Jump in ransomware attacks could see cyber rates rise

Companies are experiencing a worrisome recent increase in ransomware that could begin to increase the costs of insurance cover, experts say. The increase follows an apparent relative lull in ransomware payments following the war in Ukraine, as cybercriminals in that region appeared to be temporarily diverted by the conflict, said speakers at the US Wholesale & Specialty Insurance Association’s Annual Marketplace. “We feel like we’ve had a year-and-a-half reprieve from ransomware attacks”, which may have been because of the focus on the war, said Jeff Kulikowski, senior vice president of professional lines for Westfield Specialty. There was “definitely more ransomware in the last quarter”, said Derek Kilmer, associate managing director of professional liability with Burns & Wilcox. Julie Marvel, vice president-southeast US underwriting manager for AXA XL, said that while there may have been a slowdown in attacks, “ransomware didn’t go away”. She noted there have been ransomware issues in the oil and gas, municipalities and education sectors. Kulikowski pointed to cyberattacks on the casino operations of MGM International and Caesars Entertainment earlier this month. “It is hard to tell whether [cybercriminals’] pattern of attacks has completely changed,” he said. The focus recently has been on higher volume, smaller attacks, particularly against small to mid-sized companies, he said. “We have to figure out” if this is a one- or two-off situation, or the start of a trend, Kulikowski said. Megan Spencer, a senior underwriter of cyber and tech at AXA XL in the US, said the casino attacks show that companies “must open up their eyes”. These attacks are a matter of “not if but when”, she said. Michael Phillips, cyber practice leader USA for CFC Underwriting, said the cyber market is “a very unsettled place”. There is continued confusion around pricing, with a number of markets that have responded to ransomware frequency with quick corrections, he said. “For brokers and buyers, that instability is making it difficult to close the sale,” Phillips said. “It’s making clients sceptical about the integration of the product when the prices are spiking up and down with a lot of volatility.” Steve Robinson, national US cyber practice leader of executive lines for Risk Placement Services, an Arthur J. Gallagher unit, envisions “there being some upward adjustment in rates, perhaps a return to more underwriting discipline” in the second quarter of next year. There cannot continue to be “higher frequency and lower pricing for so long before loss ratios go up”, and when that happens there must be adjustments to ensure profitability, he said. Meanwhile, Guy Carpenter also warns that the ransomware attacks on casino operators MGM International and Caesars Entertainment could lead to a more cautious approach on cyber insurance pricing and terms. The incidents may also be classified as two separate cyber catastrophe events, the reinsurance brokerage arm of Marsh & McLennan said in its analysis. “The recent headline-grabbing attacks on these Las Vegas casino resorts will again heighten the industry’s attention to the ongoing threat from ransomware groups,” it says. Ransomware activity has escalated since the start of the year, with ransom payments spiking to near the level of fourth-quarter 2021, according to the report. After a wave of ransomware attacks starting in 2019, cyber insurers responded with major price hikes, with Guy Carpenter’s cyber client group showing an average 183% cumulative rate increase since 2020. Improved rate adequacy and cyber hygiene have since restored confidence to the cyber insurance industry and attracted new capacity. MGM disclosed on 12 September that an ongoing cybersecurity incident had paralysed its information technology and casino operations. It viewed the event as a material risk and reported it to the US Securities and Exchange Commission. Caesars reported to regulators 14 September that hackers had taken data on a significant number of its loyalty programme members, including driver’s license numbers and/or social security numbers, in an attack a week earlier. The Scattered Spider hacking group last week said it took six terabytes of data from the systems of the casino operators, according to news reports. Despite the fact that Caesars and MGM Resorts fell victim to the same threat actor, which used the same ransomware and similar social engineering tactics, “early evidence indicates that these incidents may be classified as two separate events, rather than a single cyber catastrophe event”, Guy Carpenter notes. This article first appeared on our sister website Business Insurance. For further news from Business Insurance, please click here.

Jump in ransomware attacks could see cyber rates rise

Want to read this article?

Read Next

Firms urged to embrace innovation to turn EU’s ESG rules into competitive advantage

Climate and net-zero disclosure falling short, finds EY

Legal sector faces surge in cyberattacks

Munich Re hopes Global Shield picks up momentum at COP28

Firms urged to embrace innovation to turn EU’s ESG rules into competitive advantage

Companies must prepare for more extreme weather

Climate and net-zero disclosure falling short, finds EY

Legal sector faces surge in cyberattacks

Munich Re hopes Global Shield picks up momentum at COP28

Want to read this article?

Read Next

Firms urged to embrace innovation to turn EU’s ESG rules into competitive advantage

Companies must prepare for more extreme weather

Climate and net-zero disclosure falling short, finds EY

Legal sector faces surge in cyberattacks

Munich Re hopes Global Shield picks up momentum at COP28

Related Articles