Cyber claims becoming more difficult and technical, warn brokers

Cyber insurance claims have become more difficult for buyers, with carriers now asking very detailed questions before paying out, brokers told delegates at the GVNW Symposium. The pair from Lockton said that, particularly when it comes to ransomware claims, insurers are now really checking whether insureds told the truth in their declarations at cover application stage. In a session at the event in Munich focused on the US cyber market, Deborah Hirschorn, Lockton’s managing director, US cyber and technology claims leader, said: “We are in a different market than we were a couple of years ago as cyber carriers writing risk. Now everybody wants to grow, grow, grow but on the flip side nobody wants to pay, pay, pay. What we have seen is that the handling of the claims, especially for ransomware, has become more technical.” “Insurers are really drilling down on your application… They are asking very detailed questions during the claims process to see if you were truthful on your applications. That is what we are seeing,” she added. Hirschorn said that a few years ago the cyber claims experience was very different for firms operating in the US. As long as the definition of cyber extortion was met and the cyber criminals were not a known terrorist on the Office of Foreign Assets Control (OFAC) list, insurers would pay the claim. “That was really all that was done,” she said. “But now, the carriers are taking your application and are looking to see what you have said on that. So for example, if you have had a ransomware attack through a third-party vendor, they want to see if you have MFA on remote access. If you checked yes on your application but someone was able to get in through a third-party vendor, they want to know how they got in,” said Hirschorn. “The claims adjusters will ask clients on the initial phone call, did you have MFA in place? It is one of the first questions, and was not being asked two, three or four years ago. That has been the hurdle that we have seen from a ransomware prospective,” she added. Her colleague, Kevin Holland, vice president of Lockton Global Solutions, said insurers are quick to respond to initial cyber claims notifications but getting payments is now more challenging. The comments were backed up by a quick poll of GVNW members attending the session. Some 65% described cyber claim handling as worse than in other lines, with 10% saying it is the same and 25% believing it to be better. The Lockton pair went on to explain that firms operating in the US remain the overwhelming target for cyberattacks because they tend to pay ransom demands over fears of litigation from customers. Firms in the US account for around 60% of global ransomware incidents, the brokers added. Hirschorn said that most US companies will now only pay to retrieve data if they think the breach is going to lead to litigation. She explained that companies will often still get litigated if they pay cyber ransoms to secure data but courts will take this into account when setting awards. The brokers also told German risk managers that the frequency of cyber claims in the US fell dramatically between 2020 and 2022. But they added that things changed “dramatically” in January of this year when claims jumped more than 150% as criminals in Russia and Ukraine, which make up the majority of cyberattackers, got back up and running after war between the two countries broke out in 2022. At the same time, severity of claims has remained pretty constant over time, according to Lockton. Hirschorn and Holland said cyber insurers are constantly changing their tactics to keep ahead of defences built up by industry. The latest methods focus on double extortion whereby cybercriminals target both companies and their customers to try and secure financial payments. Cyberattackers are also now infiltrating data rather than just encrypting. Meanwhile, ransomware as a service is now a big industry within the cybercriminal fraternity, they said.

Cyber claims becoming more difficult and technical, warn brokers

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Related Articles