Employers Holdings (EIG) Risk Analysis

Our business is highly dependent upon the successful and uninterrupted functioning of our information technology and telecommunications systems, including those of third parties to which we outsource certain functions. We rely on these systems to operate key aspects of our business, including processing and generating new and renewal business, providing customer service, administering and making payments on claims, facilitating collections, and underwriting and administering the policies we write. Additionally, our business and operations involve the collection, storage, transmission, and other processing of personal data and certain other sensitive and proprietary data. Companies are increasingly subject to a wide variety of attacks on their systems and networks on an ongoing basis. In addition to threats from traditional computer "hackers," we face threats from malicious code (such as malware, viruses, worms, and ransomware), employee or contractor error or malfeasance, fraud, misconduct, or misuse, phishing, social engineering attacks and denial-of-service attacks. We could be a target for cybersecurity attacks designed to disrupt our operations or to attempt to gain access to our systems, data processed or maintained in our business, trade secrets, or other proprietary information or financial resources. The third parties we have outsourced business functions to also face significant security risks. Although we have implemented and are in the process of implementing additional systems and processes designed to protect our data and systems, these security measures cannot guarantee security. Because techniques used to obtain unauthorized access to or to sabotage systems change frequently and may not be known until launched, we and the third parties on which we rely may be unable to anticipate or prevent these attacks, react in a timely manner or implement adequate preventive measures, and we may face delays in our detection or remediation of, or other responses to, security breaches and other privacy-and security-related incidents. Certain efforts may be state-sponsored or supported by significant financial and technological resources, making them even more difficult to detect, remediate, and otherwise handle. We also may experience outages, interruptions, and other disruptions to systems used in our business, including information technology and telecommunications systems, and may suffer the loss of, or inability to perform of, third parties who provide these services. Any interruptions, outages, or delays in our systems and infrastructure, our business or third parties, or deterioration in the performance of these systems and infrastructure, could impair our ability to provide our products and services. Fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, other natural disasters, acts of war or military conflict, terrorism, exceeding capacity limits, and similar events or disruptions may result in damage to or interruption of telecommunications and other systems. There can be no guarantee that our business continuity plans or measures would be sufficient to restore or secure systems or data. Any security breach or security incident, or any outages or other disruption to systems used in our business, could interrupt our operations (including by impacting our ability to service our agents, insureds, and injured workers, generate and service direct-to-customer business, and meet certain regulatory requirements), result in loss or improper access to, or acquisition, disclosure, or other processing of, personal data and other sensitive and proprietary data, or a loss of intellectual property protection. Additionally, any actual or perceived outage, breach, incident, or disruption may harm our reputation and competitive position, reduce demand for our products and services, damage our relationships with customers or others or result in claims, demands, litigation, regulatory investigations and proceedings and significant legal, regulatory and financial exposure. Further, any such incidents or any perception that our security measures are inadequate could lead to loss of confidence in us and harm to our reputation. Any of the foregoing matters could have a material adverse effect upon our business, financial condition, and operating results. We expect to incur significant costs in an effort to detect and prevent security breaches and incidents, and we may face increased costs and requirements to expend substantial resources in the event of an actual or perceived security breach or other incident. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, our insurance policies may not be adequate to compensate us for the potential losses arising from any disruption in or, failure or security breach or incident of or impacting our systems or third-party systems used in our business, and such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance coverage may not cover all claims made against us and could have high deductibles in any event, and defending a suit, regardless of its merit, could be costly and divert management attention.