WannaCry attack brings moment of truth for cyber insurance market

The recent WannaCry ransomware attacks that affected businesses, government agencies and individuals in more than 150 countries could be a seminal moment for the cyber insurance market. This is especially true in Asia, where a combination of outdated security systems, a lack of reporting on cyber attacks and a low take-up of cyber insurance have all been highlighted by the fallout from the latest cyber incident. At present, the US dominates the cyber insurance market – it is estimated that nine out of ten policies are taken out by US corporates. Yet even within the US, only one third of companies have purchased cyber insurance coverage. The statistics are even more damning when applied beyond the US. For example, the cyber insurance market accounts for just 1% of the motor insurance market within the G7, despite the fact that the value of assets insured for cyber insurance by far exceeds that of motor vehicles. The EU is some way behind but with a new data protection law, the General Data Protection Regulation, due to come into force in May 2018, adoption of cyber insurance is expected to increase markedly. Asia though stands out as a region particularly vulnerable to cyber attacks but also worryingly short on insurance cover. For example, in India more than 40,000 computers were infected by the virus, making it the third most affected country, according to IT security firm Kaspersky Lab. “Most of the Indian organisations are still vulnerable to the attacks, since the sophistication of these cyber threats is going up and many Indian organisations including private and public sector still use outdated operating systems, which make it easy for the cyber attackers to compromise the systems," Altaf Hald, managing director at Kasperksy Lab’s south Asian division told the Economic Times of India. Worryingly though, no major Indian corporates have reported any major disruption, despite a mandatory requirement for listed companies to disclose any cyber attacks. It is estimated that as many 40,000 institutions in China were affected by the ransomware, including police stations and state-owned oil company China National Petroleum Corporation, which cut the network connection to all of its refill stations on Friday evening. The high level of pirated software in the country is believed to have aggravated the threat, given that security patches issued by Microsoft could not be installed on any computers running illegal software. What remains to be seen is whether the adoption of cyber insurance will grow in Asia as a result of the recent ransomware attacks. Already, many commentators are speculating that insurers will be the big beneficiaries from the attacks and previous estimates of the future worth of the cyber insurance industry have been revised – with premiums forecast to grow from the current $3bn to $10bn by 2020. Others though, question just how much cyber insurance can contribute to companies’ resilience to cyber attacks, especially in relation to the expanding Internet of Things market. “Insurance cover does not really address these emerging cyber risks in any entirety and underwriters tend to chase the trends rather than address the changing risks using actuarial data,” said David Piesse, global insurance lead and chief risk officer at software security firm Guardtime, speaking to Commercial Risk Asia. There is a need for chief information security officers and cyber underwriters to work more closely together and to explore more data-driven underwriting, as opposed to the focus on data privacy that has dominated the cyber insurance market to date, said Mr Piesse. He is also doubtful whether the monetary loss from the WannaCry attacks will be enough to be the eureka moment to spur people to spend more resources on protecting data and integrity, and move this risk under complete boardroom compliance. “The ransom amounts are small and insurance does cover some clean-up and recovery costs. However, it is a big wake-up call both to organisations and insurance for accumulation risk, and steps must be taken to verify data integrity of third and fourth parties mathematically and independently of the of the organisations that host the data. This converts them to trusted service providers.” Others have issued words of warning for insurers looking to capitalise on a likely increase in demand for cyber cover. Fitch Ratings said that insurers are in “a unique position to assist customers in addressing the cyber threat” but also warned that “a cautious approach to adding cyber exposures is warranted as there is considerable uncertainty in pricing and underwriting this risk”, adding that “aggressive expansion by individual underwriters into the segment could be credit negative”. Another uncertainty is how much the recent ransomware attacks will cost both corporates and insurers. Most cyber insurance policies to date have focused on the costs resulting from a data breach – the cost of notification, possible regulatory fines and investigative expenses, as well as credit monitoring costs for customers and the cost of hiring a PR firm to manage any reputational damage. There has been less focus on the cost of ransomware – not so much the average individual ransom demands of $300 sought by hackers but the cost of business interruption (BI). George Ng, chief technology officer at cyber risk firm Cyence told the Wall Street Journal that the global loss could amount to $8bn, based on the average time it would take an affected company to resume normal operations. Meanwhile, Kevin Kalinich, global head of Aon’s cyber risk practice, told Reuters that the cost of BI would far outweigh the price of ransoms. “If you’re a hospital that turned away patients, if you’re a global delivery company that can’t send package, or a telecom company in Spain, Russia or China, the financial statement impact from the business interruption is much larger than the $300 ransomware,” he said. It may also encourage greater adoption of cyber insurance from a new and wider range of companies beyond those companies worried about exposing customers’ data. “This will make a lot of clients very nervous,” said Tom Reagan, cyber practice leader at insurance broker Marsh, speaking to the Financial Times. “Manufacturing and heavy industrial companies are having their operations disrupted. Insurers will see this as an opportunity to drive the market.” Asia has also featured heavily in efforts to identify the suspects behind the ransomware attack. An article in the Washington Post this week outed North Korea as a possible source, suggesting there were links between the WannaCry virus and the 2014 hack on Sony Pictures that was attributed to North Korea as an act of revenge for Sony’s release of a film that satirised its leader Kim Jong Un.

WannaCry attack brings moment of truth for cyber insurance market

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Related Articles