Identity Theft Coverage Summary of Benefits — Washington

Surfshark · Official agreement

83 cards.

Identity Protection Benefits

Identity Theft Recovery

Victims of an identity theft can get reimbursed for expenses incurred in the process of restoring their identity, up to $1,000,000. Eligible expenses include:

• Credit bureau reports

• Replacement of documents, application fees, notaries, postage

• Legal fees necessary to undo the negative effects of the identity theft

• Lost wages and child/elder care for time taken to address the identity theft (up to $5,000)

• Mental health counseling (up to $1,000)

• Other miscellaneous expenses (up to $1,000)

Additionally, victims are given access to a licensed identity theft investigator who can provide professional assistance and guide them through the process to correct their credit history or identity records. Investigators can do the majority of the work required to restore an identity on a victim’s behalf, providing peace of mind.

Please review the following Summary of Benefits for additional details on your Identity Protection Benefits.

Stolen Identity Event Group Insurance Summary of Benefits

This contract is registered and delivered as a surplus line coverage under the insurance code of the state of Washington, Title 48 RCW. It is not protected by any Washington state guaranty association law. Corey Dunbar, HSB Associates, Inc.

This Summary of Benefits document provides only a summary of the benefits entitled to you as a customer of Cyber Protection Insurance Services Inc., the policyholder of a group policy (“the policy”). Based on the specific service package you are enrolled in, benefits may vary, as outlined below. This is a summary only. Additional terms and conditions apply. A copy of the policy will be made available upon request. Refer to the full policy for all terms, conditions, and exclusions. Your entitlement to benefits under the group policy will terminate upon termination of your enrollment in any Insured Program.

Schedule

Insuring Company

| Name | HSB Specialty Insurance Company |

| Mailing Address | One State Street, P.O. Box 5024, Hartford, Connecticut 06102-5024 |

Provider Details

| Provider | Cyber Protection Insurance Services Inc. |

| Mailing Address | 20860 N. Tatum Blvd., Suite 300, Phoenix, AZ 85050 |

Insured Programs

| Insured Program Name | Surfshark One+ |

| Coverage Type | Individual |

| Coverage Aggregate Limits | |

| Case Management Service | 12 months |

| Identity Theft Recovery | $1,000,000 |

| Legal Costs | Included |

| Lost Wages and Child and Elder Care Expenses | $5,000 |

| Mental Health Counseling | $1,000 |

| Miscellaneous Unnamed Costs | $1,000 |

| Cyber Attack | Not Included |

| Cyber Extortion | Not Included |

| Online Fraud Reimbursement | Not Included |

| Online Scams | Not Included |

| Cyberbullying | Not Included |

| Home Title Fraud | Not Included |

| Data Breach | Not Included |

| Member Details | |

| Member Annual Aggregate Limit | $1,000,000 |

SIE SBS WA 09 25

© 2025, HSB Specialty Insurance Company. All rights reserved. Page 1 of 1

Stolen Identity Event Group Insurance Summary of Benefits

The words “we”, “us” and “our” refer to the Insuring Company shown in the Schedule of this Summary of Benefits. Titles given to paragraphs throughout this Summary of Benefits are for assistance in finding applicable provisions. Titles do not grant, define or restrict coverage.

A. DEFINITIONS

a. Affected individual must be someone whose personally identifying information or personally sensitive information is in the possession of a Member because of:

(1) A family or personal relationship with a Member; or

(2) The activities or responsibilities of a Member in connection with volunteer work for a non-profit organization.

b. Affected individual does not mean or include any of the following:

(1) Any Member.

(2) Anyone whose personally identifying information or personally sensitive information is in the possession of a Member because of the activities or responsibilities, of any Member in connection with a for-profit organization or in connection with a non-profit organization for which a Member is a paid employee or contract worker. Such organizations include, but are not limited to, organizations that a Member owns or operates.

(3) Any business, organization or entity. Only an individual person may be an affected individual.

a. Smart phones;

b. Thermostats;

c. Entertainment systems;

d. Appliances;

e. Smoke, fire and home security monitoring systems; or

f. Cameras.

Such device must be owned or leased by a Member, as well as operated under the Member's control.

a. Unauthorized Access or Use – meaning the gaining of access to a Member's device or system by an unauthorized person or persons or by an authorized person or persons for unauthorized purposes.

b. Malware Attack – meaning damage to a Member's device, system or data arising from malicious code, including viruses, worms, Trojans, spyware and keyloggers. This does not mean damage from shortcomings or mistakes in legitimate electronic code or damage from code installed on the Member's computer system during the manufacturing process.

SIE SB WA 09 25

a. A demand for money or other consideration based on a credible threat to damage, disable, deny access to or disseminate content from a Member's device, system or data; or

b. A demand for money or other consideration based on an offer to restore access or functionality in connection with an attack on a Member's device, system or data.

a. Incurred as a direct result of a cyber extortion event directed against a Member; and

b. Approved in advance by us. However, we may pay for cyber extortion response costs that were not approved in advance by us if we determine the following:

(1) It was not practical for the Member to obtain our prior approval; and

(2) If consulted at the time, we would have approved the payment.

a. Costs for counseling from a licensed mental health professional for the victim of the cyberbullying event;

b. Temporary relocation expenses;

c. Temporary private tutoring;

d. Enrollment expenses incurred due to relocation to a similar, alternate school. This does not include tuition costs;

e. Professional cybersecurity consultation services;

f. The purchase of mobile applications, social monitoring software and web-based products when used to prevent further occurrence of cyberbullying events;

g. Legal expenses, including legal expenses for the removal of online content related to the cyberbullying event; and

h. Lost wages, childcare and eldercare expenses.

a. Report such cyberbullying event to a school administrator or law enforcement; or

b. Require treatment by a licensed medical or mental health practitioner who is a not a Member of the Member's immediate family. At our discretion, when such treatment is required, we reserve the right to require the Member to submit to an independent medical exam.

For the purposes of this coverage, the cyberbullying event begins on the date of the first similar or related cyberbullying act.

a. Forensic IT Review

Professional information technologies review if needed to determine, within the constraints of what is possible and reasonable, the nature and extent of the data breach event and the number and identities of the affected individuals.

This does not include costs to analyze, research or determine any of the following:

(1) Vulnerabilities in systems, procedures or physical security;

(2) Compliance with security standards; or

(3) The nature or extent of loss or damage to data that is not personally identifying information or personally sensitive information.

If there is reasonable cause to suspect that a covered data breach event may have occurred, we will pay for costs covered under Forensic IT Review, even if it is eventually determined that there was no covered data breach event. However, once it is determined that there was no covered data breach event, we will not pay for any further costs.

b. Legal Review Professional legal counsel review of the data breach event and how a Member should best respond to it.

If there is reasonable cause to suspect that a covered data breach event may have occurred, we will pay for costs covered under Legal Review, even if it is eventually determined that there was no covered data breach event. However, once it is determined that there was no covered data breach event, we will not pay for any further costs.

c. Notification to Affected Individuals

The Member’s necessary and reasonable costs to provide notification of the data breach event to affected individuals.

d. Services to Affected Individuals

This coverage only applies if the Member has provided notification of the data breach event to affected individuals as covered under paragraph c. above.

The Member’s necessary and reasonable costs to provide the following services to affected individuals.

(1) The following services apply to any data breach event:

(a) Informational Materials

A packet of loss prevention and customer support information.

(b) Help Line

A toll-free telephone line for affected individuals with questions about the data breach event. Where applicable, the line can also be used to request additional services as listed in (2) (a) and

(b) below.

(2) The following additional services apply to data breach events involving personally identifying information.

(a) Credit Report and Monitoring

A credit report and an electronic service automatically monitoring for activities affecting an individual’s credit records. This service is subject to the affected individual enrolling for this service with the designated service provider.

(b) Identity Restoration Case Management

With respect to any affected individual who is or appears to be a victim of identity theft event that may reasonably have arisen from the data breach event, the services of an identity restoration professional who will assist that affected individual through the process of correcting credit and other records and, within the constraints of what is possible and reasonable, restoring control over his or her personal identity.

a. Data breach event means the loss, theft, accidental release or accidental publication of personally identifying information or personally sensitive information as respects one or more affected individuals. At the time of the breach, such information must be in the care, custody or control of:

(1) A Member; or

(2) A professional entity with whom a Member has a contract and to whom a Member has entrusted the information.

b. With respect to coverage B.2.h. Data Breach, if the date of the data breach event as defined in a. above cannot be determined, such date shall be deemed to be the date a Member first become aware of the loss, theft, release or publication of the personally identifying information or personally sensitive information.

a. Data recovery costs means the costs of a professional firm hired by a Member to replace electronic data that has been lost or corrupted.

b. Data recovery costs does not mean costs to research, re-create or replace any of the following:

(1) Software programs or operating systems that are not commercially available.

(2) Data that cannot reasonably be replaced. This includes, but is not limited to, personal photos, movies or recordings for which no electronic back-up is available.

(3) Data that is obsolete, unnecessary or no longer of use.

a. Other expenses that arise from the fraud event;

b. Indirect loss, such as bodily injury, lost time, lost wages, identity recovery expenses or damaged reputation;

c. Any interest, time value or potential investment gain on the amount of financial loss; or

d. Any portion of such amount that has been or can reasonably be expected to be reimbursed by a third party, such as a financial institution.

a. Fraud event means any of the following, when such event is wholly or partially perpetrated through a computing device or connected home device and results in direct financial loss to a Member:

(1) A identity theft event;

(2) The unauthorized use of a card, card number or account number associated with a bank account or credit account issued to or registered in a Member's name, when the Member is legally liable for such use;

(3) The forgery or alteration of any check or negotiable instrument;

(4) Acceptance in good faith of counterfeit currency; or

(5) Online scams.

b. Fraud event does not mean or include any occurrence:

(1) In which a Member is threatened or coerced to part with something of value, other than online scams;

(2) Between a Member and any of the following:

(a) Any other Member;

(b) A Member’s current or former spouse, common law spouse or domestic partner; or

(c) A Member’s grandparent, parent, sibling, child or grandchild.

(3) Involving use of a card, card number or account number associated with a bank account or credit account:

(a) By a person who has ever received any authorization from a Member to use such card, card number or account number; or

(b) If a Member has not complied with all terms and conditions under which such card, card number or account number was issued.

(4) Arising from any of the following:

(a) The business or professional service of a Member.

(b) A dispute or a disagreement over the completeness, authenticity or value of a product, a service or a financial instrument.

(c) A gift or charitable contribution to an individual or any legitimate organization.

(d) An online auction or the use of an online auction site.

(e) A lottery, gambling or a game of chance.

(f) An advance fee fraud or other fraud in which a Member provides money based on an expectation of receiving at some future time a larger amount of money or something with a greater value than the money provided.

a. Future loss avoidance costs means the amount spent by a Member to make improvements to a computing device or connected home device, provided:

(1) Such future loss avoidance costs are incurred within 60 days after the discovery of the cyber attack event; and

(2) We agree in writing that improvements to which future loss avoidance costs relate would reasonably reduce the likelihood of a future cyber attack event similar to the one for which the Member has received payment under coverage B.2.c. Cyber Attack. We will not unreasonably withhold such agreement.

b. The improvements described in paragraph a.(2) above may include, but are not limited to, hardware and software upgrades. Improvements involving services subject to lease, license or subscription may have costs that are ongoing. In such case, the most we will pay are costs associated with the first 12 months of any such service, subject to the amount described in paragraph c. below.

c. The most we will pay for all future loss avoidance costs with respect to any one cyber attack event is 10% of our Eligible Payment to the Member prior to any payment under this Future Loss Avoidance coverage.

d. As used in this definition, Eligible Payment means our total payment to the Member under coverage B.2.c. Cyber Attack, not including any deductible amount. Any payment made for hardware replacement or hardware upgrades as described under A. DEFINITIONS, 33. System restoration costs, item b.(1) below reduces the amount we will pay for future loss avoidance costs.

a. Fees and expenses for an attorney approved by us for the recovery of title to real property wrongfully or fraudulently transferred from a Member; and

b. Any other reasonable costs necessarily incurred by a Member in the course of recovering such title, including court filing and title recording fees.

a. Costs for re-filing applications for loans, grants or other credit instruments that are rejected solely as a result of a identity theft event;

b. Costs for long distance telephone calls, postage and notarizing documents;

c. Costs for credit reports from established credit bureaus;

d. Costs for an attorney approved by us for the following:

(1) The defense of any civil suit brought against a Member;

(2) The removal of any civil judgment wrongfully entered against a Member;

(3) Legal assistance for a Member at an audit or hearing by a governmental agency;

(4) Legal assistance in challenging the accuracy of a Member’s consumer credit report;

(5) The defense of any criminal charges brought against a Member arising from the actions of a third party using the personal identity of the Member; or

e. Lost wages or salaries earnings for employer-documented time necessarily taken away from work:

(1) For the activities described in a. through d. above;

(2) To meet with law enforcement authorities, governmental agencies, credit agencies or individual creditors and businesses; or

(3) To otherwise recover control over the stolen personal identity.

This does not include wages or salaried earnings for sick days, time taken away from self-employment or time taken away for tasks that could reasonably have been done during non-working hours.

f. Costs of supervision of children or elderly or infirm relatives or dependents of a Member during time taken away from such supervision. Such care must be provided by a professional care provider who is not a relative of the Member;

g. Costs for counseling from a licensed mental health professional. Such care must be provided by a professional care provider who is not a relative of the Member;

h. Any other reasonable costs necessarily incurred by a Member as a direct result of the identity theft event.

(1) Such costs include:

(a) Costs by the Member to recover control over his or her personal identity.

(b) Deductibles or service fees from financial institutions.

(c) Court filing and title recording fees.

(2) Such costs do not include:

(a) Costs to avoid, prevent or detect a identity theft event or other loss.

(b) Money lost or stolen.

(c) Costs that are restricted or excluded elsewhere in the policy.

(d) Home title fraud costs.

a. The primary member.

b. If the insured program includes coverage for family members, the residents of the household of the primary member who are:

(1) The relatives of such persons, including their spouse; or

(2) Under the age of 21 and in the care of such persons; or

(3) A student enrolled in school full-time, as defined by the school, who was a resident of the primary member's household before moving out to attend school, provided the student is under the age of:

(a) 24 and the primary member's relative; or

(b) 21 and in the primary member's care or the care of a resident of the primary member's household who is the primary member's relative.

a. Occur at the same time; or

b. Arise during the same policy period from the same source, cause or vulnerability.

a. Disclose login credentials that results in a financial loss of money, securities, cryptocurrency or tangible property; or

b. Part voluntarily with money, securities, cryptocurrency or tangible property.

a. Personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of a Member. This includes, but is not limited to, Social Security numbers, account numbers, passwords or login credentials, or other methods to access or control a computing device or connected home device system identification.

b. With respect to coverage B.2.h. Data Breach, personally identifying information means information, including health information, that could be used to commit fraud or other illegal activity involving the credit, access to health care or identity of an affected individual. This includes, but is not limited to, Social Security numbers or account numbers.

c. Personally identifying information does not mean or include information that is otherwise available to the public, such as names and addresses.

a. System restoration costs means the costs of a professional firm hired by a Member to do the following in order to restore the Member's computing device or connected home device to the level of functionality it had before the cyber attack event:

(1) Replace or reinstall computer software programs;

(2) Remove any malicious code; and

(3) Configure or correct the configuration of the Member's device or system.

b. System restoration costs does not mean any of the following:

(1) Costs to repair or replace hardware. However, we may choose to pay to repair or replace hardware if doing so reduces the amount of loss payable under the policy.

(2) Costs to increase the speed, capacity or utility of the Member's device or system.

(3) The Member's time or labor.

(4) Any costs in excess of the replacement value of the Member's system, including applicable hardware and software.

a. Utility bill overage expenses means additional expenses incurred by a Member to operate their home over and above the cost that normally would have incurred to operate their home during the same period had no cryptojacking event occurred, provided that such additional expenses are billed to the Member by the Utility Provider via written invoices that reflect the additional utility usage or consumption.

b. Utility bill overage expenses does not mean or include any expenses that are:

(1) Incurred prior to the policy period for which the policy is applicable; or

(2) Charged at a flat or fixed fee that does not fluctuate with usage.

c. As used in this definition, Utility Provider means an electrical, internet, natural gas or oil service provider.

B. COVERAGE

This Stolen Identity Event Group Insurance applies only if all of the following conditions are met:

a. There has been a stolen identity event involving the personally identifying information of a Member; and

b. Such stolen identity event is first discovered by the Member during the policy period for which the policy is applicable; and

c. Such stolen identity event is reported to us as soon as practicable, but in no event more than 60 days after the date it is first discovered by the Member.

If all of the conditions listed above in 1. COVERAGE REQUIREMENTS have been met, then we will provide the Member the following coverages for loss directly arising from such stolen identity event.

a. Case Management Service

We will provide the services of an identity recovery case manager as needed to respond to the stolen identity event.

b. Identity Theft Recovery

If there has been an identity theft event as a direct result of such stolen identity event, then we will pay the Member's reasonable and necessary identity theft costs.

c. Cyber Attack

If there has been a cyber attack event as a direct result of such stolen identity event, then we will provide the Member the following coverages for loss directly arising from such cyber attack event:

(1) Data Recovery

We will pay the Member's necessary and reasonable data recovery costs.

(2) System Restoration

We will pay the Member's necessary and reasonable system restoration costs.

(3) Cryptojacking

We will pay the Member's necessary and reasonable utility bill overage expenses.

(4) Future Loss Avoidance

We will pay the Member's necessary and reasonable future loss avoidance costs.

d. Cyber Extortion

If there has been a cyber extortion event as a direct result of such stolen identity event, then we will provide the Member the following coverages for loss directly arising from such cyber extortion event:

(1) Professional assistance from a subject matter expert provided by us for advice and consultation regarding how best to respond to the threat.

(2) Reimbursement of the Member's necessary and reasonable cyber extortion response costs.

e. Online Fraud Reimbursement

If there has been a fraud event that is wholly or partially perpetrated through a computing device or connected home device as a direct result of such stolen identity event, then we will pay the Member's necessary and reasonable fraud costs.

f. Cyberbullying

If there has been a cyberbullying event as a direct result of such stolen identity event, then we will provide reimbursement for the Member's necessary and reasonable cyberbullying costs.

g. Home Title Fraud

If there has been a home title fraud event as a direct result of such stolen identity event, then we will pay the Member’s reasonable and necessary home title fraud costs.

h. Data Breach

If there has been a data breach event as a direct result of such stolen identity event, we will pay the Member’s reasonable and necessary data breach costs.

C. EXCLUSIONS

The following exclusions apply to all coverages under the policy.

We will not pay for loss, damage or expense caused by or resulting from:

a. Criminal, fraudulent or dishonest acts, errors or omissions;

b. Intentional violations of the law; or

c. Intentionally initiating or contributing to a covered loss event.

a. Cyber warfare, whether or not occurring in combination with physical combat;

b. Undeclared war;

c. Civil war;

d. Hostile action by military force or cyber measures, including action in defending against or hindering an expected or actual attack, by any Combatant; or

e. Insurrection, rebellion, revolution, usurped power, political violence or action taken by governmental authority in defending against or hindering any of these, including cyber action in connection with any of the foregoing.

For purposes of this exclusion, cyber warfare, cyber measures and cyber action include, but are not limited to, the use of disruptive digital activities against a computer network or system with the intention to cause harm in order to further political or similar objectives, or to intimidate any person(s) in furtherance of such objectives, committed by a Combatant.

The attribution of an action to a Combatant will be determined by relying on reasonable evidence such as:

a. Statements by an impacted government, sovereign or other authority;

b. Statements by widely recognized international bodies (such as the United Nations) or alliances (such as the North Atlantic Treaty Organization); or

c. Consensus opinion within relevant expert communities such as the cyber security industry. Decisions about the presence or absence of war, hostile action, and other terms used in this exclusion will take into consideration the full range of available tactics, weapons and technologies at the time of the event giving rise to the loss.

Combatant means, for purposes of this exclusion, a government, sovereign or other authority, or agents acting on their behalf.

D. LIMITS

The Member Annual Aggregate Limit shown in the Schedule of this Summary of Benefits under the applicable insured program is the most we will pay for all loss, damage or expense for any one Member arising during any one policy period for all coverages provided by the policy. If the insured program includes coverage for family Members, then the Member Annual Aggregate Limit is the most we will pay for all loss, damage or expense for all Members associated with any one primary member for all coverages provided by the policy. This limit shall apply to the total of all loss, damage or expense arising from all stolen identity events discovered during such policy period.

The Coverage Aggregate Limit for each coverage shown in the Schedule of this Summary of Benefits under the applicable insured program is the most we will pay for all loss, damage or expense for any one Member arising during any one policy period for such coverage. If the insured program includes coverage for family members, then the Coverage Aggregate Limit is the most we will pay for all loss, damage or expense for all Members associated with any one primary member for such coverage. This limit shall apply to the total of all loss, damage or expense arising from all stolen identity events discovered during such policy period. If any occurrence causes loss, damage or expense in more than one policy period, all such loss, damage and expense will be subject to the Member Annual Aggregate Limit of the first policy period in which the occurrence was discovered.

The Legal Costs as provided under item d. of the definition of identity theft costs are subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit.

Item e. (Lost Wages) and item f. (Child and Elder Care Expenses) of the definition of identity theft costs are jointly subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit. Coverage is limited to wages lost and costs incurred within 12 months after the first discovery of the stolen identity event by the Member.

Item g. (Mental Health Counseling) of the definition of identity theft costs is subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit. Coverage is limited to costs incurred within 12 months after the first discovery of the stolen identity event by the Member.

Item h. (Miscellaneous Unnamed Costs) of the definition of identity theft costs is subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Identity Theft Recovery Coverage Limit. Coverage is limited to costs incurred within 12 months after the first discovery of the stolen identity event by the Member.

Fraud costs resulting from Item a.(5). (online scams) of the definition of fraud event is subject to the sublimit shown in the Schedule of this Summary of Benefits. This sublimit is part of, and not in addition to, the Online Fraud Reimbursement Coverage Limit.

E. DEDUCTIBLE

We will pay only that part of the total payable loss that exceeds the Member Deductible shown in the Schedule of this Summary of Benefits under the applicable insured program, subject to the applicable limits shown in the Schedule of this Summary of Benefits.

The Member will be responsible for the applicable Member Deductible under the applicable insured program, if shown in the Schedule of this Summary of Benefits.

Case Management Service and Identity Theft Recovery coverages are not subject to a deductible.

F. CONDITIONS

The following conditions apply to all coverages under the policy:

Assignment of the policy will not be valid unless we give our written consent.

With respect to Case Management Service, for assistance the Member should call the Identity Recovery Help Line. The Identity Recovery Help Line can provide the Member with information and advice for how to respond to a possible stolen identity event.

In some cases, we may provide Case Management Service at our expense to a Member prior to a determination that a covered stolen identity event has occurred. Our provision of such services is not an admission of liability under the policy. We reserve the right to deny further coverage or service if, after investigation, we determine that a covered stolen identity event has not occurred.

With respect to Identity Theft Recovery Coverage, the Member must send receipts, bills or other records that support his or her claim for identity theft costs to us within 60 days after our request.

Our obligations under the policy will not be relieved by the bankruptcy or insolvency of a Member or provider.

a. The provider may cancel the policy at any time by informing us in writing of the date cancellation is to take effect.

b. We may cancel the policy only for the reasons stated below by informing the provider in writing of the date cancellation takes effect. This cancellation notice may be delivered to the provider, or mailed to the provider at their mailing address shown in the Declarations of the policy. Proof of mailing will be sufficient proof of notice.

(1) When the provider has not paid the premium, we may cancel at any time by letting the provider know at least 10 days prior to the date cancellation takes effect.

(2) When the policy has been in effect for less than 60 days and is not a renewal with us, we may cancel for any reason by letting the provider know at least 10 days prior to the date cancellation takes effect.

(3) When the policy is a renewal with us or has been in effect for 60 days or more, we may cancel:

(i) If there has been a material misrepresentation which if known to us would have caused us not to issue the policy; or

(ii) If the risk has changed substantially since the policy was issued.

This can be done by letting the provider know at least 90 days before the date cancellation takes effect.

(4) When the policy is written for a period of more than one year, we may cancel for any reason at anniversary by letting the provider know at least 90 days before the cancellation takes effect.

c. When the policy is cancelled, the premium for the period from the date of cancellation to the expiration date will be refunded pro rata.

d. If the return premium is not refunded with the notice of cancellation or when the policy is returned to us, we will refund it within a reasonable time after the date cancellation takes effect.

e. The provider is responsible for informing Members of a non-renewal or cancellation of the policy.

f. Member coverage under the policy shall terminate upon the termination of the primary member’s enrollment in the insured program or the termination of the policy, in accordance with the terms of the policy, whichever is earlier.

The policy contains all the agreements between the provider and us concerning the insurance afforded. The provider shown in the Schedule of this Summary of Benefits is authorized to make changes in the terms of the policy with our consent. The policy’s terms can be waived or amended only by endorsement issued by us and made a part of the policy. The provider is responsible for informing Members of any changes to the policy.

We do not provide coverage to a Member who, whether before or after a loss, has:

a. Intentionally concealed or misrepresented any material fact or circumstance;

b. Engaged in fraudulent conduct; or

c. Made false statements; relating to this insurance.

With respect to Cyber Extortion coverage, Members must make every reasonable effort to avoid divulging the existence of this coverage.

Members must agree to use due diligence to prevent and mitigate costs covered under the policy. This includes, but is not limited to, complying with reasonable and widely-practiced steps for:

a. Providing and maintaining appropriate system and data security; and

b. Maintaining and updating at appropriate intervals backups of electronic data.

In case of a loss, the following duties must be performed either by the Member or the Member's representative. If failure to comply with these duties is prejudicial to us, we have no duty to provide coverage under the policy:

a. Give prompt notice to us;

b. Notify the police if there has been a violation of the law;

c. Notify the police or a school administrator in case of a cyberbullying event;

d. Notify the bank, credit card or electronic fund transfer card or access device company in case of a fraud event involving a bank card, credit card or check;

e. Cooperate with us in the investigation or settlement as follows:

(1) Provide the following information within 30 days after our request:

(i) A description of how, when and where the stolen identity event occurred.

(ii) Written reports of any service providers who participated in the investigation of or response to the stolen identity event.

(iii) Written reports or correspondence to or from law enforcement or any governmental authority or agency, or similar organization.

(iv) Any additional information we request relevant to the investigation of the stolen identity event.

(2) As may be reasonably required, permit us or a third party appointed by us to inspect and audit the computing device, connected home device, and any records. Any additional expenses related to this Condition F.9.e.(2) will be paid by us and will be in addition to, and not part of, the Member Annual Aggregate Limit. We must approve such expenses in advance.

(3) Send us signed, sworn proof of loss that contains the information we request to investigate the stolen identity event. This must be done within 60 days after our request. We will supply the necessary forms.

We are not the Members' or provider’s legal advisor. Our determination of what is or is not insured under the policy does not represent advice or counsel from us about what a Member should or should not do.

We may elect not to renew the policy. We may do so by delivering to the provider, or mailing to the provider at their mailing address shown in the Declarations of the policy, written notice at least 90 days before the expiration date of the policy. Proof of mailing will be sufficient proof of notice.

We shall be excess over any other insurance (including, without limitation, cyber insurance), product warranty, extended services agreement or contract. The policy is specifically excess of any cyber insurance policy carried by the Member, in addition to any other insurance carried by the Member that applies to a loss under the policy.

a. The Member agrees to consult with us prior to the issuance of notification to affected individuals under coverage B.2.h. Data Breach. We assume no responsibility for any services promised to affected individuals without our prior agreement.

b. We will suggest a service provider for Notification to Affected Individuals and Services to Affected Individuals. If the Member prefers to use an alternate service provider, our coverage is subject to the following limitations:

(1) Such alternate service provider must be approved by us; and

(2) Our payment for services provided by any alternate service provider will not exceed the amount that we would have paid using the service provider we had suggested.

c. The Member will provide us and the service provider the following at our pre-notification consultation with the Member:

(1) Requested information about the affected individuals to be notified, including contact information;

(2) Information about the data breach event that may appropriately be communicated with affected individuals; and

(3) The scope of services that the Member desires for the affected individuals. For example, coverage may be structured to provide fewer services in order to make those services available to more affected individuals without exceeding the available limit of coverage.

a. The premium shown in the Declarations of the policy was computed based on rates in effect at the time the policy was issued. Other than documented and verifiable change in applicable insurance premium taxes or legal or regulatory requirements requiring a change in the rates, we will only modify rates on the renewal effective date of the policy.

b. Premium will be calculated in accordance with the reporting and the rates shown in the Declarations of the policy, prorated based on the Reporting Period shown in the Declarations of the policy. We will issue a premium invoice to the provider within ten (10) business days of receipt of such reporting.

a. We will only pay under the policy for services that are provided by service providers approved by us. Members must obtain our prior approval for any service provider whose expenses they want covered under the policy. We will not unreasonably withhold such approval.

b. Members will have a direct relationship with service providers paid for in whole or in part under the policy. Those firms work for the Members.

c. With respect to any services provided by any service provider paid for in whole or in part under the policy:

(1) The effectiveness of such services depends on Members' cooperation and assistance.

(2) We do not warrant or guarantee that services will be available or applicable to all individuals. For example, under Identity Theft Recovery Coverage, Members who are minors or foreign nationals may not have credit records that can be provided or monitored. Service in Canada will be different from service in the United States and Puerto Rico.

(3) We do not warrant or guarantee that the services will end or eliminate all problems associated with the covered events.

No action can be brought against us unless there has been full compliance with all of the terms and conditions of the policy and the action is started within two years after the date of loss.

If any Member for whom we make payment under the policy has rights to recover damages from another, those rights are transferred to us to the extent of our payment. The Member must do everything necessary to secure our rights and must do nothing after loss to impair them.

Any dispute arising out of or related to the policy, or with respect to the application of or the interpretation of the policy, shall be governed by the laws of the state of Washington, without giving effect to the principles of conflict of laws. We designate the Insurance Commissioner of Washington, pursuant to the laws of Washington, as our true and lawful attorney upon whom may be served any lawful process in any action, suit or proceeding instituted in the State of Washington, by, or on behalf of, the Named Insured or any beneficiary hereunder arising out of this Policy. We designate the Corporate Secretary of HSB Specialty Insurance Company, One State Street, Hartford, CT 06102 as the person whom the said officer is authorized to mail such process or true copy thereof.

  • Waiver or Change of Policy Provisions

A change or waiver of a provision of the policy must be in writing by us to be valid. Our request for an appraisal or examination will not waive any of our rights.