Ransomware losses to drive cyber rates in France

Large French companies face price increases for cyber insurance following a spate of large ransomware losses, as hackers target corporates with ever higher extortion demands. The increased frequency and severity of ransomware attacks in France, and the rest of Europe, is putting cyber insurance rates under increased pressure, according to Jean Bayon de La Tour, head of cyber for continental Europe at Marsh’s finpro practice. Rates for cyber insurance in France have risen and insurers have been looking to increase retention levels, he told CRE as AMRAE gathered for its conference in Deauville. “The cyber insurance market in France has been more aggressive in terms of pricing and insurers have sought to realign retention levels. Retentions are stable in Europe, but in France last year we saw a reversal in the trend of decreased retentions,” he said. Cyber insurance rates were reducing up until last year, but recent increases have seen prices return to the levels of about four years ago, continued Mr Bayon de La Tour. However, cyber insurance rates in Europe remain about 30% to 50% lower than in the US, the UK and Australia, where liability claims are much larger, he added. Losses, and in particular ransomware claims, are the main driver behind growing pressure on cyber insurance rates. A number of French companies were hit by crippling ransomware attacks in 2019. Engineering firm Altran SA and agrifood business Fleury Michon SA are among those known to have reported incidents in France. In November, French multimedia group M6 was also hit by a ransomware attack, as was a hospital in Rouen. Elsewhere in Europe, a ransomware attack at Danish hearing aid manufacturer Demant in September cost the company DKK650m ($95m), making it one of the costliest ransomware attacks of 2019. Norwegian aluminium manufacturer Norsk Hydro, Belgium-based aerospace firm Asco and Belgian textile machine producer Picanol have all been victims of ransomware during the past year. Cyber insurance claims continue to increase in frequency and severity, according to Mark Camillo, head of cyber for Europe, the Middle East and Africa at AIG. The claims experience in France, which mirrors that of Europe, is dominated by ransomware attacks and business email compromise scams. “Most cyber incidents and claims are tied to business email compromise or ransomware, particularly targeted ransomware claims. While most clients don’t pay extortion demands, they do experience significant business interruption and forensics costs, as well as the expense of restoring systems,” said Mr Camillo. Ransomware attacks in the past year have become more targeted and sophisticated, according to Luc Vignancour, cyber underwriter at Beazley in Paris. Hackers will study a target company to identify security vulnerabilities and weigh up the cost of attack against potential ransom value and likelihood of success. As ransomware attacks have evolved, extortion demands have grown and are now often in excess of €1m, said Mr Vignancour. Companies in all sectors appear to be at risk of ransomware. Hackers will target companies that hold personal data, threatening to go public unless the ransom is paid. However, they may also look to encrypt and shut down a company’s critical systems. This type of attack could affect almost any company, including manufacturers, professional service firms and public sector organisations, explained Mr Vignancour. Any increase in ransomware attacks may well move the cyber market, said Mr Vignancour. “Insurers need to underwrite a lot of accounts to pay a large claim of €25m or more. The ransomware attacks made public in Europe in 2019 are estimated to have cost about €200m to €300m, which is approaching the size of the continental European cyber insurance market. So when underwriting, the insurance industry needs to take into account that it will need enough premium to pay a loss,” he said. Growing liability is another potential driver of cyber insurance pricing. The General Data Protection Regulation (GDPR), which was implemented in May 2018, increases data and privacy liability for companies, bringing higher fines and potential collective litigation. Several large data breaches have already resulted in big fines and sparked litigation. The British Airways data breach in 2018 landed the airline with a likely £189m fine and resulted in a class action suit in the UK. However, the GDPR has not yet had a major impact on cyber insurance claims in France and Europe, according to Mr Camillo. While a number of data breaches have resulted in large fines and litigation, this does not reflect the experience overall, he said. “First-party and ransomware costs are still the biggest driver of cyber claims in Europe, including France. We have not seen a spike in data liability and GDPR claims, but that is not to say we will not see a shift towards liability. We may yet see a significant liability from the GDPR,” said Mr Camillo. The largest GDPR fines have come from the UK regulator, although the French privacy regulator – Commission Nationale de L'informatique et des Libertés – issued a €50m GDPR fine against Google in 2019. Overall, GDPR enforcement has been proportionate and within expectations, according to Mr Camillo. “GDPR adds to the cost of a data breach – from legal advice and forensics – but so far regulatory fines and penalties have been relatively light for minor incidents that are dealt with effectively,” he said. Cyber insurance claims in France continue to be driven by business interruption and first-party costs, rather than liability, according to Mr Bayon de la Tour. “For the moment, the GDPR is not a driver for losses, but this could change with tougher regulatory enforcement and the potential for class actions,” he said. Mr Vignancour agreed that first-party and business interruption costs are seen as the biggest cyber threat in France, noting that they are the top cyber concern of large corporate customers and the biggest driver of claims, he said. “A lot of people predicted that the GDPR would be a big boost for insurers and all companies would buy cyber insurance. There have been losses in the market in 2019, and some have been large, but these are almost always first-party losses and business interruption from malicious cyberattacks or accidental events, such as a bug or IT malfunction,” said Mr Vignancour. “We have not yet seen liability claims linked to the GDPR in France. Where our response services have been triggered there may have been the need for some legal advice around notification, but we have not seen claims or large fines as yet,” he added. Meanwhile, the head of a multinational insurance group in France has described the French insurance market as "frustrating", during a session at this week’s AMRAE conference on wider market conditions. Brigitte Bouquot, president of French risk management association AMRAE, has said the creation of state-backed cyber insurance pools is a good idea in principle, particularly for terror-related threats, but said companies must first focus on loss prevention and risk management before exploring such options.

Ransomware losses to drive cyber rates in France

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles