23-04 - Reporting Cybersecurity Events to the Department of Commerce & Insurance, October 25, 2023

INSURANCE BULLETIN 23-04 Reporting Cybersecurity Events to the Department of Commerce & Insurance

Issued: October 25, 2023

The following Bulletin is issued by the Missouri Department of Commerce and Insurance (“Department”) to inform and educate the reader on the specified issue. It does not have the force and effect of law, is not an evaluation of any specific facts or circumstances, and is not binding on the Department. See section 374.015, RSMo.

To: All insurers writing insurance coverages in the State of Missouri

From: Chlora Lindley-Myers, Director

Re: Reporting Cybersecurity Events to the Department of Commerce & Insurance (Department)

The purpose of this Bulletin is to respond to and address inquiries the Department has received with regard to notification requirements in the event of a cybersecurity event.

Insurers should be aware of the notification requirements related to cybersecurity events that affect Missouri consumers. These requirements are found in §407.1500 RSMo and are under the purview of the Missouri Office of the Attorney General.

Section 407.1500.2(1) RSMo, provides that in the event of a breach:

“Any person that owns or licenses personal information of residents of Missouri or any person that conducts business in Missouri that owns or licenses personal information in any form of a resident of Missouri shall provide notice to the affected consumer that there has been a breach of security following discovery or notification of the breach.”

The law also defines what constitutes a breach, under what circumstances a disclosure must be made, the requirements for disclosure notifications, how notifications must be provided, and when notice of an event must be reported to the Missouri Attorney General’s Office and consumer reporting agencies.

In addition to complying with the requirements of §407.1500 RSMo, the Department requests that all insurers writing insurance coverages1 in the State of Missouri notify the Department of any breach of security as defined by §407.1500 RSMo, as soon as practicable, but no later than 10 days, after it has become aware of such a breach. When in doubt as to whether to notify the Department, insurers are encouraged to report the cybersecurity event as soon as possible.

Notification to the Department should be sent to the Chief Market Conduct Examiner at the address above or via email to marketconduct@insurance.mo.gov and, at a minimum, include the following:

 The date the cybersecurity event was identified and how it was discovered.  The identity of the source of the cybersecurity event, if known.  A description of how the information was exposed, lost, stolen, or breached, for example ransomware, phishing, denial or distributed denial-of-service, etc., including the specific roles and responsibilities of third-party service providers, if any.  A description of the specific types of information acquired without authorization.  The period during which the information system was compromised by the cybersecurity event.  The total number of Missouri consumers affected by the cybersecurity event.  A description of efforts being undertaken to remediate the situation that permitted the cybersecurity event to occur.  A description of the steps that will be or have been taken to mitigate damage to affected consumers, such as sending notifications, credit monitoring, and/or rectifying identity or credit damage.  Information on whether notice has been provided to the Missouri Office of the Attorney General, credit bureaus, and any law enforcement agencies, and, if so, when such notification was provided.  The name of and contact information of a person who is both familiar with the cybersecurity event and authorized to act for the insurer.

Any questions or comments regarding this Bulletin should be directed to the Department’s Market Conduct Section at marketconduct@insurance.mo.gov

###

1 For purposes of this bulletin, “insurers writing insurance coverage in the state of Missouri” shall have the same meaning as the word “insurer” in section 374.018. That definition is as follows: “’insurer’ shall mean all insurance companies organized, incorporated, or doing business under the provisions of chapter 354,376, 378, or 380.”