Identity theft policies go corporate.

The numbers are alarming: In 2005, more than 134 computer security breaches affecting potentially more than 57 million individuals were reported in the U.S., according to the Identity Theft Resource Center. Also in 2005, companies incurred an average cost of $14 million per breach incident, with costs ranging as high as $50 million, according to a survey conducted by the Ponemon Institute.

Moreover, some 80 percent of 250 executives and marketers polled in a recent study by the CMO Council registered growing levels of concern for their companies and their customers around security issues.

No wonder insurance companies see a vein of valuable ore in identity theft. A number have come out with policies protecting individuals or households, and American International Group (AIG) has been a leader in developing coverage for companies that could be deemed responsible for instances of identity theft.

In September, for instance, AIG's National Union Fire Insurance Co. of Pittsburgh announced the availability of AIG Corporate Identity Protection, a new policy "designed to protect small and mid-sized companies from financial exposures related to identity theft or the threat of identity theft." National Union said the policies are "ideal for companies in Main Street industries with revenues up to $100 million or holding up to one million identities, [and] provide coverage ... when the personal data of its employees or customers is compromised, regardless of whether an actual identity theft results."

[ILLUSTRATION OMITTED]

Coverage extends to: legal liability damages, defense costs, regulatory action expenses, notification costs, crisis expenses and post-event services, including identity theft recovery services. Companies can obtain policies with limits starting at $100,000 and rising up to $5 million.

AIG is also involved in a corollary type of corporate coverage: liability for companies accused of negligently handling private or confidential data (the kind of breach that often leads to identity theft). Last March, National Union introduced Security & Privacy Insurance, a new policy coverage addressing this liability.

This insurance covers liabilities that arise when private or confidential information is put at risk by any number of means, including a failure of computer security or wrongful release or disclosure of information by the insured, the insured's employee or another third party. These liabilities are typically not covered by conventional professional liability, commercial general liability or media liability insurance policies.

National Union says that companies in all industries can obtain this insurance as part of an AIG suite for network infrastructure and cyber risk protection. Limits up to $25 million are available.

Corporate policies against identity theft appear far less common, however, than individual policies, which are being hawked over the Internet and through more traditional insurance marketing channels. Among the underwriters offering such individual or family coverage are Travelers Casualty and Surety, Farmer's Insurance and Encompass Insurance. Identity theft coverage is even being made available for new checking account customers at some banks through Progeny Marketing of Nashville; the actual insurance is being underwritten by AIG.

Steve Bridges, vice president of Professional Risk Solutions for Aon Financial Services Group, says that such individual policies have been around for three or four years. Frequently, they can be bought through a credit union or an online provider like AOL, he adds.

Bridges said in an interview that corporate coverage is a relatively recent phenomenon, and has grown considerably in the past six months. Historically, he says, companies have had network risk policies, which covered "hacking" incidents or other security breaches. But those didn't impact privacy issues.

Moreover, he adds, corporate coverage traditionally kicked in only when there was a claim. Now, insurance can cover issues like notification and other crisis services. "We had to push all of the carriers to [add] it," he says, referring to the brokerage community. Companies like Chubb Corp., Beazley Group plc and Hiscox are also providing such coverage, he says.

If a company is looking to buy such coverage for the first time, it may be wrapped up into one price with network risk insurance. However, Bridges believes insurers are likely requiring companies to have a large "retention," or deductible, for the "incident fund" coverage to kick in, meaning that the breach "has to be a relatively large incident."