Close to $200bn at risk from global ransomware attack

A global ransomware attack could cost as much as $193bn and encrypt data on 30 million devices within just 24 hours, according to a scenario played out in a new report by the Cyber Risk Management project (CyRiM) that warns business are underprepared. Using an infected phishing email scenario, which once opened would forward to all contacts, the contagion malware would spread to about 600,000 businesses across the globe and demand ransom payments to decrypt data or restore infected devices. The US and Europe would be most affected, the report says, with the attack costing $89bn and $76bn respectively. Asia would have $19bn at risk under the ransomware scenario, with the rest of the world accounting for the remaining $9bn. In Europe, retail business, professional services and manufacturing are forecast to be the hardest hit. US losses would be driven by high infection rates across finance, healthcare and retail sectors, the report says. Such an attack – dubbed the ‘Bashe’ attack in the report – would affect a wide range of businesses across the world through lower productivity, IT recovery costs, ransom payments and supply chain disruption, the report says. Globally, it finds that retail and healthcare would be most affected at a cost of $25bn each, followed by manufacturing on $24bn. Both traditional retail and online businesses would be constrained by encryption of payment systems, while in healthcare ageing IT equipment would be more difficult and costly to clean-up, patch and replace. Small and medium-sized firms are particularly at risk in Europe because weak cyber defences put them at greater risk of attack, CyRiM says. Globally, direct economic losses of $133bn are forecast to consist of $112bn in productivity and consumption loss, $18bn in clean-up costs and $2bn in cyber extortion loss. A further $60bn is estimated for indirect economic loss. The report estimates economic losses of $85bn in the least severe variant of the attack. CyRiM, a public-private initiative supported by Lloyd’s, says 85% of economic losses would be uninsured, creating an insurance gap of $166bn. The Bashe scenario found the bulk of insurance claims from such an attack would be booked to business interruption, though losses would also spread to contingent business interruption, cyber extortion, incident response costs, personal cyber and liability. Claims would range from between $10bn in the least severe form of attack to $27bn in the most severe form of attack, with business interruption accounting for 59% of the loss. CyRiM says such losses far exceeds estimated affirmative cyber premiums for 2019 at $6.4bn, and “shows that the insurance industry is significantly exposed to a contagious malware event”. CyRiM was critical of global preparedness for a ransomware attack on such a scale. Companies were warned of contagion risks with the WannaCry and NotPetya attacks in 2017, but the report says there has been a reluctance to invest in risk prevention without a full understanding of the financial impact. It urges businesses, industry associations, markets and policymakers to improve levels of awareness over cyber and its associated risks. The report says organisations must have effective responses to contagious malware built into their business operations. Dr Trevor Maynard, head of innovation at Lloyd’s, commented: “Companies must ensure they are better prepared for ransomware attacks and that includes working with insurers to reduce the risks before they are attacked, and ensuring they have the right insurance cover in place to respond after the event. The reality for business is: it’s not if you get attacked but when.”

Close to $200bn at risk from global ransomware attack

Want to read this article?

Read Next

Vast majority of global wind and solar energy assets unprotected from fire

Ardonagh to acquire PSC Insurance in Australia

Baltimore bridge supply chain insurance losses likely

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

New cyber insurance endorsement from AXA XL in US

Vast majority of global wind and solar energy assets unprotected from fire

Ardonagh to acquire PSC Insurance in Australia

Baltimore bridge supply chain insurance losses likely

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

New cyber insurance endorsement from AXA XL in US

Want to read this article?

Read Next

Vast majority of global wind and solar energy assets unprotected from fire

Ardonagh to acquire PSC Insurance in Australia

Baltimore bridge supply chain insurance losses likely

Munich Re Q1 net result up 68%, buoyed by ERGO international growth and April renewals

New cyber insurance endorsement from AXA XL in US

Related Articles