Investigating Potential Recovery: Are 3rd party vendors responsible?

The insured used a 3rd party vendor to host its website. It was subsequently reported that customers were having difficulty checking out orders on the website and that a breach had been discovered. Perpetrators had installed a script on the system, allowing access to the order and credit card information. It’s believed that 600 orders were potentially compromised. Notification letters were sent to the affected customers and the Attorney General`s office was informed. A detailed investigation ensued as to whether the breach had utilized the 3rd party vendor’s system, but it was ultimately found that there was no opportunity to recover from other sources and the $10,631 Privacy Breach Response costs were funded by the insured’s cyber endorsement.