark One+.
Supporting quotations
With respect to Cyber Extortion coverage, Members must make every reasonable effort to avoid divulging the existence of this coverage.
Qualifications & exceptions
The Schedule marks Cyber Extortion "Not Included" for Surfshark One+.
Security & Safeguards · Restriction or exception
Members must use due diligence to prevent and mitigate covered costs
Members must agree to use due diligence to prevent and mitigate costs covered under the policy, including complying with reasonable and widely practiced steps for providing and maintaining appropriate system and data security and for maintaining and updating backups of electronic data at appropriate intervals.
Supporting quotations
Members must agree to use due diligence to prevent and mitigate costs covered under the policy. This includes, but is not limited to, complying with reasonable and widely-practiced steps for:
Providing and maintaining appropriate system and data security; and
Maintaining and updating at appropriate intervals backups of electronic data.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The list is introduced with "includes, but is not limited to", so the due diligence duty is broader than the two steps named.
Not stated here
The document does not say what happens to a claim if a Member did not take these steps, other than the general duties after loss.