1-888-643-2217 Email ABEX
Keeping you updated

Archives

What the Accomod8u Data Leak Shows About Student Housing

Here’s the background you need in order to understand the data hack, what it says about student housing, and what’s being done about it, as published by CBC News.

Earlier this month, an anonymous Reddit user wrote a post titled: “Massive Data Leak of Accommod8u Maintenance Requests Over the Last Two Years.” In a public Google document, the author said they managed to log into Accommod8u’s online tenant portal and access two years worth of maintenance requests. (Reddit)

Leaked information from the popular student rental company Accommod8u appears to paint a picture of apartments plagued with vermin, mould and broken heating systems.

But some say the problem with student housing in Waterloo goes beyond just one company.

Here’s the background you need to understand the data hack, what it says about student housing, and what’s being done about it.

What was the leak?

Earlier this month, an anonymous Reddit user wrote a post titled: “Massive Data Leak of Accommod8u Maintenance Requests Over the Last Two Years.”

In a public Google document, the author said they managed to log into Accommod8u’s online tenant portal and access two years worth of maintenance requests.

“A close look at the 6000+ entries reveals an egregious disregard for the rights and wellbeing of the residents,” the user wrote in the post.

The report describes requests from tenants for help dealing with mold, vermin, carbon monoxide and fire alarm issues and faulty heating systems. It also criticizes Accommod8u’s response time, alleging that users often put in multiple requests for help that were ignored.

Who is involved?

The company

On its website, Accommod8u describes itself as a high-end apartment brand with eight high-rise buildings under its ownership. The web copy says each rental suite is clean, secure and “maintained to the highest standard.”

The company has been criticized before, after tenants had their move-in dates at an Accommod8u property delayed for weeks because construction wasn’t finished. Once the building was occupied, tenants said they still encountered problems with air conditioning, garbage chutes and laundry machines.

Student move-ins delayed again, this time for TheHub in Waterloo
CBC has reached out to Accommod8u for comment and has not yet heard back.

The company has been criticized before, after tenants had their move-in dates at an Accommod8u property delayed for weeks because construction wasn’t finished. (Submitted by Brooke Willis)

The hacker

In a Google document titled “Contact Information,” the person or people behind the hack said they will not reveal their identity, or whether one or multiple people were involved. CBC has not spoken to those responsible for the data breach.

The police

The Waterloo Regional Police Service has confirmed that they are investigating the hack, but have not said whether any charges are pending.

What the leak shows

Students at the University of Waterloo say the hack shows what many of them knew already: that students are easily taken advantage of, and often don’t know what recourse they have when that happens.

Colin Chu was one of about 20 students who joined a meeting of the Waterloo Undergraduate Students’ Association Sunday, where the Accommod8U hack was on the agenda.

He said poor maintenance — along with disputed leases and other problems — is an ongoing problem at many of the rental companies that target students in Waterloo.

“Especially a lot of international students that are coming into the region for the first time and don’t have a really good handle on renting procedures or ways that they can be scammed or misled,” said Chu.

Chu said many students don’t know what their rights are, or that agencies like the Landlord and Tenant Board exist, and hopes they’ll become more active in learning about possible scams and ways to get help.

What officials are saying

Tenille Bonoguore, who represents much of the university area as a city councillor for uptown Waterloo, called the contents of the Accomod8u report “disturbing.”

“The kinds of issues that were being dealt with and the long time it was taking to deal with these issues give me concerns both for residents’ health and for their mental health,” said Bonoguore.

Bonoguore and her fellow councillors discussed the leak at a committee meeting this week, and questioned city staff about what the municipality’s responsibility is.

Shayne Turner, the city’s director of municipal enforcement services, said the city doesn’t have the power to investigate buildings without first being invited by a tenant.

But if tenants are having problems with their unit and aren’t getting anywhere with their landlord, they can contact the property standards office, which will check to see if there’s really a problem.

An inspector can issue a work order requiring property owners to fix problems, or hire someone to make repairs and add the bill to the property owner’s taxes.

What’s next

The undergraduate students association says it will set up a committee to research student housing in Waterloo, and to look into the possibility of a class-action lawsuit against housing companies on behalf of students.

Turner said his team will be in touch with the universities to ensure students understand how his office works, and what they can offer to tenants.

And Bonoguore said she plans to speak to students about their housing rights during a scheduled day upcoming where she was planning to go door-to-door talking about street parties.

“I’m hopeful that residents and tenants become so aware of their rights and what’s expected and how to get help that they end up being able to very successfully advocate for their own health and safety,” said Bonoguore.

“I think anyone who has lived in rental accommodation knows that your state of living is as good as your landlord is,” said uptown Waterloo councillor Tenille Bonoguore.

Author: Paula Duhatschek · CBC News ·


How Well Does That Blanket Cover Your Client?

Blanket additional insured endorsements are useful tools for preventing administrative oversights and reducing paperwork, but they also carry risks for both the named and additional insureds. Discover methods contractors and subcontractors can use to minimize the risks of breaching their contracts when using blanket AI endorsements.

One of the age-old problems in obtaining additional insured status under a contractor’s or subcontractor’s insurance policy is making sure the appropriate actions have been taken to effect the required coverage. Certificates of insurance are commonly used to verify that the certificate holder has been added as an additional insured, but because they are not part of the policy, information contained on certificates may not be binding on the insurer. This article examines the use of blanket endorsements to effect additional insured status as a means of overcoming at least some of the imperfections of the process.

Additional insured status is a common and effective tool for protecting one party from certain risks arising out of another party’s activities. For example, municipalities typically require additional insured status from anyone holding a public event on city property, such as concerts, parades, and carnivals. The rationale behind this requirement is that the activities expose the city to certain risks that would not otherwise exist, so the person or organization that creates the risk should assume responsibility for any losses incurred as a result of the activities. In the case of a public concert, for example, if someone is injured when the crowd gets unruly, both the city and the concert sponsor will likely be sued. As an additional insured under the sponsor’s policy, the city can tender the claim under that policy instead of having to file the claim under its own insurance. The risk has been effectively transferred to the concert sponsor (assuming the available policy limits are sufficient to cover the claim.)

On a construction project, the owner typically requires additional insured status under the general contractor’s liability insurance policies; general contractors may do likewise with subcontractors. As in the example above, the rationale is that the construction activities create certain risks that would not otherwise exist and increase the magnitude of certain other risks. For example, a construction project in a retail district carries the risk that a pedestrian will be injured from flying debris, collapsed scaffolding, or a tool dropped from several stories up. These risks are directly related to the contractor’s operations on the site. Further, goes the rationale, the contractor (or subcontractor) performing the work is generally in the best position to prevent or control losses arising out of the work, and should therefore bear the corresponding financial risk.

However, requiring additional insured status does not necessarily guarantee that you will get it. The named insured (contractor or subcontractor) must notify the insurance company of the request, and absent a provision to the contrary, the person or entity requesting additional insured status must be listed, or “scheduled”, by name on an endorsement that is attached to the policy.

Because this requirement is so common in construction contracts, some contractors may handle hundreds of requests for additional insured status in a given year. Further, because the contracting process is often drawn out, and the insurance requirements given little more than a cursory review, this method of providing additional insured status carries inherent risks of error and oversight. Whether the result of failing to forward the request for additional insured status to the broker or insurer, failing to ensure additional insured status under a new or renewal policy, or some other oversight, a contractor (or subcontractor) can easily find itself in breach of a contract, among other unpleasant outcomes. Likewise, the would-be additional insured may find itself embroiled in a coverage dispute with the insurer and a contract dispute with the named insured contractor; meanwhile, it may be forced to tender the claim to its own insurer (or, if self-insured, fund its own defense). All of these possible outcomes frustrate the intent of the contracting parties.

Blanket additional insured endorsements were introduced as a means of avoiding administrative errors and oversights in providing additional insured status. These endorsements typically contain language indicating that additional insured status is automatically provided when the named insured agrees to provide such status. To avoid overly broad grants of coverage, these endorsements typically limit their application to certain types of written contracts, such as construction contracts or equipment rental agreements.

The obvious benefits of blanket, or automatic, additional insured endorsements are that they protect against failure to add a party as an additional insured in accordance with the contractual agreement, and reduce the administrative burden of making each request individually. However, from the additional insured’s perspective, there are also some potential drawbacks to obtaining additional insured status in this manner. First, in the past, blanket additional insured endorsements had to be manuscripted as no standard endorsements were available. Because they are not standardized, manuscript endorsements can differ from one policy to the next. Consequently, they offer less predictability in terms of scope of coverage, as well as how a court might interpret the language of the endorsement.

Because blanket additional insured endorsements typically require a contractual obligation on the part of the named insured to provide such status, those who obtain additional insured status through such an endorsement must retain proof of the contractual requirement to effect coverage. Even when the additional insured’s coverage does not apply to completed operations, claims arising out of occurrences that took place during the course of construction may not surface until years later. Some additional insureds assume that a certificate of insurance showing additional insured status at the time of the occurrence will be sufficient to trigger the insurer’s duty to defend and indemnify. That is not necessarily true. The additional insured will also need evidence that there was in fact a contract requiring such coverage. While a certificate of insurance indicating that the certificate holder has been added as an additional insured is evidence of a contractual requirement, a better approach may be to require the certificate to refer to the contract requirement. For example, the following language could be required on the certificate:

“In compliance with the contract requirements, certificate holder is an additional insured under the policy.”

If possible, the contracts themselves should be retained. (This should not impose a significant additional burden in most instances, as construction contracts are typically retained for access to indemnity and other provisions that may come into play well after the project is completed.)

Finally, blanket additional insured endorsements restrict insurers ability to provide notice of cancellation to additional insureds. Most insurance policies require such notice to be provided only to the named insured. Additional insureds often try to obtain a guarantee of notice of cancellation by modifying the certificate language, but this is an unreliable approach.

Summary

Blanket additional insured endorsements are useful tools for preventing administrative oversights and reducing paperwork, but they also carry some risks for both the named insured and the additional insured. Fortunately, these risks can be managed fairly effectively.

Owners and contractors requiring additional insured status should make certain the additional insured requirement is part of a written and properly executed contract, and retain copies of these contracts (as well as the certificates of insurance) for an appropriate period of time—at least 3-5 years if completed-operations coverage was required and included in the additional insured’s coverage. Further, they should stipulate in the contract insurance requirements a minimum scope of coverage to be provided to them as an additional insured.

Contractors and subcontractors using blanket additional insured endorsements to provide contractually required coverage can minimize the risks of breaching their contracts by sticking with language that has been tested, and making sure the endorsement extends the contractually required scope of coverage.

Source: irmi.com


Implementing Multi-Factor Authentication is Critical

The CFC Incident Response Team notes that the vast majority of claims for business email compromise (BEC) and the associated crimes that result from such a compromise (wire transfer fraud, data theft and further phishing attacks) could potentially be prevented by implementing multi-factor authentication (MFA) on email accounts and other accounts.

Due to the proliferation of modern attack methods used by cybercriminals, not using multi-factor authentication is akin to closing the door of your home but not locking it. To improve your security posture, and to bring it up to date to face current threats, the use of MFA is highly recommended.

 

So what is MFA? It’s an authentication process that requires more than just a password to protect an email account or digital identity and is used to ensure that a person is who they say they are by requiring a minimum of two pieces of unique data that corroborates their identity. This unique data comes in three forms – something you know (i.e. your password), something that you have (i.e. a one-time passcode generated by an app or hardware token), or something you are (i.e. fingerprint, retinal pattern, voice signature or facial recognition).

In the event of a password compromise, perhaps as a result of a phishing attack, it is very unlikely that the threat actor will also have the other piece of the authentication data. Therefore, the chances are that your email account or digital identity will not be compromised. It will increase your overall cyber security posture and will decrease your chances of reputational harm and negative business impact.

There are many free MFA apps and more comprehensive corporate solutions. Below are some additional resources:

We urge all brokers and their clients to take this critical security step as soon as possible.

Source: www.cfc.com

 

 


Look for These Points of Differentiation in Cyber Coverage

There is a slew of ways in which insurers are differentiating the policy wording in their cyber products. Some of these points of differentiation are described below.

  • Additional breach response limits. Look for whether, and how much, additional limits are available specifically for handling breach response costs.
  • Increasing, or eliminating entirely, sublimits for certain exposures. Fraudulent instruction is one particular exposure for which some insurers may be willing to either increase any available sublimits or remove the restriction of a sublimit entirely.
  • “Betterment” coverage. In the aftermath of a data breach, security failure, or other cyber claim, many cyber and privacy insurers are only willing to cover expenses incurred by the insured to get its networks back up to their prior level of adequacy. However, some insurers are willing to offer a degree of “betterment” coverage that allows insureds to work with a third-party vendor to not only restore their systems to their prior adequacy but also set them up with greater security, functionality, capacity, and so on.
  • Quality of service providers offered. The quality of third-party service providers (e.g., cyber-forensics specialists) can vary from insurer to insurer, and insureds and their representatives should do their due diligence to review their qualifications.
  • Number of service providers offered. Similarly, insureds should be aware of how many options may be at their disposal when selecting an insurer-approved service provider.
  • Use of “system failure” coverage trigger. A “system failure” coverage trigger can allow for more coverage for “accidental” exposures (e.g., nonmalicious failures or accidental data deletion), as opposed to a coverage trigger that requires “breach” or “compromise” of data or systems.
  • Trigger for regulatory fines and penalties coverage. Relatedly, many coverage triggers pertaining to regulatory fines and penalties insuring agreements may require a “breach.” However, some insurers may not include the breach requirement, potentially opening up coverage for scenarios in which regulators may “come knocking” even without a known data breach.

Keeping these points in mind can help insureds assemble better cyber and privacy insurance protection to complement their management and/or professional liability insurance portfolio.

Source: www.irmi.com


Secure Favorable Wording in Contractual Liability Exclusion

Contractual liability exclusions are a fact of life in directors and officers (D&O) policy forms. While there is no getting around the existence of the contractual liability exclusion within standard policy wording, insureds can certainly benefit from variations in wording that can carve-back certain elements of coverage. Consider asking the following questions in order to determine potential ways to minimize the impact of the exclusion.

  • Is there a carve-back for liability that would have attached even in the absence of a contract or agreement? All policy forms should make this exception.
  • Does the exclusion bar coverage for written contracts only? Or does it also apply to oral contracts?
  • Does the exclusion only refer to “contracts,” or does it also apply to “agreements,” “warranties,” and/or “guarantees”? Inclusion of these other terms, especially when combined with wording excluding them in their oral forms, can significantly broaden the effect of the exclusion and thus constrict coverage.
  • Is there a carve-back for defense costs in the event of claims against insured persons (e.g., Side A defense coverage)?
  • Does the exclusion apply to both express and implied contracts? Much like the inclusion of some of the terminology shown above, implied contracts can extend the restrictive impact of the exclusion to a far greater range of the insured’s activities.
  • Does the lead-in wording to the exclusion bar coverage for claims “for” contractual liability, or does it bar coverage for claims “based upon, arising out of, or in any way related to” contractual liability? The former is the less common approach but is more favorable for an insured.
  • Does the exclusion explicitly state that it also applies to the liability of others that an insured assumes?
  • Is there an exception for contractual liability related to “employment claims”? With the blurring of some D&O and employment practices liability (EPL) risks in recent years and the frequency with which officers have employment contracts, this is particularly relevant.

Source: www.irmi.com


Blog

FOLLOW OUR BLOG

Receive notifications of new posts automatically.



ABEX - AFFILIATED BROKERS EXCHANGE IS ON FACEBOOK.

Like us on Facebook

Connect with us on LinkedIn