Marriot breach cyber losses up to $600m

The Marriot data breach could cost up to $600m in direct cyber losses, with insurance potentially covering half that amount, according to recent estimates and reports. AIR estimates that the breach will cost Marriot between $200m and $600m, excluding any fines, D&O and other non-cyber policy-related claims and the impact of insurance. “The net financial impact to Marriott will be partially mitigated by the cyber insurance and other liability insurance coverage they reportedly have,” said the modelling firm. The wide range reflects uncertainty about the exact data stolen and whether any of the 500 million records breached were duplicates. AIR’s modelled estimate include first- and third-party losses directly related to the security breach. These include notification costs, forensics, credit monitoring, replacing credit cards, setting up a call centre, and any liability covered under an affirmative cyber policy. Insurable losses from the data breach could be in excess of $250m, RMS said, potentially making it the largest ever hit to the bourgeoning cyber market. RMS expects the losses to exceed $160m and might top $250m. It said litigation will be a major contributor to the bill, as well as a source of considerable uncertainty. The modelling firm explained that the amount of cyber cover Marriott has in place remains uncertain, but said a limit in excess of $100m is not unusual for companies of its profile. Media reports have suggested that the hospitality group’s cyber insurers are expecting a claim of about $300m, and that the company’s limit would cover this amount. The same reports said the cyber tower is led by AIG and brokered by Lockton. If insured losses reach the upper end of RMS’s forecast, they would rival Merck’s NotPetya claim of about $275m as the biggest ever to hit the cyber market. “With the full impact of the Marriott breach still emerging, losses certainly have the potential to be significant and the potential hit to Marriott’s insurers is substantial,” said Tom Harvey, senior product manager at RMS. Marriott received an alert from an internal security tool regarding an attempt to access its Starwood guest reservation database in September. The company discovered that the Starwood network had been accessed since 2014. At the end of last month, Marriott said that it believes about 500 million customers were affected, making it by far the largest breach to hit the hospitality sector. Approximately 327 million of the guests hacked lost a combination of name, address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, and arrival and departure information. For some, the information also includes payment card numbers and expiration dates. There are two components needed to decrypt the payment card numbers and Marriott has not been able to rule out the possibility that both were taken. For the remaining guests, the information was limited to name and, in some cases, other data such as mailing and email address. Marriot has taken steps to help guests affected by the data breach. It has set up a dedicated website and hotline to deal with queries, sent emails to all guests affected and provided them with free access to WebWatcher, which helps flag misuse of their information. WebWatcher monitors internet sites where personal information is shared and generates an alert if there is evidence of misuse. RMS’s Mr Harvey noted rumours that Chinese state hackers might be behind the cyberattack. But, as with most cyber incidents, finding the culprits will be a lengthy and uncertain task, he added.

Marriot breach cyber losses up to $600m

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Related Articles