Cyber insurance payouts fall short of ransomware losses, finds survey

Cyber insurance paid only some of the losses incurred from ransomware attacks for 42% of business with cover in place, according to a new global survey from Cybereason of almost 1,300 security professionals. The survey results also suggest that paying ransoms is not the best course of action, with time and money better spent on risk mitigation. Cybereason said 66% of all businesses reported significant revenue loss from ransomware attacks, although higher in Spain at 80% and Germany at 75%, with the costs of such attacks spiralling and projected to hit $20bn globally this year. While some 54% respondents had bought cyber insurance to cover ransomware in the past 24 months, a further 21% said their cyber insurance excluded losses from ransomware attacks. “These results suggest a major impact to those who don’t have the proper insurance, and the potential for significant impact to the business even if they do,” Cybereason said. “Having cyber insurance coverage in place does not guarantee an organisation will be able to recoup losses associated with a ransomware attack,” added CEO of Cybereason, Lior Div. Ransom demands are increasing, Cybereason said. Its survey found 35% of businesses that met the ransom demand paid between $350,000 and $1.4m, with a further 7% paying more than $1.4m. Several high-profile attacks this year, most recently against Colonial Pipeline, have made companies think about whether to pay ransoms to restore access to systems or rely on their own backups. The survey found that 80% of the firms that paid a ransom suffered another attack and almost half of these firms (46%) suspected the same attacker. Pressure to pay ransoms has escalated with the growing use of double-extortion attacks, where attackers extract and store data before encryption and threaten to publish or sell the data if the initial ransom for an encryption key is not paid. At the same time, Cybereason said 46% of companies that paid a ransom reported some data, or in some cases all data, was corrupted during the recovery. “These findings underscore why it does not pay to pay ransomware attackers, and that organisations should focus on early detection and prevention strategies to end ransomware attacks at the earliest stages before critical systems and data are put in jeopardy,” Cybereason said. The survey also found that 26% of firms were forced to close following a ransomware attack and 32% lost members of their top leadership team. Globally, 53% of respondents said an attack caused brand and reputational damage, although this was higher in the US at 56% and the UK at 63%. “Paying a ransom demand does not guarantee a successful recovery, does not prevent the attackers from hitting the victim organisation again, and in the end only exacerbates the problem by encouraging more attacks. Getting in front of the threat by adopting a prevention-first strategy for early detection will allow organisations to stop disruptive ransomware before it can hurt the business,” Mr Div said.

Cyber insurance payouts fall short of ransomware losses, finds survey

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles