Charges & Financial Obligations · Company commitment
Identity theft recovery: reimbursement up to $1,000,000 for restoration expenses
The opening benefits summary says that victims of identity theft can be reimbursed for expenses they incur restoring their identity, up to $1,000,000, and lists credit bureau reports, replacement of documents, application fees, notaries and postage, and legal fees necessary to undo the negative effects of the identity theft among the eligible expenses. It points the reader to the Summary of Benefits that follows for details, so the headline list is a short description, not the full set of conditions.
Supporting quotations
Victims of an identity theft can get reimbursed for expenses incurred in the process of restoring their identity, up to $1,000,000. Eligible expenses include:
Credit bureau reports
Replacement of documents, application fees, notaries, postage
Legal fees necessary to undo the negative effects of the identity theft
Please review the following Summary of Benefits for additional details on your Identity Protection Benefits.
Qualifications & exceptions
The later definitions limit identity theft costs to reasonable and necessary costs incurred as a result of an identity theft event, and several exclusions, conditions and the coverage requirements (discovery during the policy period, report within 60 days) apply to every payment.
The Schedule shows the $1,000,000 Identity Theft Recovery limit for the Surfshark One+ insured program and also a $1,000,000 Member Annual Aggregate Limit.
Not stated here
This marketing-style summary does not state the deductible position, the reporting deadline or the exclusions; those appear only in the policy summary that follows.
Charges & Financial Obligations · Restriction or exception
Lost wages and care, counseling and miscellaneous costs have smaller caps
Within the identity theft recovery benefit, the opening summary caps lost wages and child or elder care at $5,000, mental health counseling at $1,000 and other miscellaneous expenses at $1,000. The detailed limits section says each of these caps is part of, and not in addition to, the overall Identity Theft Recovery limit, and that lost wages, care costs and counseling are covered only for costs incurred within 12 months after the Member first discovers the stolen identity event. Counseling must come from a licensed mental health professional who is not a relative of the Member.
Supporting quotations
Lost wages and child/elder care for time taken to address the identity theft (up to $5,000)
Mental health counseling (up to $1,000)
Other miscellaneous expenses (up to $1,000)
This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit. Coverage is limited to wages lost and costs incurred within 12 months after the first discovery of the stolen identity event by the Member.
Coverage is limited to costs incurred within 12 months after the first discovery of the stolen identity event by the Member.
Such care must be provided by a professional care provider who is not a relative of the Member;
Qualifications & exceptions
The caps are shown here as dollar amounts; the detailed limits section refers to a sublimit "shown in the Schedule", and the Schedule for Surfshark One+ shows the same dollar amounts for these three categories.
Lost wages and the cost of child or elder care share one joint sublimit.
Security & Safeguards · Company commitment
Victims get access to a licensed identity theft investigator
The opening summary says victims are given access to a licensed identity theft investigator who can give professional assistance and guide them through correcting their credit history or identity records, and says investigators can do the majority of the work required to restore an identity on the victim's behalf.
Supporting quotations
Additionally, victims are given access to a licensed identity theft investigator who can provide professional assistance and guide them through the process to correct their credit history or identity records. Investigators can do the majority of the work required to restore an identity on a victim’s behalf, providing peace of mind.
Qualifications & exceptions
The detailed policy describes the service as the Case Management Service: an identity recovery case manager assigned by the insurer to assist with communications the insurer deems necessary, with the Member's permission and cooperation. The policy also says it does not guarantee that services will end or eliminate all problems.
The Schedule shows the Case Management Service as 12 months for Surfshark One+.
Not stated here
The opening summary says "licensed identity theft investigator"; the detailed policy uses "identity recovery case manager" without stating a license requirement.
Cross-references
contrast (model-proposed): Identity recovery case manager helps with communications the insurer deems necessary — contrast: The opening summary describes investigators who can do the majority of the restoration work on the victim's behalf, while the policy defines the case manager as assisting with communications the insurer deems necessary, with the Member's permission and cooperation.
Legal Rights & Agreement Rules · Restriction or exception
This is a summary only; the group policy governs and ends with enrollment
The document describes itself as a summary of benefits available to customers of Cyber Protection Insurance Services Inc., the policyholder of a group policy. Benefits vary with the service package the person is enrolled in. It says this is a summary only, additional terms and conditions apply, the full policy contains all terms, conditions and exclusions and a copy will be made available on request, and that entitlement to benefits ends when enrollment in any Insured Program ends.
Supporting quotations
This Summary of Benefits document provides only a summary of the benefits entitled to you as a customer of Cyber Protection Insurance Services Inc., the policyholder of a group policy (“the policy”).
Based on the specific service package you are enrolled in, benefits may vary, as outlined below. This is a summary only. Additional terms and conditions apply. A copy of the policy will be made available upon request. Refer to the full policy for all terms, conditions, and exclusions.
Your entitlement to benefits under the group policy will terminate upon termination of your enrollment in any Insured Program.
Qualifications & exceptions
The full group policy is not part of this saved document, so terms that only appear there are not covered here.
Later, the cancellation condition says Member coverage terminates when the primary member's enrollment in the insured program ends or the policy terminates, whichever is earlier.
Not stated here
The summary does not say how a person requests the policy copy or who sends it.
The words "any Insured Program" here are broader than the later wording about the primary member's enrollment in "the insured program"; the summary does not explain the difference.
Cross-references
contrast (model-proposed): Member coverage ends with the primary member's enrollment or the policy, whichever is earlier — contrast: The opening description says entitlement ends when enrollment in "any Insured Program" ends, while the condition says Member coverage ends when the primary member's enrollment in "the insured program" ends or the policy terminates, whichever is earlier.
Legal Rights & Agreement Rules · Context
No guaranty fund protection if the insurer becomes insolvent
A notice citing the Arizona Revised Statutes says this Evidence of Coverage is issued by an insurer without a certificate of authority from the director of the Arizona Department of Insurance. If that insurer becomes insolvent, insureds or claimants will not be eligible for insurance guaranty fund protection under title 20 of the Arizona Revised Statutes.
Supporting quotations
this Evidence of Coverage is issued by an insurer that does not possess a certificate of authority from the director of the Arizona Department of Insurance. If the insurer that issued this policy becomes insolvent, insureds or claimants will not be eligible for insurance guaranty fund protection pursuant to title 20, Arizona Revised Statutes.
Qualifications & exceptions
The notice cites section 20-401.01, subsection B, paragraph 1 of the Arizona Revised Statutes by name; its contents are not reproduced in this document and are not explained here.
Not stated here
The notice does not say whether it applies to people who do not live in Arizona; the document is titled as covering the United States except Washington, and a later exclusion also removes members whose primary residence is in New York or Washington.
Account & Service Control · Context
HSB Specialty Insurance Company insures; Cyber Protection Insurance Services Inc. is the provider
The Schedule names HSB Specialty Insurance Company as the Insuring Company, with a Hartford, Connecticut mailing address, and Cyber Protection Insurance Services Inc., Phoenix, Arizona, as the Provider. The document says "we", "us" and "our" mean the Insuring Company, and that the Provider is the entity providing the insured program shown in the Schedule.
Supporting quotations
HSB Specialty Insurance Company
One State Street, P.O. Box 5024, Hartford, Connecticut 06102-5024
Cyber Protection Insurance Services Inc.
20860 N. Tatum Blvd., Suite 300, Phoenix, AZ 85050
Provider means the entity providing the insured program and shown as the Provider in the Schedule of this Summary of Benefits.
Not stated here
Surfshark appears only through the insured program name in the Schedule; the document does not describe the contractual relationship between Surfshark and either the Insuring Company or the Provider.
Charges & Financial Obligations · Company commitment
Schedule for Surfshark One+: included coverages and limits
For the insured program named Surfshark One+, the Schedule shows a Case Management Service of 12 months, an Identity Theft Recovery limit of $1,000,000, Legal Costs shown as "Included", lost wages and child and elder care at $5,000, mental health counseling at $1,000, miscellaneous unnamed costs at $1,000, and a Member Annual Aggregate Limit of $1,000,000. The Schedule is the listing of the insured program as defined by the policy summary.
Supporting quotations
Surfshark One+
Case Management Service | 12 months
Identity Theft Recovery | $1,000,000
Legal Costs | Included
Lost Wages and Child and Elder Care Expenses | $5,000
Mental Health Counseling | $1,000
Miscellaneous Unnamed Costs | $1,000
Member Annual Aggregate Limit | $1,000,000
Insured program means the package of products and/or services provided by the provider and shown under the Insured Programs section of the Schedule of this Summary of Benefits.
Qualifications & exceptions
The sublimits for legal costs, lost wages and care, counseling and miscellaneous costs sit inside, and do not add to, the Identity Theft Recovery limit.
The Member Annual Aggregate Limit caps all coverages together for one Member in a policy period.
Not stated here
The Case Management Service row appears under the heading "Coverage Aggregate Limits" but states a duration, not a dollar amount; the document does not explain that.
Legal Costs is shown as "Included" rather than a dollar sublimit, although the limits section refers to a sublimit "shown in the Schedule" for legal costs; no separate legal-costs amount is stated.
No Member Deductible row appears in the Schedule.
Account & Service Control · Restriction or exception
Coverage type is Individual; family members count only if the program covers them
The Schedule lists the coverage type for Surfshark One+ as Individual. The definition of Member covers the primary member and, only if the insured program includes coverage for family members, certain household residents. The Schedule does not show family coverage for this insured program.
Supporting quotations
Coverage Type | Individual
Member means:
If the insured program includes coverage for family members, the residents of the household of the primary member who are:
Qualifications & exceptions
Whether Member extends beyond the primary member depends on what the insured program includes; the Schedule shows only "Individual".
Not stated here
The document does not say how enrollment in Surfshark One+ is handled for other people in the same household.
Charges & Financial Obligations · Restriction or exception
Cyber attack, extortion, online fraud, scams, cyberbullying, home title fraud and data breach are not included
The Schedule marks seven coverages as "Not Included" for Surfshark One+: cyber attack, cyber extortion, online fraud reimbursement, online scams, cyberbullying, home title fraud and data breach. The body of the policy summary still describes those coverages and their definitions, but the stolen identity event definition counts them only to the extent that the corresponding coverages are included in the insured program, so for this program they are not provided.
Supporting quotations
Cyber Attack | Not Included
Cyber Extortion | Not Included
Online Fraud Reimbursement | Not Included
Online Scams | Not Included
Cyberbullying | Not Included
Home Title Fraud | Not Included
Data Breach | Not Included
but only to the extent that such corresponding coverages are included in the insured program
Online scams means intentional and criminal deception of a Member, perpetrated partially or wholly through a computing device or connected home device, to induce the Member to:
Qualifications & exceptions
This reading applies to the Surfshark One+ insured program shown in this Schedule; the document does not show other programs.
Online scams is both a listed coverage and part of the fraud event definition.
Not stated here
The document does not say whether the text describing the not-included coverages is shared across programs or why it is printed in this summary.
Form identifiers and copyright; no effective date stated
The Schedule page ends with the form reference SIE SBS 03 25 and a 2025 copyright line for HSB Specialty Insurance Company. No effective date, policy period or revision date is stated in the document.
No effective date or policy period for this Summary of Benefits is stated.
Legal Rights & Agreement Rules · Context
"We" means the Insuring Company; paragraph titles do not change coverage
In this Summary of Benefits, "we", "us" and "our" refer to the Insuring Company named in the Schedule. Paragraph titles are only there to help find provisions and do not grant, define or restrict coverage.
Supporting quotations
The words “we”, “us” and “our” refer to the Insuring Company shown in the Schedule of this Summary of Benefits.
Titles given to paragraphs throughout this Summary of Benefits are for assistance in finding applicable provisions. Titles do not grant, define or restrict coverage.
Qualifications & exceptions
The Insuring Company shown in the Schedule is HSB Specialty Insurance Company, not the Provider.
Legal Rights & Agreement Rules · Context
"Affected individual" is a limited definition used for data breach cover
An affected individual is a person whose personally identifying or personally sensitive information is lost, stolen, accidentally released or accidentally published in a covered data breach event. The person's information must be held by a Member because of a family or personal relationship or because of the Member's volunteer work for a non-profit. It does not include any Member, people whose information a Member holds through a for-profit organization (or a non-profit where the Member is a paid worker), or any business or other entity.
Supporting quotations
Affected individual means any person whose personally identifying information or personally sensitive information is lost, stolen, accidentally released or accidentally published by a data breach event covered under the policy.
Affected individual must be someone whose personally identifying information or personally sensitive information is in the possession of a Member because of:
A family or personal relationship with a Member
Affected individual does not mean or include any of the following:
Any Member.
The activities or responsibilities of a Member in connection with volunteer work for a non-profit organization.
Anyone whose personally identifying information or personally sensitive information is in the possession of a Member because of the activities or responsibilities, of any Member in connection with a for-profit organization or in connection with a non-profit organization for which a Member is a paid employee or contract worker.
Any business, organization or entity. Only an individual person may be an affected individual.
Personally sensitive information means private information specific to an individual, the release of which requires notification of affected individuals under any applicable law.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Data Breach is among them.
Only an individual person may be an affected individual.
Security & Safeguards · Restriction or exception
Computing devices and connected home devices must be owned or leased and under the Member's control
A computing device is a desktop, laptop or tablet computer or a Wi-Fi router or other internet access point. A connected home device is any other electronic device that connects to the internet or other devices, including networked smart phones, thermostats, entertainment systems, appliances, smoke, fire and home security monitoring systems, and cameras. For either, the device must be owned or leased by a Member and operated under the Member's control.
Supporting quotations
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point. Such device must be owned or leased by a Member, as well as operated under the Member's control.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Smart phones;
Thermostats;
Entertainment systems;
Appliances;
Smoke, fire and home security monitoring systems; or
Cameras.
Such device must be owned or leased by a Member, as well as operated under the Member's control.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. The device definitions are used by the cyber attack, cyber extortion, fraud event and online scams definitions, and by an exclusion for devices the Member does not own, lease or control.
The connected home device list says "includes, but is not limited to".
Security & Safeguards · Context
Cyber attack and cryptojacking events are defined by device access, malware and utility overage
A cyber attack event is either unauthorized access to or use of a Member's device or system (by an unauthorized person, or by an authorized person for unauthorized purposes), or a malware attack damaging a Member's device, system or data. Malware damage does not include damage from shortcomings or mistakes in legitimate code or from code installed during manufacturing. A cryptojacking event is a cyber attack carried out to mine cryptocurrency that makes a Member incur utility bill overage expenses.
Supporting quotations
Cyber attack event means one of the following involving a computing device or connected home device:
Unauthorized Access or Use – meaning the gaining of access to a Member's device or system by an unauthorized person or persons or by an authorized person or persons for unauthorized purposes.
Malware Attack – meaning damage to a Member's device, system or data arising from malicious code, including viruses, worms, Trojans, spyware and keyloggers. This does not mean damage from shortcomings or mistakes in legitimate electronic code or damage from code installed on the Member's computer system during the manufacturing process.
Cryptojacking event means a cyber attack event carried out for the purpose of mining cryptocurrency that causes a Member to incur utility bill overage expenses.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyber Attack is among them.
Security & Safeguards · Context
Cyber extortion event and the response costs payable under it
A cyber extortion event is a demand for money or other consideration based on a credible threat to damage, disable, deny access to or disseminate content from a Member's device, system or data, or based on an offer to restore access or functionality after an attack. Cyber extortion response costs are payments made as directed in response to such an event, only when incurred as a direct result of the event and approved in advance by the insurer; the insurer may still pay unapproved costs if it determines that getting approval was not practical and it would have approved the payment if consulted.
Supporting quotations
Cyber extortion event means one of the following involving a computing device or connected home device:
A demand for money or other consideration based on a credible threat to damage, disable, deny access to or disseminate content from a Member's device, system or data; or
A demand for money or other consideration based on an offer to restore access or functionality in connection with an attack on a Member's device, system or data.
Cyber extortion response costs means any payment made as directed in response to a cyber extortion event, but only when that payment is:
Incurred as a direct result of a cyber extortion event directed against a Member; and
Approved in advance by us. However, we may pay for cyber extortion response costs that were not approved in advance by us if we determine the following:
It was not practical for the Member to obtain our prior approval; and
If consulted at the time, we would have approved the payment.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyber Extortion is among them.
The insurer decides whether prior approval was impractical and whether it would have approved.
Security & Safeguards · Context
Cyberbullying acts and the costs listed for a cyberbullying event
A cyberbullying act is harassment, intimidation, defamation, invasion of privacy, threat of violence or a similar act personally targeted at a Member and carried out wholly or partly on social media platforms. Cyberbullying costs are the listed costs that arise directly from a cyberbullying event and are incurred within 12 months after it: counseling for the victim, temporary relocation, temporary tutoring, enrollment costs at a similar alternate school (not tuition), professional cybersecurity consultation, mobile apps and monitoring software to prevent recurrence, legal expenses including content removal, and lost wages, childcare and eldercare.
Supporting quotations
Cyberbullying act means an act of harassment, intimidation, defamation, invasion of privacy, threat of violence or other similar act personally targeted towards a Member and perpetrated wholly or partially using social media platforms.
Cyberbullying costs means the following costs arising as a direct result of a cyberbullying event when incurred by a Member within 12 months after the cyberbullying event:
Costs for counseling from a licensed mental health professional for the victim of the cyberbullying event;
Temporary relocation expenses;
Temporary private tutoring;
Enrollment expenses incurred due to relocation to a similar, alternate school. This does not include tuition costs;
Professional cybersecurity consultation services;
The purchase of mobile applications, social monitoring software and web-based products when used to prevent further occurrence of cyberbullying events;
Legal expenses, including legal expenses for the removal of online content related to the cyberbullying event; and
Lost wages, childcare and eldercare expenses.
Cyberbullying event means two or more similar or related cyberbullying acts.
Qualifications & exceptions
These definitions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyberbullying is among them.
A cyberbullying event needs two or more similar or related acts and must have caused harm significant enough for the Member to report it or need treatment (defined in the next section).
Security & Safeguards · Context
A cyberbullying event needs repeated acts and significant harm
A cyberbullying event is two or more similar or related cyberbullying acts that caused harm significant enough for the Member either to report it to a school administrator or law enforcement, or to need treatment by a licensed medical or mental health practitioner who is not in the Member's immediate family. When treatment is required, the insurer reserves the right to require an independent medical exam. For this coverage the event begins on the date of the first similar or related act. A school administrator is a principal, vice principal, headmaster or dean.
Supporting quotations
Cyberbullying event means two or more similar or related cyberbullying acts. Such cyberbullying event must have caused harm significant enough for a Member to:
Report such cyberbullying event to a school administrator or law enforcement; or
Require treatment by a licensed medical or mental health practitioner who is a not a Member of the Member's immediate family. At our discretion, when such treatment is required, we reserve the right to require the Member to submit to an independent medical exam.
For the purposes of this coverage, the cyberbullying event begins on the date of the first similar or related cyberbullying act.
School administrator means a principal, vice principal, headmaster or dean.
Cyberbullying act means an act of harassment, intimidation, defamation, invasion of privacy, threat of violence or other similar act personally targeted towards a Member
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyberbullying is among them.
Use & Processing · Context
Data breach costs include forensic IT review and legal review
Data breach costs start with a forensic IT review, to find out the nature and extent of the breach and the number and identities of affected individuals, and a professional legal counsel review of the breach and how the Member should respond. The forensic review does not cover analyzing system vulnerabilities, security-standard compliance, or damage to data that is not personally identifying or personally sensitive information. If there is reasonable cause to suspect a covered breach, the insurer pays for these two reviews even if it is later found there was no covered breach, but stops paying further costs once that is determined.
Supporting quotations
Data breach costs means:
Forensic IT Review
Professional information technologies review if needed to determine, within the constraints of what is possible and reasonable, the nature and extent of the data breach event and the number and identities of the affected individuals.
Vulnerabilities in systems, procedures or physical security;
Compliance with security standards; or
The nature or extent of loss or damage to data that is not personally identifying information or personally sensitive information.
If there is reasonable cause to suspect that a covered data breach event may have occurred, we will pay for costs covered under Forensic IT Review, even if it is eventually determined that there was no covered data breach event. However, once it is determined that there was no covered data breach event, we will not pay for any further costs.
Legal Review Professional legal counsel review of the data breach event and how a Member should best respond to it.
If there is reasonable cause to suspect that a covered data breach event may have occurred, we will pay for costs covered under Legal Review, even if it is eventually determined that there was no covered data breach event. However, once it is determined that there was no covered data breach event, we will not pay for any further costs.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Data Breach is among them.
Use & Processing · Context
Notification and services for affected individuals are paid only for necessary and reasonable costs
Data breach costs also include the Member's necessary and reasonable costs to notify affected individuals, and, only if the Member has given that notification, necessary and reasonable costs of services to those individuals. For any breach the services are informational materials and a toll-free help line. For breaches involving personally identifying information they also include a credit report and electronic credit monitoring (subject to the individual enrolling with the designated service provider) and identity restoration case management for individuals who are or appear to be identity theft victims arising from the breach.
Supporting quotations
Notification to Affected Individuals
The Member’s necessary and reasonable costs to provide notification of the data breach event to affected individuals.
This coverage only applies if the Member has provided notification of the data breach event to affected individuals as covered under paragraph c. above.
The Member’s necessary and reasonable costs to provide the following services to affected individuals.
A packet of loss prevention and customer support information.
A toll-free telephone line for affected individuals with questions about the data breach event.
(b) below.
The following additional services apply to data breach events involving personally identifying information.
A credit report and an electronic service automatically monitoring for activities affecting an individual’s credit records. This service is subject to the affected individual enrolling for this service with the designated service provider.
With respect to any affected individual who is or appears to be a victim of identity theft event that may reasonably have arisen from the data breach event, the services of an identity restoration professional who will assist that affected individual through the process of correcting credit and other records and, within the constraints of what is possible and reasonable, restoring control over his or her personal identity.
Identity theft event means the fraudulent use of social security number or other personally identifying information.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Data Breach is among them.
Services to affected individuals depend on the Member first notifying them under the notification coverage.
Use & Processing · Context
A data breach event involves information in the Member's or an entrusted professional's custody
A data breach event is the loss, theft, accidental release or accidental publication of personally identifying or personally sensitive information about one or more affected individuals, while the information is in the care, custody or control of a Member or of a professional entity the Member contracted with and entrusted with it. If the date of the breach cannot be determined, it is deemed to be the date the Member first became aware of the loss, theft, release or publication. For data breach coverage, personally identifying information means information (including health information) that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of an affected individual.
Supporting quotations
Data breach event
Data breach event means the loss, theft, accidental release or accidental publication of personally identifying information or personally sensitive information as respects one or more affected individuals. At the time of the breach, such information must be in the care, custody or control of:
A Member; or
A professional entity with whom a Member has a contract and to whom a Member has entrusted the information.
if the date of the data breach event as defined in a. above cannot be determined, such date shall be deemed to be the date a Member first become aware of the loss, theft, release or publication of the personally identifying information or personally sensitive information.
personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of an affected individual.
Affected individual means any person whose personally identifying information or personally sensitive information is lost, stolen, accidentally released or accidentally published by a data breach event covered under the policy.
Personally sensitive information means private information specific to an individual, the release of which requires notification of affected individuals under any applicable law.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Data Breach is among them.
Security & Safeguards · Context
Data recovery costs cover a professional firm replacing lost or corrupted data, with exclusions
Data recovery costs are the costs of a professional firm hired by a Member to replace electronic data that has been lost or corrupted. They do not include costs to research, re-create or replace software programs or operating systems that are not commercially available, data that cannot reasonably be replaced (for example personal photos, movies or recordings with no electronic back-up), or data that is obsolete, unnecessary or no longer of use.
Supporting quotations
Data recovery costs
Data recovery costs means the costs of a professional firm hired by a Member to replace electronic data that has been lost or corrupted.
Data recovery costs does not mean costs to research, re-create or replace any of the following:
Software programs or operating systems that are not commercially available.
Data that cannot reasonably be replaced. This includes, but is not limited to, personal photos, movies or recordings for which no electronic back-up is available.
Data that is obsolete, unnecessary or no longer of use.
Qualifications & exceptions
This provision serves the Cyber Attack coverage, which the Schedule marks "Not Included" for Surfshark One+.
Charges & Financial Obligations · Restriction or exception
Fraud costs are only the direct financial loss
Fraud costs are the amount fraudulently taken from a Member, which is the direct financial loss only. They do not include other expenses arising from the fraud event, indirect loss such as bodily injury, lost time, lost wages, identity recovery expenses or damaged reputation, interest or investment gain on the loss, or any part of the loss that has been or can reasonably be expected to be reimbursed by a third party such as a financial institution.
Supporting quotations
Fraud costs means the amount fraudulently taken from a Member. This is the direct financial loss only.
Other expenses that arise from the fraud event;
Indirect loss, such as bodily injury, lost time, lost wages, identity recovery expenses or damaged reputation;
Any interest, time value or potential investment gain on the amount of financial loss; or
Any portion of such amount that has been or can reasonably be expected to be reimbursed by a third party, such as a financial institution.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Online Fraud Reimbursement is among them.
Identity recovery expenses are covered, if at all, under Identity Theft Recovery, not as fraud costs.
Charges & Financial Obligations · Context
A fraud event is a device-involved event causing direct financial loss
A fraud event is an identity theft event, unauthorized use of a card or account number issued to or registered in the Member's name when the Member is legally liable for that use, forgery or alteration of a check or negotiable instrument, acceptance in good faith of counterfeit currency, or an online scam, when the event is wholly or partly carried out through a computing device or connected home device and results in direct financial loss to the Member.
Supporting quotations
Fraud event means any of the following, when such event is wholly or partially perpetrated through a computing device or connected home device and results in direct financial loss to a Member:
A identity theft event;
The unauthorized use of a card, card number or account number associated with a bank account or credit account issued to or registered in a Member's name, when the Member is legally liable for such use;
The forgery or alteration of any check or negotiable instrument;
Acceptance in good faith of counterfeit currency; or
Online scams.
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Identity theft event means the fraudulent use of social security number or other personally identifying information.
Online scams means intentional and criminal deception of a Member, perpetrated partially or wholly through a computing device or connected home device, to induce the Member to:
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Online Fraud Reimbursement and Online Scams are among them.
The identity theft recovery coverage that the Schedule includes pays identity theft costs, not the money lost.
Charges & Financial Obligations · Restriction or exception
Fraud event excludes coerced, related-party, authorized-user and listed dispute or gambling cases
A fraud event does not include occurrences where the Member is threatened or coerced to part with something of value (other than online scams); occurrences between the Member and another Member, a current or former spouse or domestic partner, or a grandparent, parent, sibling, child or grandchild; card or account use by a person who ever received authorization from a Member, or where the Member has not complied with the card or account terms; and losses arising from the Member's business or professional service, disputes over completeness, authenticity or value, gifts or charitable contributions, online auctions, lotteries, gambling or games of chance, and advance fee or similar fraud where money is given on the expectation of receiving more later.
Supporting quotations
Fraud event does not mean or include any occurrence:
In which a Member is threatened or coerced to part with something of value, other than online scams;
Between a Member and any of the following:
Any other Member;
A Member’s current or former spouse, common law spouse or domestic partner; or
A Member’s grandparent, parent, sibling, child or grandchild.
Involving use of a card, card number or account number associated with a bank account or credit account:
By a person who has ever received any authorization from a Member to use such card, card number or account number; or
If a Member has not complied with all terms and conditions under which such card, card number or account number was issued.
Arising from any of the following:
The business or professional service of a Member.
A dispute or a disagreement over the completeness, authenticity or value of a product, a service or a financial instrument.
A gift or charitable contribution to an individual or any legitimate organization.
An online auction or the use of an online auction site.
A lottery, gambling or a game of chance.
An advance fee fraud or other fraud in which a Member provides money based on an expectation of receiving at some future time a larger amount of money or something with a greater value than the money provided.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Online Fraud Reimbursement is among them.
Charges & Financial Obligations · Restriction or exception
Future loss avoidance costs are limited to device improvements within 60 days and 10% of the cyber attack payment
Future loss avoidance costs are amounts a Member spends to improve a computing device or connected home device, if incurred within 60 days after discovery of a cyber attack event and the insurer agrees in writing that the improvements would reasonably reduce the likelihood of a similar attack (the insurer will not unreasonably withhold agreement). Improvements may include hardware and software upgrades; for subscription services the insurer pays only the first 12 months. The most payable for any one cyber attack event is 10% of the insurer's Eligible Payment under the Cyber Attack coverage, before any payment under this coverage, excluding any deductible; a payment for hardware replacement or upgrades under the system restoration costs definition reduces what is payable.
Supporting quotations
Future loss avoidance costs means the amount spent by a Member to make improvements to a computing device or connected home device, provided:
Such future loss avoidance costs are incurred within 60 days after the discovery of the cyber attack event; and
We agree in writing that improvements to which future loss avoidance costs relate would reasonably reduce the likelihood of a future cyber attack event similar to the one for which the Member has received payment under coverage B.2.c. Cyber Attack. We will not unreasonably withhold such agreement.
Improvements involving services subject to lease, license or subscription may have costs that are ongoing. In such case, the most we will pay are costs associated with the first 12 months of any such service, subject to the amount described in paragraph c. below.
The most we will pay for all future loss avoidance costs with respect to any one cyber attack event is 10% of our Eligible Payment to the Member prior to any payment under this Future Loss Avoidance coverage.
Eligible Payment means our total payment to the Member under coverage B.2.c. Cyber Attack, not including any deductible amount.
Cyber attack event means one of the following involving a computing device or connected home device:
Any payment made for hardware replacement or hardware upgrades as described under A. DEFINITIONS, 33. System restoration costs, item b.(1) below reduces the amount we will pay for future loss avoidance costs.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Cyber Attack is among them.
Charges & Financial Obligations · Context
Home title fraud costs cover recovering title wrongfully transferred away from a Member
Home title fraud costs are fees and expenses of an attorney approved by the insurer for recovering title to real property wrongfully or fraudulently transferred from a Member, and other reasonable costs necessarily incurred in recovering that title, including court filing and title recording fees. A home title fraud event is an identity theft event that results in the wrongful or fraudulent transfer of title to real property from a Member.
Supporting quotations
Home title fraud costs means:
Fees and expenses for an attorney approved by us for the recovery of title to real property wrongfully or fraudulently transferred from a Member; and
Any other reasonable costs necessarily incurred by a Member in the course of recovering such title, including court filing and title recording fees.
Home title fraud event means an identity theft event resulting in the wrongful or fraudulent transfer of title to real property from a Member.
Qualifications & exceptions
These provisions serve coverages that the Schedule marks "Not Included" for Surfshark One+. Home Title Fraud is among them. Identity theft costs also exclude home title fraud costs.
Security & Safeguards · Company commitment
Identity recovery case manager helps with communications the insurer deems necessary
An identity recovery case manager is one or more individuals assigned by the insurer to help a Member with communications the insurer deems necessary for re-establishing the integrity of the Member's personal identity. That includes, with the Member's permission and cooperation, written and telephone communications with law enforcement authorities, government agencies, credit agencies and individual creditors and businesses.
Supporting quotations
Identity recovery case manager means one or more individuals assigned by us to assist a Member with communications we deem necessary for re-establishing the integrity of the personal identity of the Member. This includes, with the permission and cooperation of the Member, written and telephone communications with law enforcement authorities, governmental agencies, credit agencies and individual creditors and businesses.
Qualifications & exceptions
This is the service behind the Case Management Service coverage, which the Schedule includes for 12 months. The insurer decides which communications it deems necessary, and the Member must give permission and cooperate.
The policy also says services depend on the Member's cooperation and are not guaranteed to end or eliminate all problems.
Charges & Financial Obligations · Company commitment
Identity theft costs: re-filing, postage and notary, and credit report costs
Identity theft costs are the reasonable and necessary costs a Member incurs as a result of an identity theft event. The first items are costs of re-filing applications for loans, grants or other credit instruments that were rejected solely because of the identity theft event, costs for long distance telephone calls, postage and notarizing documents, and costs for credit reports from established credit bureaus.
Supporting quotations
Identity theft costs means the following when they are reasonable and necessary costs that are incurred by a Member as a result of a identity theft event:
Costs for re-filing applications for loans, grants or other credit instruments that are rejected solely as a result of a identity theft event;
Costs for long distance telephone calls, postage and notarizing documents;
Costs for credit reports from established credit bureaus;
Qualifications & exceptions
This is part of the Identity Theft Recovery coverage that the Schedule includes for Surfshark One+, with a $1,000,000 limit. Costs must be reasonable and necessary and caused by an identity theft event, and the coverage requirements, exclusions and conditions apply.
Costs restricted or excluded elsewhere in the policy are not covered.
Legal Rights & Agreement Rules · Company commitment
Identity theft costs: legal costs need an attorney approved by the insurer
Identity theft costs include costs for an attorney approved by the insurer to defend a civil suit brought against the Member, remove a civil judgment wrongfully entered against the Member, assist the Member at a government agency audit or hearing, help challenge the accuracy of the Member's consumer credit report, or defend criminal charges brought against the Member arising from a third party's use of the Member's identity. The general exclusion for third-party liability or legal defense costs has an exception for the Identity Theft Recovery coverage.
Supporting quotations
Costs for an attorney approved by us for the following:
The defense of any civil suit brought against a Member;
The removal of any civil judgment wrongfully entered against a Member;
Legal assistance for a Member at an audit or hearing by a governmental agency;
Legal assistance in challenging the accuracy of a Member’s consumer credit report;
The defense of any criminal charges brought against a Member arising from the actions of a third party using the personal identity of the Member; or
Any third party liability or legal defense costs, except as described in coverage B.2.b. Identity Theft Recovery.
Qualifications & exceptions
The attorney must be one the insurer has approved. The Schedule shows Legal Costs as "Included", and the limits section says a legal costs sublimit is part of, and not in addition to, the Identity Theft Recovery limit.
The criminal-defense item sits beside an exclusion for any criminal investigations or proceedings; the exclusions section lists both.
Not stated here
The document does not say how the insurer decides whether to approve an attorney beyond the later statement that approval of service providers will not be unreasonably withheld.
Charges & Financial Obligations · Company commitment
Identity theft costs: employer-documented lost wages, with exclusions
Identity theft costs include lost wages or salaried earnings for employer-documented time the Member necessarily took away from work to carry out the activities in items a through d, to meet with law enforcement, government agencies, credit agencies, creditors or businesses, or to otherwise recover control over the stolen identity. They do not include wages for sick days, time away from self-employment, or time taken for tasks that could reasonably have been done outside working hours.
Supporting quotations
Lost wages or salaries earnings for employer-documented time necessarily taken away from work:
For the activities described in a. through d. above;
To meet with law enforcement authorities, governmental agencies, credit agencies or individual creditors and businesses; or
To otherwise recover control over the stolen personal identity.
This does not include wages or salaried earnings for sick days, time taken away from self-employment or time taken away for tasks that could reasonably have been done during non-working hours.
Qualifications & exceptions
Lost wages and care costs share a joint sublimit (shown as $5,000 in the Schedule) that is part of the Identity Theft Recovery limit, and cover only wages lost within 12 months after the Member first discovers the stolen identity event.
Charges & Financial Obligations · Company commitment
Identity theft costs: dependent supervision and mental health counseling by non-relative professionals
Identity theft costs include the cost of supervising children or elderly or infirm relatives or dependents of the Member while the Member is away from that supervision, and the cost of counseling from a licensed mental health professional. In both cases the care must be provided by a professional care provider who is not a relative of the Member.
Supporting quotations
Costs of supervision of children or elderly or infirm relatives or dependents of a Member during time taken away from such supervision. Such care must be provided by a professional care provider who is not a relative of the Member;
Costs for counseling from a licensed mental health professional. Such care must be provided by a professional care provider who is not a relative of the Member;
Qualifications & exceptions
Dependent supervision shares the joint $5,000 lost wages and care sublimit; counseling has its own $1,000 sublimit in the Schedule. Both are part of the Identity Theft Recovery limit and limited to costs within 12 months after the first discovery of the stolen identity event.
Charges & Financial Obligations · Restriction or exception
Identity theft costs: other direct costs, with what is not included
Identity theft costs include any other reasonable costs the Member necessarily incurs as a direct result of the identity theft event, including the Member's costs to recover control over personal identity, deductibles or service fees from financial institutions, and court filing and title recording fees. They do not include costs to avoid, prevent or detect an identity theft event or other loss, money lost or stolen, costs restricted or excluded elsewhere in the policy, or home title fraud costs.
Supporting quotations
Any other reasonable costs necessarily incurred by a Member as a direct result of the identity theft event.
Such costs include:
Costs by the Member to recover control over his or her personal identity.
Deductibles or service fees from financial institutions.
Court filing and title recording fees.
Such costs do not include:
Costs to avoid, prevent or detect a identity theft event or other loss.
Money lost or stolen.
Costs that are restricted or excluded elsewhere in the policy.
Home title fraud costs.
Home title fraud costs means:
Qualifications & exceptions
This is the miscellaneous category the Schedule shows as Miscellaneous Unnamed Costs at $1,000, part of the Identity Theft Recovery limit, limited to costs incurred within 12 months after the first discovery of the stolen identity event.
Because money lost or stolen is excluded, the coverage reimburses recovery costs, not stolen funds.
Security & Safeguards · Context
An identity theft event is the fraudulent use of a Social Security number or other personal information
An identity theft event is the fraudulent use of a Social Security number or other personally identifying information, including fraudulently using such information to establish credit accounts, secure loans, enter into contracts or commit crimes.
Supporting quotations
Identity theft event means the fraudulent use of social security number or other personally identifying information. This includes fraudulently using such information to establish credit accounts, secure loans, enter into contracts or commit crimes.
Qualifications & exceptions
Identity Theft Recovery applies only if the identity theft event is a direct result of a stolen identity event discovered and reported as the coverage requirements say.
Account & Service Control · Restriction or exception
"Member" is the primary member, and household family only if the program covers family
A Member is the primary member and, if the insured program includes coverage for family members, residents of the primary member's household who are relatives (including a spouse), under 21 and in the care of such persons, or full-time students who lived in the household before moving out to attend school, if under 24 and the primary member's relative, or under 21 and in the primary member's care or a relative resident's care. A primary member is a person who, at the time of discovery of the stolen identity event, is a customer in good standing of the provider and is directly enrolled in the insured program. The insured program is the package of products and services shown in the Schedule.
Supporting quotations
Member means:
The primary member.
If the insured program includes coverage for family members, the residents of the household of the primary member who are:
The relatives of such persons, including their spouse; or
Under the age of 21 and in the care of such persons; or
A student enrolled in school full-time, as defined by the school, who was a resident of the primary member's household before moving out to attend school, provided the student is under the age of:
24 and the primary member's relative; or
21 and in the primary member's care or the care of a resident of the primary member's household who is the primary member's relative.
Primary member means a person who, at the time of the discovery of the stolen identity event, is a customer in good standing of the provider and is directly enrolled in the insured program.
Insured program means the package of products and/or services provided by the provider and shown under the Insured Programs section of the Schedule of this Summary of Benefits.
Qualifications & exceptions
The Schedule lists the coverage type for Surfshark One+ as Individual and shows no family coverage.
Primary member status is tested at the time of discovery of the stolen identity event.
Not stated here
The document does not say what "customer in good standing of the provider" requires or how enrollment through the Surfshark One+ subscription is evidenced.
Nuclear hazard is defined broadly for the exclusion
Nuclear hazard means nuclear reaction, radiation or radioactive contamination, or any consequence of any of these, however caused and whether controlled or uncontrolled. The exclusions section excludes loss from any nuclear hazard.
Supporting quotations
Nuclear Hazard means nuclear reaction, radiation or radioactive contamination, or any consequence of any of these, however caused and whether controlled or uncontrolled.
Legal Rights & Agreement Rules · Context
Related events count as one occurrence if simultaneous or from the same source in the same policy period
An occurrence groups stolen identity events, cyber attack events, cyberbullying events, cyber extortion events, data breach events, fraud events, home title fraud events or identity theft events that happen at the same time, or that arise in the same policy period from the same source, cause or vulnerability. The limits section uses the discovery period of an occurrence to decide which annual limit applies if loss spans policy periods.
Supporting quotations
Occurrence means all stolen identity events, cyber attack events, cyberbullying event, cyber extortion events, data breach events, fraud events, home title fraud events or identity theft events that:
Occur at the same time; or
Arise during the same policy period from the same source, cause or vulnerability.
Charges & Financial Obligations · Context
Online scams are deception through a device that induces disclosing credentials or voluntarily parting with money
Online scams are intentional and criminal deception of a Member, carried out wholly or partly through a computing device or connected home device, that induces the Member to disclose login credentials resulting in a financial loss of money, securities, cryptocurrency or tangible property, or to voluntarily part with money, securities, cryptocurrency or tangible property.
Supporting quotations
Online scams means intentional and criminal deception of a Member, perpetrated partially or wholly through a computing device or connected home device, to induce the Member to:
Disclose login credentials that results in a financial loss of money, securities, cryptocurrency or tangible property; or
Part voluntarily with money, securities, cryptocurrency or tangible property.
Qualifications & exceptions
Online Scams is marked "Not Included" for Surfshark One+ in the Schedule.
Data Access & Collection · Context
Personally identifying information is information usable for fraud, excluding publicly available details
Personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of a Member, including Social Security numbers, account numbers, passwords or login credentials, or other methods to access or control a computing device or connected home device system identification. It does not include information otherwise available to the public, such as names and addresses. For data breach coverage the definition refers to the affected individual instead of a Member.
Supporting quotations
Personally identifying information
Personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of a Member. This includes, but is not limited to, Social Security numbers, account numbers, passwords or login credentials, or other methods to access or control a computing device or connected home device system identification.
b. With respect to coverage B.2.h. Data Breach, personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of an affected individual.
Personally identifying information does not mean or include information that is otherwise available to the public, such as names and addresses.
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Qualifications & exceptions
A stolen identity event, and therefore coverage, depends on the theft or release of a Member's personally identifying information.
Legal Rights & Agreement Rules · Context
Short definitions: public information, personally sensitive information, primary member, provider, school administrator
Information that is otherwise available to the public, such as names and addresses, is not personally identifying information. Personally sensitive information is private information specific to an individual whose release requires notification of affected individuals under any applicable law. A primary member is a customer in good standing of the provider who is directly enrolled in the insured program at the time the stolen identity event is discovered. The provider is the entity shown as Provider in the Schedule. A school administrator is a principal, vice principal, headmaster or dean.
Supporting quotations
Personally identifying information does not mean or include information that is otherwise available to the public, such as names and addresses.
Personally sensitive information means private information specific to an individual, the release of which requires notification of affected individuals under any applicable law.
Primary member means a person who, at the time of the discovery of the stolen identity event, is a customer in good standing of the provider and is directly enrolled in the insured program.
Provider means the entity providing the insured program and shown as the Provider in the Schedule of this Summary of Benefits.
School administrator means a principal, vice principal, headmaster or dean.
Qualifications & exceptions
These definitions repeat points explained with the Member, personally identifying information and cyberbullying cards.
Security & Safeguards · Restriction or exception
Stolen identity event: theft or release of a Member's personal information
A stolen identity event is the theft, accidental release, publication or misappropriation of a Member's personally identifying information that results in, or could reasonably result in, wrongful use of the information. It includes a cyber attack, cyberbullying, cyber extortion, fraud, home title fraud, data breach or identity theft event, but only to the extent that the corresponding coverages are included in the insured program.
Supporting quotations
Stolen identity event means the theft, accidental release, publication or misappropriation of a Member’s personally identifying information that results in or could reasonably result in the wrongful use of the information.
This includes a cyber attack event, cyberbullying event, cyber extortion event, fraud event, home title fraud event, data breach event or identity theft event, but only to the extent that such corresponding coverages are included in the insured program.
Insured program means the package of products and/or services provided by the provider and shown under the Insured Programs section of the Schedule of this Summary of Benefits.
Personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of a Member.
Qualifications & exceptions
The Schedule includes only Case Management Service and Identity Theft Recovery (with the listed sublimits) for Surfshark One+; the other listed event types are marked "Not Included". The definition covers events that "could reasonably result" in wrongful use, not only completed misuse.
Cross-references
narrows (model-proposed): Cyberbullying coverage reimburses necessary and reasonable cyberbullying costs — narrows: The stolen identity event definition counts the listed event types only to the extent the corresponding coverage is included in the insured program, and the Schedule marks this coverage "Not Included" for Surfshark One+.
narrows (model-proposed): Home Title Fraud coverage pays reasonable and necessary home title fraud costs — narrows: The stolen identity event definition counts the listed event types only to the extent the corresponding coverage is included in the insured program, and the Schedule marks this coverage "Not Included" for Surfshark One+.
narrows (model-proposed): Data Breach coverage pays reasonable and necessary data breach costs — narrows: The stolen identity event definition counts the listed event types only to the extent the corresponding coverage is included in the insured program, and the Schedule marks this coverage "Not Included" for Surfshark One+.
Security & Safeguards · Restriction or exception
System restoration costs cover professional restoration of a device, not hardware, upgrades or the Member's own time
System restoration costs are the costs of a professional firm hired by a Member to restore a computing device or connected home device to its functionality before a cyber attack event: replacing or reinstalling software, removing malicious code, and configuring or correcting configuration. They do not include costs to repair or replace hardware (though the insurer may choose to pay for it if that reduces the loss payable), costs to increase speed, capacity or utility, the Member's time or labor, or costs above the replacement value of the Member's system.
Supporting quotations
System restoration costs means the costs of a professional firm hired by a Member to do the following in order to restore the Member's computing device or connected home device to the level of functionality it had before the cyber attack event:
Replace or reinstall computer software programs;
Remove any malicious code; and
Configure or correct the configuration of the Member's device or system.
Costs to repair or replace hardware. However, we may choose to pay to repair or replace hardware if doing so reduces the amount of loss payable under the policy.
Costs to increase the speed, capacity or utility of the Member's device or system.
The Member's time or labor.
Any costs in excess of the replacement value of the Member's system, including applicable hardware and software.
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Qualifications & exceptions
This serves the Cyber Attack coverage, which the Schedule marks "Not Included" for Surfshark One+.
Charges & Financial Obligations · Restriction or exception
Utility bill overage expenses cover documented extra usage caused by cryptojacking
Utility bill overage expenses are additional expenses a Member incurs to operate the home above what would normally have been incurred in the same period without a cryptojacking event, if the utility provider billed them by written invoices reflecting the extra usage. They do not include expenses incurred before the policy period, or charged at a flat or fixed fee that does not vary with usage. A utility provider is an electrical, internet, natural gas or oil service provider.
Supporting quotations
Utility bill overage expenses means additional expenses incurred by a Member to operate their home over and above the cost that normally would have incurred to operate their home during the same period had no cryptojacking event occurred, provided that such additional expenses are billed to the Member by the Utility Provider via written invoices that reflect the additional utility usage or consumption.
Incurred prior to the policy period for which the policy is applicable; or
Charged at a flat or fixed fee that does not fluctuate with usage.
As used in this definition, Utility Provider means an electrical, internet, natural gas or oil service provider.
Qualifications & exceptions
This serves the Cryptojacking part of Cyber Attack coverage, which the Schedule marks "Not Included" for Surfshark One+.
Legal Rights & Agreement Rules · Restriction or exception
Coverage requires a stolen identity event discovered in the policy period and reported within 60 days
The insurance applies only if all three conditions are met: there has been a stolen identity event involving a Member's personally identifying information; the Member first discovered it during the policy period for which the policy applies; and it was reported to the insurer as soon as practicable and no more than 60 days after the Member first discovered it.
Supporting quotations
This Stolen Identity Event Group Insurance applies only if all of the following conditions are met:
There has been a stolen identity event involving the personally identifying information of a Member; and
Such stolen identity event is first discovered by the Member during the policy period for which the policy is applicable; and
Such stolen identity event is reported to us as soon as practicable, but in no event more than 60 days after the date it is first discovered by the Member.
Qualifications & exceptions
The exclusions add that events discovered before coverage began, or first occurring more than 60 days before coverage began, are not covered.
Not stated here
The document does not state the policy period dates.
Case Management Service provides an identity recovery case manager as needed
If the coverage requirements are met, the insurer provides the Member the services of an identity recovery case manager as needed to respond to the stolen identity event. The Schedule shows this service for 12 months for Surfshark One+ and the Case Management Service and Identity Theft Recovery coverages are not subject to a deductible.
Supporting quotations
If all of the conditions listed above in 1. COVERAGE REQUIREMENTS have been met, then we will provide the Member the following coverages for loss directly arising from such stolen identity event.
Case Management Service
We will provide the services of an identity recovery case manager as needed to respond to the stolen identity event.
Identity recovery case manager means one or more individuals assigned by us to assist a Member with communications we deem necessary for re-establishing the integrity of the personal identity of the Member.
Qualifications & exceptions
The coverage applies to loss "directly arising from" the stolen identity event and only after the requirements are met. The insurer may also provide the service before determining that a covered event occurred, without admitting liability (see the conditions).
Charges & Financial Obligations · Company commitment
Identity Theft Recovery pays reasonable and necessary identity theft costs
If the coverage requirements are met and there has been an identity theft event as a direct result of the stolen identity event, the insurer pays the Member's reasonable and necessary identity theft costs, as defined in the definitions section.
Supporting quotations
If all of the conditions listed above in 1. COVERAGE REQUIREMENTS have been met, then we will provide the Member the following coverages for loss directly arising from such stolen identity event.
Identity Theft Recovery
If there has been an identity theft event as a direct result of such stolen identity event, then we will pay the Member's reasonable and necessary identity theft costs.
Identity theft costs means the following when they are reasonable and necessary costs that are incurred by a Member as a result of a identity theft event:
Identity theft event means the fraudulent use of social security number or other personally identifying information.
Qualifications & exceptions
The Schedule shows a $1,000,000 Identity Theft Recovery limit for Surfshark One+, with sublimits for lost wages and care, counseling and miscellaneous costs; the Member Annual Aggregate Limit also applies; this coverage is not subject to a deductible.
Security & Safeguards · Company commitment
Cyber Attack coverage: data recovery, system restoration, cryptojacking and future loss avoidance
If a cyber attack event occurs as a direct result of a stolen identity event, the policy summary describes four payments: necessary and reasonable data recovery costs, system restoration costs, utility bill overage expenses for cryptojacking, and future loss avoidance costs. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Cyber Attack
If there has been a cyber attack event as a direct result of such stolen identity event, then we will provide the Member the following coverages for loss directly arising from such cyber attack event:
We will pay the Member's necessary and reasonable data recovery costs.
We will pay the Member's necessary and reasonable system restoration costs.
We will pay the Member's necessary and reasonable utility bill overage expenses.
We will pay the Member's necessary and reasonable future loss avoidance costs.
Cryptojacking event means a cyber attack event carried out for the purpose of mining cryptocurrency that causes a Member to incur utility bill overage expenses.
Cyber attack event means one of the following involving a computing device or connected home device:
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. The text is printed in the summary, but for this program the Schedule says the coverage is not included.
Security & Safeguards · Company commitment
Cyber Extortion coverage: expert assistance and reimbursement of response costs
If a cyber extortion event occurs as a direct result of a stolen identity event, the policy summary describes professional assistance from a subject matter expert provided by the insurer on how to respond to the threat, and reimbursement of the Member's necessary and reasonable cyber extortion response costs. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Cyber Extortion
If there has been a cyber extortion event as a direct result of such stolen identity event, then we will provide the Member the following coverages for loss directly arising from such cyber extortion event:
Professional assistance from a subject matter expert provided by us for advice and consultation regarding how best to respond to the threat.
Reimbursement of the Member's necessary and reasonable cyber extortion response costs.
Cyber extortion event means one of the following involving a computing device or connected home device:
Cyber extortion response costs means any payment made as directed in response to a cyber extortion event, but only when that payment is:
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. Response costs are payable only when approved in advance, subject to the exception in the definition.
Charges & Financial Obligations · Company commitment
Online Fraud Reimbursement pays necessary and reasonable fraud costs
If a fraud event, carried out wholly or partly through a computing device or connected home device, happens as a direct result of a stolen identity event, the policy summary describes payment of the Member's necessary and reasonable fraud costs, meaning the direct financial loss only. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Online Fraud Reimbursement
If there has been a fraud event that is wholly or partially perpetrated through a computing device or connected home device as a direct result of such stolen identity event, then we will pay the Member's necessary and reasonable fraud costs.
Fraud costs means the amount fraudulently taken from a Member. This is the direct financial loss only.
Fraud event means any of the following, when such event is wholly or partially perpetrated through a computing device or connected home device and results in direct financial loss to a Member:
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. The limits section describes a separate sublimit for online scams inside the Online Fraud Reimbursement limit.
Security & Safeguards · Company commitment
Cyberbullying coverage reimburses necessary and reasonable cyberbullying costs
If a cyberbullying event happens as a direct result of a stolen identity event, the policy summary describes reimbursement of the Member's necessary and reasonable cyberbullying costs, which are the listed costs incurred within 12 months after the event. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Cyberbullying
If there has been a cyberbullying event as a direct result of such stolen identity event, then we will provide reimbursement for the Member's necessary and reasonable cyberbullying costs.
Cyberbullying costs means the following costs arising as a direct result of a cyberbullying event when incurred by a Member within 12 months after the cyberbullying event:
Cyberbullying event means two or more similar or related cyberbullying acts.
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Charges & Financial Obligations · Company commitment
Home Title Fraud coverage pays reasonable and necessary home title fraud costs
If a home title fraud event happens as a direct result of a stolen identity event, the policy summary describes payment of the Member's reasonable and necessary home title fraud costs. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Home Title Fraud
If there has been a home title fraud event as a direct result of such stolen identity event, then we will pay the Member’s reasonable and necessary home title fraud costs.
Home title fraud costs means:
Home title fraud event means an identity theft event resulting in the wrongful or fraudulent transfer of title to real property from a Member.
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. Identity theft costs under the included Identity Theft Recovery coverage also exclude home title fraud costs.
Use & Processing · Company commitment
Data Breach coverage pays reasonable and necessary data breach costs
If a data breach event happens as a direct result of a stolen identity event, the policy summary describes payment of the Member's reasonable and necessary data breach costs, which are the forensic, legal, notification and affected-individual services described in the definitions. This coverage is marked "Not Included" for Surfshark One+ in the Schedule.
Supporting quotations
Data Breach
If there has been a data breach event as a direct result of such stolen identity event, we will pay the Member’s reasonable and necessary data breach costs.
Data breach costs means:
Qualifications & exceptions
This coverage is marked "Not Included" for Surfshark One+ in the Schedule. The conditions add a pre-notification consultation duty that applies to this coverage.
Legal Rights & Agreement Rules · Restriction or exception
Exclusions apply to all coverages under the policy
The exclusions section says its exclusions apply to all coverages under the policy and that the insurer will not pay for loss, damage or expense caused by or resulting from the listed items.
Supporting quotations
The following exclusions apply to all coverages under the policy.
We will not pay for loss, damage or expense caused by or resulting from:
Qualifications & exceptions
The phrase "caused by or resulting from" ties each exclusion to the cause of the loss, not only to loss that is exclusively that item.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: a Member's criminal, fraudulent or dishonest acts, intentional violations and contributing to the loss
No payment is made for loss caused by or resulting from a Member's criminal, fraudulent or dishonest acts, errors or omissions; a Member's intentional violations of the law; or a Member intentionally initiating or contributing to a covered loss event. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any of the following by a Member:
Criminal, fraudulent or dishonest acts, errors or omissions;
Intentional violations of the law; or
Intentionally initiating or contributing to a covered loss event.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The listed acts include "errors or omissions" that are described as criminal, fraudulent or dishonest; the exclusion does not say how a mistake without such character is treated.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: any criminal investigations or proceedings
Loss, damage or expense caused by or resulting from any criminal investigations or proceedings is excluded. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any criminal investigations or proceedings.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The identity theft costs definition separately lists legal costs for defending criminal charges brought against a Member that arise from a third party using the Member's identity, and the exclusion has no stated exception for it.
Not stated here
The document does not explain how the exclusion for criminal investigations or proceedings fits with the identity theft cost item for defending criminal charges that arise from a third party using the Member's identity.
Cross-references
contrast (model-proposed): Identity theft costs: legal costs need an attorney approved by the insurer — contrast: One provision excludes any criminal investigations or proceedings, while the identity theft costs list includes an approved attorney to defend criminal charges that arise from a third party using the Member's identity. The document states no exception reconciling them.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: third-party liability and legal defense costs, except under Identity Theft Recovery
Any third-party liability or legal defense costs are excluded, except as described in the Identity Theft Recovery coverage. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any third party liability or legal defense costs, except as described in coverage B.2.b. Identity Theft Recovery.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The only exception named is the Identity Theft Recovery coverage; legal costs under other coverages (for example cyberbullying legal expenses) are covered only to the extent those coverages apply, and they are not included for Surfshark One+.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: physical damage, bodily injury, vehicle damage, fines and penalties
Excluded are any physical damage or bodily injury (except as described in the Cyberbullying coverage), any damage to a motor vehicle, watercraft, aircraft or other vehicle, and any fines or penalties. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any physical damage or bodily injury, except as described in coverage B.2.f. Cyberbullying.
Any damage to a motor vehicle, watercraft, aircraft or other vehicle.
Any fines or penalties.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The only exception to the bodily injury exclusion is the Cyberbullying coverage, which is not included for Surfshark One+.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: devices not owned, leased or controlled; business losses; costs to correct deficiencies
Excluded are damage to any device or system that is not owned or leased by a Member or operated under the control of the Member or another Member, loss arising from any business (including a business owned or operated by any Member or one that employs any Member), and, except for the System Restoration portion of Cyber Attack coverage, costs to research or correct any deficiency. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Damage to any device or system that is not owned or leased by a Member, or operated under the Member's control or the control of another Member.
Loss arising from any business, including but not limited to any business owned or operated by any Member or any business employing any Member.
Except as specifically provided under the System Restoration portion of Cyber Attack coverage, costs to research or correct any deficiency.
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The business exclusion reaches any business a Member owns, operates or works for.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: events discovered before coverage began, occurring over 60 days before, and costs over a year after expiration
Excluded are any stolen identity event first discovered by a Member before the Member's coverage began, any stolen identity event first occurring more than 60 days before the Member's coverage began, and any costs or expenses incurred more than one year after the policy's expiration date. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any stolen identity event first discovered by a Member prior to the inception of the Member's coverage under the policy.
Any stolen identity event first occurring more than 60 days prior to the inception of the Member's coverage under the policy.
Any costs or expenses associated with a stolen identity event if such costs or expenses are incurred more than one year from the expiration date of the policy.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
An event that first occurred within 60 days before coverage began is excluded only if it was also first discovered before coverage began; one first occurring more than 60 days before is excluded regardless.
Not stated here
The document does not state when a Member's coverage begins or when the policy expires.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: professional or business identity theft, nuclear hazards and governmental action
Excluded are the theft of a professional or business identity, any nuclear hazard, and any governmental action, meaning destruction, confiscation or seizure of property by order of any governmental or public authority. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
The theft of a professional or business identity.
Any nuclear hazard.
Any governmental action, meaning the destruction, confiscation or seizure of property by order of any governmental or public authority.
Nuclear Hazard means nuclear reaction, radiation or radioactive contamination, or any consequence of any of these, however caused and whether controlled or uncontrolled.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: war, including cyber warfare, and how attribution is decided
War is excluded, including its consequences: cyber warfare (whether or not combined with physical combat), undeclared war, civil war, hostile action by military force or cyber measures (including defensive action) by a Combatant, and insurrection, rebellion, revolution, usurped power, political violence or governmental action against these, including cyber action. Cyber warfare, cyber measures and cyber action include the use of disruptive digital activities against a computer network or system intended to cause harm for political or similar objectives, or to intimidate people to further them, committed by a Combatant, meaning a government, sovereign or other authority or its agents. Attribution to a Combatant relies on reasonable evidence such as statements by an affected government, widely recognized international bodies or alliances, or consensus within relevant expert communities such as the cyber security industry. Decisions about whether war or hostile action exists take into account the full range of tactics, weapons and technologies available at the time. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
War, including the following and any consequence of any of the following:
Cyber warfare, whether or not occurring in combination with physical combat;
Undeclared war;
Civil war;
Hostile action by military force or cyber measures, including action in defending against or hindering an expected or actual attack, by any Combatant; or
Insurrection, rebellion, revolution, usurped power, political violence or action taken by governmental authority in defending against or hindering any of these, including cyber action in connection with any of the foregoing.
For purposes of this exclusion, cyber warfare, cyber measures and cyber action include, but are not limited to, the use of disruptive digital activities against a computer network or system with the intention to cause harm in order to further political or similar objectives, or to intimidate any person(s) in furtherance of such objectives, committed by a Combatant.
The attribution of an action to a Combatant will be determined by relying on reasonable evidence such as:
Statements by an impacted government, sovereign or other authority;
Statements by widely recognized international bodies (such as the United Nations) or alliances (such as the North Atlantic Treaty Organization); or
Consensus opinion within relevant expert communities such as the cyber security industry.
Decisions about the presence or absence of war, hostile action, and other terms used in this exclusion will take into consideration the full range of available tactics, weapons and technologies at the time of the event giving rise to the loss.
Combatant means, for purposes of this exclusion, a government, sovereign or other authority, or agents acting on their behalf.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The exclusion applies to consequences of war and uses broad terms such as "political violence" and "similar objectives".
Not stated here
The document does not say who makes the attribution decision or how a disagreement about it would be resolved.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: third-party network failures, data input errors and investment performance
Excluded are failure, interruption, reduced performance or damage to any electrical power or telecommunication network not owned and operated by a Member (including the internet, internet service providers, DNS providers, cable and wireless providers, internet exchange providers, search engine providers and similar infrastructure providers), any loss resulting directly or indirectly from errors or omissions by a Member or a financial institution in the input or processing of data, and any loss related to the financial performance of investments. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Total or partial failure or interruption of, reduction in performance of, or damage to any electrical power supply network or telecommunication network not owned and operated by a Member including, but not limited to, the internet, internet service providers, Domain Name System (DNS) service providers, cable and wireless providers, internet exchange providers, search engine providers, internet protocol networks (and similar networks that may have different designations) and other providers of telecommunications or internet infrastructure.
Any loss resulting directly or indirectly from any errors or omissions by a Member or a financial institution in the input or processing of data.
Any loss related to the financial performance of any investments.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Account & Service Control · Restriction or exception
Excluded: loss while the primary member is not an active customer in good standing and enrolled
Loss occurring while the primary Member is not an active customer in good standing of the provider and directly enrolled in the insured program is excluded. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any loss occurring while the primary Member is not an active customer in good standing of the provider and directly enrolled in the insured program.
Primary member means a person who, at the time of the discovery of the stolen identity event, is a customer in good standing of the provider and is directly enrolled in the insured program.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The primary member definition tests status at discovery of the stolen identity event; this exclusion tests status when the loss occurs.
Not stated here
The document does not define "customer in good standing" or say what happens to a loss that straddles a lapse in enrollment.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: Members whose primary residence is in New York or Washington state
Any Member whose primary residence is located in New York or Washington state is excluded. This document is titled as covering the United States except Washington, and the Schedule does not mention New York. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any Member whose primary residence is located in New York or Washington state.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Not stated here
The document does not say why New York residents are excluded here although only Washington is named in the title, or whether a separate document covers New York.
Legal Rights & Agreement Rules · Restriction or exception
Excluded: losses claimed by the provider, uninsurable amounts and sanctions-law conflicts
Excluded are any loss claimed by the provider, any amount not insurable under applicable law, and any provision of coverage to the extent it would expose the Member or provider to a violation of economic or trade sanctions, laws or regulations of the United States or any other jurisdiction whose laws the insurer is legally obliged to comply with. This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Supporting quotations
Any loss claimed by the provider.
Any amount not insurable under applicable law.
Any provision of coverage under the policy to the extent that such provision would expose the Member or provider to a violation of economic or trade sanctions, laws or regulations of the United States of America or any other jurisdiction with whose laws we are legally obligated to comply.
Provider means the entity providing the insured program and shown as the Provider in the Schedule of this Summary of Benefits.
Qualifications & exceptions
This exclusion applies to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Charges & Financial Obligations · Restriction or exception
Member Annual Aggregate Limit caps all coverages for a policy period
The Member Annual Aggregate Limit shown in the Schedule is the most the insurer will pay for all loss, damage or expense for any one Member during any one policy period, across all coverages. If the insured program includes family coverage, it is the most for all Members associated with one primary member. It applies to the total of all loss arising from all stolen identity events discovered during that policy period. The Schedule shows $1,000,000 for Surfshark One+.
Supporting quotations
The Member Annual Aggregate Limit shown in the Schedule of this Summary of Benefits under the applicable insured program is the most we will pay for all loss, damage or expense for any one Member arising during any one policy period for all coverages provided by the policy.
If the insured program includes coverage for family Members, then the Member Annual Aggregate Limit is the most we will pay for all loss, damage or expense for all Members associated with any one primary member for all coverages provided by the policy.
This limit shall apply to the total of all loss, damage or expense arising from all stolen identity events discovered during such policy period.
Such stolen identity event is first discovered by the Member during the policy period for which the policy is applicable; and
Insured program means the package of products and/or services provided by the provider and shown under the Insured Programs section of the Schedule of this Summary of Benefits.
Qualifications & exceptions
The Schedule shows no family coverage for Surfshark One+, so the family wording does not appear to apply to this program.
Not stated here
The document does not state the length or dates of the policy period.
Charges & Financial Obligations · Restriction or exception
Each coverage has its own aggregate limit; occurrences spanning periods fall under the first period's limit
The Coverage Aggregate Limit for each coverage shown in the Schedule is the most the insurer will pay for all loss for any one Member in one policy period for that coverage, and for all Members associated with one primary member if the program includes family coverage. It applies to the total of all loss from stolen identity events discovered in that policy period. If any occurrence causes loss in more than one policy period, all of it is subject to the Member Annual Aggregate Limit of the first policy period in which the occurrence was discovered.
Supporting quotations
The Coverage Aggregate Limit for each coverage shown in the Schedule of this Summary of Benefits under the applicable insured program is the most we will pay for all loss, damage or expense for any one Member arising during any one policy period for such coverage.
If the insured program includes coverage for family members, then the Coverage Aggregate Limit is the most we will pay for all loss, damage or expense for all Members associated with any one primary member for such coverage.
If any occurrence causes loss, damage or expense in more than one policy period, all such loss, damage and expense will be subject to the Member Annual Aggregate Limit of the first policy period in which the occurrence was discovered.
Occurrence means all stolen identity events, cyber attack events, cyberbullying event, cyber extortion events, data breach events, fraud events, home title fraud events or identity theft events that:
Qualifications & exceptions
For Surfshark One+ the Schedule shows the Identity Theft Recovery limit as $1,000,000 and the Case Management Service as a 12-month duration, not a dollar limit.
Charges & Financial Obligations · Restriction or exception
Legal, lost wages and care, counseling and miscellaneous sublimits sit inside the Identity Theft Recovery limit
Four sublimits shown in the Schedule apply within Identity Theft Recovery: legal costs; lost wages and child and elder care (jointly); mental health counseling; and miscellaneous unnamed costs. Each is part of, and not in addition to, the Identity Theft Recovery limit. Lost wages and care costs must be wages lost or costs incurred within 12 months after the Member first discovers the stolen identity event, and the counseling and miscellaneous costs must also be incurred within those 12 months. The legal costs paragraph states no 12-month limit.
Supporting quotations
The Legal Costs as provided under item d. of the definition of identity theft costs are subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit.
Item e. (Lost Wages) and item f. (Child and Elder Care Expenses) of the definition of identity theft costs are jointly subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit. Coverage is limited to wages lost and costs incurred within 12 months after the first discovery of the stolen identity event by the Member.
Item g. (Mental Health Counseling) of the definition of identity theft costs is subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit. Coverage is limited to costs incurred within 12 months after the first discovery of the stolen identity event by the Member.
Item h. (Miscellaneous Unnamed Costs) of the definition of identity theft costs is subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit. Coverage is limited to costs incurred within 12 months after the first discovery of the stolen identity event by the Member.
Identity theft costs means the following when they are reasonable and necessary costs that are incurred by a Member as a result of a identity theft event:
Qualifications & exceptions
The Schedule shows $5,000 for lost wages and child and elder care, $1,000 for counseling and $1,000 for miscellaneous costs; for legal costs it shows "Included" with no dollar amount.
Not stated here
No separate dollar sublimit for legal costs is shown in the Schedule, so the effective legal costs cap is not stated apart from the overall Identity Theft Recovery limit.
contrast (model-proposed): Schedule for Surfshark One+: included coverages and limits — contrast: The limits section says legal costs are subject to a sublimit "shown in the Schedule", but the Schedule shows Legal Costs only as "Included" with no amount.
Charges & Financial Obligations · Restriction or exception
Online scam fraud costs have a sublimit inside Online Fraud Reimbursement
Fraud costs resulting from online scams are subject to a sublimit shown in the Schedule, which is part of, and not in addition to, the Online Fraud Reimbursement limit. Online Fraud Reimbursement and Online Scams are marked "Not Included" for Surfshark One+.
Supporting quotations
Fraud costs resulting from Item a.(5). (online scams) of the definition of fraud event is subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Online Fraud Reimbursement Coverage Limit.
Online scams means intentional and criminal deception of a Member, perpetrated partially or wholly through a computing device or connected home device, to induce the Member to:
Qualifications & exceptions
The Schedule marks the related coverages "Not Included" for Surfshark One+.
Charges & Financial Obligations · Restriction or exception
Insurer pays only the part above the Member Deductible; case management and identity theft recovery have none
The insurer pays only the part of the total payable loss that exceeds the Member Deductible shown in the Schedule, up to the applicable limits, and the Member is responsible for the deductible if one is shown. The Case Management Service and Identity Theft Recovery coverages are not subject to a deductible.
Supporting quotations
We will pay only that part of the total payable loss that exceeds the Member Deductible shown in the Schedule of this Summary of Benefits under the applicable insured program, subject to the applicable limits shown in the Schedule of this Summary of Benefits.
The Member will be responsible for the applicable Member Deductible under the applicable insured program, if shown in the Schedule of this Summary of Benefits.
Case Management Service and Identity Theft Recovery coverages are not subject to a deductible.
Qualifications & exceptions
The Schedule for Surfshark One+ shows no deductible row, and the only coverages it includes are Case Management Service and Identity Theft Recovery, which are not subject to a deductible.
Legal Rights & Agreement Rules · Restriction or exception
Conditions apply to all coverages; assignment needs the insurer's written consent
The conditions section applies to all coverages under the policy. Assignment of the policy is not valid unless the insurer gives written consent.
Supporting quotations
The following conditions apply to all coverages under the policy:
Assignment of the policy will not be valid unless we give our written consent.
Account & Service Control · Procedure
Assistance line, pre-determination case management and 60-day documents request
For Case Management Service, the Member should call the Identity Recovery Help Line, which can give information and advice on responding to a possible stolen identity event. The insurer may sometimes provide Case Management Service at its expense before determining that a covered stolen identity event occurred, without admitting liability, and may deny further coverage or service if it later determines no covered event occurred. For Identity Theft Recovery, the Member must send receipts, bills or other records supporting the claim to the insurer within 60 days after the insurer asks for them.
Supporting quotations
With respect to Case Management Service, for assistance the Member should call the Identity Recovery Help Line. The Identity Recovery Help Line can provide the Member with information and advice for how to respond to a possible stolen identity event.
In some cases, we may provide Case Management Service at our expense to a Member prior to a determination that a covered stolen identity event has occurred. Our provision of such services is not an admission of liability under the policy. We reserve the right to deny further coverage or service if, after investigation, we determine that a covered stolen identity event has not occurred.
With respect to Identity Theft Recovery Coverage, the Member must send receipts, bills or other records that support his or her claim for identity theft costs to us within 60 days after our request.
Not stated here
The document does not give a telephone number or address for the Identity Recovery Help Line or for sending claim records.
Legal Rights & Agreement Rules · Company commitment
Bankruptcy or insolvency of a Member or provider does not relieve the insurer
The insurer's obligations under the policy are not relieved by the bankruptcy or insolvency of a Member or the provider.
Supporting quotations
Our obligations under the policy will not be relieved by the bankruptcy or insolvency of a Member or provider.
Qualifications & exceptions
This does not address the insurer's own insolvency; the opening notice says insureds or claimants will not be eligible for insurance guaranty fund protection if the insurer becomes insolvent.
Legal Rights & Agreement Rules · Restriction or exception
The insurer may cancel the policy only for stated reasons and notice periods
The insurer may cancel the policy only for stated reasons, by written notice to the provider (delivered, or mailed to the provider's address, with proof of mailing sufficient). It may cancel on at least 10 days' notice if the provider has not paid the premium, or for any reason on at least 10 days' notice if the policy has been in effect for less than 60 days and is not a renewal. For a renewal or a policy in effect 60 days or more, it may cancel on at least 90 days' notice for a material misrepresentation that would have stopped it issuing the policy, or if the risk has changed substantially since issue. If the policy is written for more than one year, it may cancel for any reason at the anniversary on at least 90 days' notice.
Supporting quotations
We may cancel the policy only for the reasons stated below by informing the provider in writing of the date cancellation takes effect. This cancellation notice may be delivered to the provider, or mailed to the provider at their mailing address shown in the Declarations of the policy. Proof of mailing will be sufficient proof of notice.
When the provider has not paid the premium, we may cancel at any time by letting the provider know at least 10 days prior to the date cancellation takes effect.
When the policy has been in effect for less than 60 days and is not a renewal with us, we may cancel for any reason by letting the provider know at least 10 days prior to the date cancellation takes effect.
When the policy is a renewal with us or has been in effect for 60 days or more, we may cancel:
If there has been a material misrepresentation which if known to us would have caused us not to issue the policy; or
If the risk has changed substantially since the policy was issued.
This can be done by letting the provider know at least 90 days before the date cancellation takes effect.
When the policy is written for a period of more than one year, we may cancel for any reason at anniversary by letting the provider know at least 90 days before the cancellation takes effect.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Notice goes to the provider, not to Members; the provider is responsible for informing Members.
Not stated here
The Declarations of the policy, which would show the provider's mailing address and the policy term, are not part of this document.
Legal Rights & Agreement Rules · Restriction or exception
The provider may cancel at any time; premium refunds and member notice are the provider's job
The provider may cancel the policy at any time by telling the insurer in writing the date cancellation is to take effect. On cancellation the premium from the cancellation date to expiration is refunded pro rata, and if the return premium is not refunded with the notice or when the policy is returned, the insurer refunds it within a reasonable time after cancellation takes effect. The provider is responsible for informing Members of a non-renewal or cancellation of the policy.
Supporting quotations
The provider may cancel the policy at any time by informing us in writing of the date cancellation is to take effect.
When the policy is cancelled, the premium for the period from the date of cancellation to the expiration date will be refunded pro rata.
If the return premium is not refunded with the notice of cancellation or when the policy is returned to us, we will refund it within a reasonable time after the date cancellation takes effect.
The provider is responsible for informing Members of a non-renewal or cancellation of the policy.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Not stated here
The refund goes to the provider as policyholder; the document does not say whether any part reaches Members.
Account & Service Control · Restriction or exception
Member coverage ends with the primary member's enrollment or the policy, whichever is earlier
A Member's coverage under the policy ends when the primary member's enrollment in the insured program ends or when the policy terminates in accordance with its terms, whichever is earlier.
Supporting quotations
Member coverage under the policy shall terminate upon the termination of the primary member’s enrollment in the insured program or the termination of the policy, in accordance with the terms of the policy, whichever is earlier.
Primary member means a person who, at the time of the discovery of the stolen identity event, is a customer in good standing of the provider and is directly enrolled in the insured program.
Insured program means the package of products and/or services provided by the provider and shown under the Insured Programs section of the Schedule of this Summary of Benefits.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The opening description says entitlement ends when enrollment in "any Insured Program" ends; this condition refers to the primary member's enrollment in "the insured program".
Not stated here
The document does not say what happens to a claim for an event discovered before enrollment ended.
Legal Rights & Agreement Rules · Restriction or exception
The policy changes only by endorsement, and the provider informs Members
The policy contains all the agreements between the provider and the insurer about the insurance. The provider is authorized to make changes to the policy's terms with the insurer's consent, but the terms can be waived or amended only by an endorsement the insurer issues. The provider is responsible for informing Members of any changes.
Supporting quotations
The policy contains all the agreements between the provider and us concerning the insurance afforded. The provider shown in the Schedule of this Summary of Benefits is authorized to make changes in the terms of the policy with our consent. The policy’s terms can be waived or amended only by endorsement issued by us and made a part of the policy. The provider is responsible for informing Members of any changes to the policy.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Not stated here
The document does not say how or when the provider must inform Members of changes.
Legal Rights & Agreement Rules · Restriction or exception
No coverage for a Member who conceals, defrauds or makes false statements about the insurance
The insurer does not provide coverage to a Member who, whether before or after a loss, intentionally concealed or misrepresented any material fact or circumstance, engaged in fraudulent conduct, or made false statements relating to this insurance.
Supporting quotations
We do not provide coverage to a Member who, whether before or after a loss, has:
Intentionally concealed or misrepresented any material fact or circumstance;
Engaged in fraudulent conduct; or
Made false statements; relating to this insurance.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Security & Safeguards · Restriction or exception
Members must avoid divulging the existence of Cyber Extortion coverage
For Cyber Extortion coverage, Members must make every reasonable effort to avoid divulging the existence of the coverage. Cyber Extortion is marked "Not Included" for Surfshark One+.
Supporting quotations
With respect to Cyber Extortion coverage, Members must make every reasonable effort to avoid divulging the existence of this coverage.
Qualifications & exceptions
The Schedule marks Cyber Extortion "Not Included" for Surfshark One+.
Security & Safeguards · Restriction or exception
Members must use due diligence to prevent and mitigate covered costs
Members must agree to use due diligence to prevent and mitigate costs covered under the policy, including complying with reasonable and widely practiced steps for providing and maintaining appropriate system and data security and for maintaining and updating backups of electronic data at appropriate intervals.
Supporting quotations
Members must agree to use due diligence to prevent and mitigate costs covered under the policy. This includes, but is not limited to, complying with reasonable and widely-practiced steps for:
Providing and maintaining appropriate system and data security; and
Maintaining and updating at appropriate intervals backups of electronic data.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The list is introduced with "includes, but is not limited to", so the due diligence duty is broader than the two steps named.
Not stated here
The document does not say what happens to a claim if a Member did not take these steps, other than the general duties after loss.
Account & Service Control · Procedure
After a loss: give prompt notice and notify police, school administrator or card company as applicable
In case of a loss, the Member or the Member's representative must perform the listed duties; if failure to comply is prejudicial to the insurer, the insurer has no duty to provide coverage. The duties include giving prompt notice to the insurer, notifying the police if there has been a violation of the law, notifying the police or a school administrator in case of a cyberbullying event, and notifying the bank, credit card or electronic fund transfer card or access device company in case of a fraud event involving a bank card, credit card or check.
Supporting quotations
In case of a loss, the following duties must be performed either by the Member or the Member's representative. If failure to comply with these duties is prejudicial to us, we have no duty to provide coverage under the policy:
Give prompt notice to us;
Notify the police if there has been a violation of the law;
Notify the police or a school administrator in case of a cyberbullying event;
Notify the bank, credit card or electronic fund transfer card or access device company in case of a fraud event involving a bank card, credit card or check;
School administrator means a principal, vice principal, headmaster or dean.
Cyberbullying event means two or more similar or related cyberbullying acts.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The consequence is limited by "if failure to comply with these duties is prejudicial to us": the insurer has no duty to provide coverage only where non-compliance prejudices it.
Not stated here
"Prompt notice" has no stated number of days here, while the coverage requirements require the event to be reported as soon as practicable and within 60 days of discovery.
Account & Service Control · Procedure
Cooperation: information within 30 days, device inspection and a sworn proof of loss within 60 days
The Member must cooperate with the insurer in the investigation or settlement. Within 30 days after the insurer asks, the Member must provide a description of how, when and where the stolen identity event occurred, written reports of service providers who took part in the investigation or response, written reports or correspondence with law enforcement or any government authority, and any additional information requested. As reasonably required, the Member must permit the insurer or its appointee to inspect and audit the computing device, connected home device and records; additional expenses for that are paid by the insurer, in addition to and not part of the Member Annual Aggregate Limit, if approved in advance. The Member must send signed, sworn proof of loss within 60 days after the insurer asks, and the insurer supplies the forms.
Supporting quotations
Cooperate with us in the investigation or settlement as follows:
Provide the following information within 30 days after our request:
A description of how, when and where the stolen identity event occurred.
Written reports of any service providers who participated in the investigation of or response to the stolen identity event.
Written reports or correspondence to or from law enforcement or any governmental authority or agency, or similar organization.
Any additional information we request relevant to the investigation of the stolen identity event.
As may be reasonably required, permit us or a third party appointed by us to inspect and audit the computing device, connected home device, and any records. Any additional expenses related to this Condition F.9.e.(2) will be paid by us and will be in addition to, and not part of, the Member Annual Aggregate Limit. We must approve such expenses in advance.
Send us signed, sworn proof of loss that contains the information we request to investigate the stolen identity event. This must be done within 60 days after our request. We will supply the necessary forms.
Computing device means a desktop, laptop or tablet computer or Wi-Fi router or other internet access point.
Connected home device means any electronic device, other than a computing device, that connects to the internet or to other electronic devices.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The duties are part of the duties after loss; the earlier sentence says the insurer has no duty to provide coverage if failure to comply is prejudicial to it.
Legal Rights & Agreement Rules · Restriction or exception
The insurer is not the legal advisor of Members or the provider
The insurer says it is not the legal advisor of the Members or the provider, and its determination of what is or is not insured does not represent advice or counsel about what a Member should or should not do.
Supporting quotations
We are not the Members' or provider’s legal advisor. Our determination of what is or is not insured under the policy does not represent advice or counsel from us about what a Member should or should not do.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Legal Rights & Agreement Rules · Restriction or exception
The insurer may decline to renew on 90 days' written notice to the provider
The insurer may elect not to renew the policy by delivering or mailing written notice to the provider at the mailing address shown in the Declarations at least 90 days before the policy's expiration date. Proof of mailing is sufficient proof of notice.
Supporting quotations
We may elect not to renew the policy. We may do so by delivering to the provider, or mailing to the provider at their mailing address shown in the Declarations of the policy, written notice at least 90 days before the expiration date of the policy. Proof of mailing will be sufficient proof of notice.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Notice goes to the provider, which is responsible for informing Members of a non-renewal.
Charges & Financial Obligations · Restriction or exception
The policy is excess over other insurance, warranties and service contracts
The insurer will be excess over any other insurance (including cyber insurance), product warranty, extended services agreement or contract. The policy is specifically excess of any cyber insurance policy the Member carries and of any other insurance the Member has that applies to a loss under the policy.
Supporting quotations
We shall be excess over any other insurance (including, without limitation, cyber insurance), product warranty, extended services agreement or contract. The policy is specifically excess of any cyber insurance policy carried by the Member, in addition to any other insurance carried by the Member that applies to a loss under the policy.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Not stated here
The document does not say how the insurer coordinates payment with other coverage in practice or what a Member must show about other insurance.
Use & Processing · Procedure
Data breach pre-notification: consult the insurer, use its suggested service provider or an approved one
For Data Breach coverage, the Member agrees to consult the insurer before notifying affected individuals; the insurer assumes no responsibility for services promised to affected individuals without its prior agreement. The insurer suggests a service provider for notification and services; if the Member prefers an alternate provider, it must be approved by the insurer and payment will not exceed what the insurer would have paid using its suggested provider. At the consultation the Member provides contact information about the affected individuals, information about the breach that may appropriately be communicated, and the scope of services desired, which may be structured to provide fewer services to more people without exceeding the limit. Data Breach is marked "Not Included" for Surfshark One+.
Supporting quotations
The Member agrees to consult with us prior to the issuance of notification to affected individuals under coverage B.2.h. Data Breach. We assume no responsibility for any services promised to affected individuals without our prior agreement.
We will suggest a service provider for Notification to Affected Individuals and Services to Affected Individuals. If the Member prefers to use an alternate service provider, our coverage is subject to the following limitations:
Such alternate service provider must be approved by us; and
Our payment for services provided by any alternate service provider will not exceed the amount that we would have paid using the service provider we had suggested.
The Member will provide us and the service provider the following at our pre-notification consultation with the Member:
Requested information about the affected individuals to be notified, including contact information;
Information about the data breach event that may appropriately be communicated with affected individuals; and
The scope of services that the Member desires for the affected individuals. For example, coverage may be structured to provide fewer services in order to make those services available to more affected individuals without exceeding the available limit of coverage.
Qualifications & exceptions
The Schedule marks Data Breach "Not Included" for Surfshark One+.
Charges & Financial Obligations · Restriction or exception
Premium rates are fixed until renewal, with narrow exceptions, and invoiced to the provider
The premium shown in the Declarations was computed on rates in effect when the policy was issued. Other than a documented and verifiable change in applicable insurance premium taxes or in legal or regulatory requirements that requires a change in rates, the insurer will modify rates only on the renewal effective date. Premium is calculated under the reporting and rates shown in the Declarations, prorated over the Reporting Period, and the insurer issues a premium invoice to the provider within ten business days after receiving the report.
Supporting quotations
The premium shown in the Declarations of the policy was computed based on rates in effect at the time the policy was issued. Other than documented and verifiable change in applicable insurance premium taxes or legal or regulatory requirements requiring a change in the rates, we will only modify rates on the renewal effective date of the policy.
Premium will be calculated in accordance with the reporting and the rates shown in the Declarations of the policy, prorated based on the Reporting Period shown in the Declarations of the policy. We will issue a premium invoice to the provider within ten (10) business days of receipt of such reporting.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The premium is charged to the provider, not to Members.
Not stated here
The Declarations (rates, Reporting Period) are not part of this document.
Account & Service Control · Restriction or exception
Services are paid only if provided by service providers the insurer approves
The insurer pays under the policy only for services provided by service providers it has approved, and Members must obtain its prior approval for any provider whose expenses they want covered; the insurer will not unreasonably withhold approval. Members have a direct relationship with service providers paid for in whole or part under the policy, and those firms work for the Members.
Supporting quotations
We will only pay under the policy for services that are provided by service providers approved by us. Members must obtain our prior approval for any service provider whose expenses they want covered under the policy. We will not unreasonably withhold such approval.
Members will have a direct relationship with service providers paid for in whole or in part under the policy. Those firms work for the Members.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Account & Service Control · Restriction or exception
No guarantee that services are available to everyone or will end all problems
For services provided by service providers paid for under the policy, the effectiveness of the services depends on the Members' cooperation and assistance. The insurer does not warrant or guarantee that services will be available or applicable to all individuals; for example, under Identity Theft Recovery Coverage Members who are minors or foreign nationals may not have credit records that can be provided or monitored, and service in Canada will differ from service in the United States and Puerto Rico. It also does not warrant or guarantee that the services will end or eliminate all problems associated with the covered events.
Supporting quotations
With respect to any services provided by any service provider paid for in whole or in part under the policy:
The effectiveness of such services depends on Members' cooperation and assistance.
We do not warrant or guarantee that services will be available or applicable to all individuals. For example, under Identity Theft Recovery Coverage, Members who are minors or foreign nationals may not have credit records that can be provided or monitored. Service in Canada will be different from service in the United States and Puerto Rico.
We do not warrant or guarantee that the services will end or eliminate all problems associated with the covered events.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
The examples (minors, foreign nationals, Canada) are given as "for example" and are not a complete list.
Cross-references
qualifies (model-proposed): Victims get access to a licensed identity theft investigator — qualifies: The policy gives no guarantee that services will be available to everyone or will end all problems, which qualifies the opening statement about the investigator's help.
Legal Rights & Agreement Rules · Restriction or exception
No suit against the insurer without full compliance and filing within two years of the loss
No action can be brought against the insurer unless there has been full compliance with all of the terms and conditions of the policy and the action is started within two years after the date of loss.
Supporting quotations
No action can be brought against us unless there has been full compliance with all of the terms and conditions of the policy and the action is started within two years after the date of loss.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Legal Rights & Agreement Rules · Restriction or exception
Rights to recover damages from others transfer to the insurer to the extent of its payment
If a Member for whom the insurer makes payment has rights to recover damages from another, those rights transfer to the insurer to the extent of its payment. The Member must do everything necessary to secure the insurer's rights and must do nothing after loss to impair them.
Supporting quotations
If any Member for whom we make payment under the policy has rights to recover damages from another, those rights are transferred to us to the extent of our payment. The Member must do everything necessary to secure our rights and must do nothing after loss to impair them.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Legal Rights & Agreement Rules · Restriction or exception
Disputes about the policy are governed by Arizona law
Any dispute arising out of or related to the policy, or the application or interpretation of the policy, is governed by the laws of the state of Arizona, without giving effect to the principles of conflict of laws.
Supporting quotations
Any dispute arising out of or related to the policy, or with respect to the application of or the interpretation of the policy, shall be governed by the laws of the state of Arizona, without giving effect to the principles of conflict of laws.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.
Not stated here
Although the condition is titled "Venue and Choice of Law", the text states only a governing law and names no court or venue.
Legal Rights & Agreement Rules · Restriction or exception
A change or waiver of a policy provision must be in writing by the insurer
A change or waiver of a provision of the policy must be in writing by the insurer to be valid. The insurer's request for an appraisal or examination does not waive any of its rights.
Supporting quotations
A change or waiver of a provision of the policy must be in writing by us to be valid. Our request for an appraisal or examination will not waive any of our rights.
Qualifications & exceptions
These conditions apply to all coverages under the policy, including the Identity Theft Recovery and Case Management Service coverages that the Schedule includes for Surfshark One+.