Amrae welcomes bill that approves ransomware payments by French insurers

Amrae has welcomed a forthcoming bill to explicitly legalise ransomware payments by insurers in France as long as insureds have filed an official complaint about the incident. The move looks set to make it more difficult for insurers in France to justify refusing to pay ransoms after some, including the biggest French insurer AXA, ruled out payments on grounds that they fuel criminal activity. Currently, the payment of ransomware is not forbidden in France but insurers fear that they may end in trouble for doing so. AXA said it would stop paying ransom payments last year over concerns they encourage criminals and gives them a revenue stream. But the new report from France’s Ministry of Economy concludes that victims of ransomware attacks, as well as their insurers, should be allowed to pay ransom demands as long they file a complaint to authorities about the attack. The goal is to boost transparency and better understand cyber risks, so that the insurance market can work on modelling and take steps to boost risk prevention among clients. Another proposal in the report is broader exchange of information between the public and private sector about cyber losses. These measures have been included in a bill sent to the French Council of Ministers last week that will be discussed in parliament next month. The proposals were celebrated by France’s risk management association Amrae as a major step towards improving the country’s cyber resilience. The association, which took part in a taskforce that helped facilitate the government report, wants the measures to be quickly implemented. But some have warned that legalising ransomware payments could increase the frequency of attacks. “It is a boost for criminals,” said Sébastien Meurant, a senator from the ultra-right French party Reconquête. “The message that [the report] gives to cybercriminals and their victims is deplorable,” said socialist senator Rémi Cardon. “We must clearly state that ransomware is not welcome in France.” In addition to plans to ensure ransomware payments remain legal for French insurers, the French government has announced plans to create a taskforce to examine cyber insurance. The report flags statistics by a government agency that show cyberattacks increased by 155% in France between 2019 and 2020. In the following year, the number jumped 101%. Anssi, a cybersecurity agency, estimates that 54% of all French companies suffered some kind of attack last year. However, French companies are not taking out much cyber cover. The government estimates that cyber insurance premiums reached a mere €219m in 2021, which amounts to 3.1% of the P&C market. Small and medium-sized companies, among which cyber insurance penetration is 0.3%, are most vulnerable. The report’s authors say it is necessary to create conditions for more SMEs to manage and transfer their cyber risks. But there are significant challenges to achieving this goal. The report notes that, on the one hand, small and medium-sized companies continue to struggle to properly assess cyber risks. On the other, the insurance and reinsurance markets still face a dearth of information about losses, which makes it harder for them to offer cover at reasonable prices. A lack of legal clarity about how to deal with cyberattacks is another factor hampering the insurance market. The report’s proposal to allow insurers to pay ransomware in cases where the attack is reported to the authorities, aims to provide more legal security to insurers and their clients. The report also reinforces the idea that sanctions imposed by the authorities on companies cannot be covered by insurance, including, for instance, GDPR fines. Other measures proposed by the authors include the adoption of cyber insurance wordings that are easier for buyers to understand, including clear definitions of cyberwar exclusions. They also want to see the use of risk-sharing tools, such as captives, to improve the penetration of cyber insurance, and the creation of a cyber risk observatory to better share information on claims and losses. Finally, the authors say the French insurance market should try and turn Paris into a centre of excellence on cyber risks. “I hope that these suggestions will be implemented as soon as possible,” economy minister Bruno Le Maire said after publishing the report. “It is a vital challenge: we are talking about boosting our economy’s digital sovereignty as we face an increase of cyber threats, and to strengthen the resilience of our companies,” he said.

Amrae welcomes bill that approves ransomware payments by French insurers

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Related Articles