Posted on June 7, 2021 at 11:47 AM

Insurers Reconsider Ransomware Policies As Hacking Claims Surge

Ransomware attacks have been around for several years, but their prevalence has never been felt so high before. With the increasing surge of hacking incidents, insurers are now pondering on the risks. They are considering canceling policies that will make them pay for risks relating to ransomware attacks.

This year, hackers have succeeded in breaking into organizations running critical infrastructures, with the Colonial Pipeline incident the most recent to come to mind.

Apart from the fuel pipeline incident, a key producer of U.S. meat supply was also hit, as well as the ferries that serve Nantucket and Martha’s Vineyard.

The hacking incidents also show how critical sectors of the economy can be impacted by toxic codes delivered by threat actors thousands of miles away. This also makes it difficult to stop, considering that the hackers are now using effective technology to hide their identities. They also demand ransom payments through cryptocurrencies, which also make them more difficult to trace.

Insurers are now reconsidering their stance on the ransomware policies, which indemnifies victimized organizations that took up such policies.

Cyber insurance still in its early phase

The property insurance market began after the great fire of London when residents feared that the destruction of 1666 could be repeated. In the same way, insurance companies started offering ransomware policies as threat actors targeted organizations.

Head of cyber at Marsh insurance firm Sarah Stephens stated that the cyber insurance space is about 2 decades old. But when compared to other classes of insurance such as marine or property, it’s still in its early stage.

Insurance companies are providing emergency support services and financial compensation for such attacks. Chief Innovative Officer at London-based insurance provider Graeme Newman stated that the company is drawing a line with the rapidly evolving market of cyber coverage.

Russian-based hackers accused

Cybersecurity agencies are blaming the incessant rise of attacks on critical infrastructure on state-sponsored attackers, especially those from Russia. This type of attack is not the challenge of insurance companies, but those demanding ransomware payments.

Western officials are pointing accusing fingers at threat groups based in Russia. They often steal the data, encrypt them, and demand a ransom payment from their victims before decrypting and releasing the data.

Surging cost in cyber insurance

For organizations that buy cyber insurance policies, ransomware is usually part of the cover offered by most insurance companies. In this U.S about 50% of those that purchase insurance or their organizations have such ransomware clause included in the policies. The compensation includes financial indemnity for losses suffered due to the attack and the cost incurred for the ransom payment. It also includes other services like data recovery and other financial losses suffered because of the incident.

The cost of cyber insurance is expectedly rising in the U.S. Premium for such insurance cover has surged by 27% from last year, based on the data shared by Insurance broker Aon.

Claims of insurance rising

Insurers have also intensified their vigilance and controls when it comes to the organizations they sell such cover to. For example, U.S. insurance giant AIG has put a tougher underwriting approach was set up this year, which outlined 25 detailed questions on the security measures of the clients. Insurance companies are looking to reduce the risk of a ransomware attack as much as possible.

AIG’s global head of cyber insurance Tracie Grella stated that the company is looking to reduce the risk of exposure and attack. He added that AIG “may not write coverage at all” if it has very low controls.

With the surging claims of ransomware insurance, the profits of insurance companies have been hit. As a result, underwriters are contemplating whether it’s still worth it to continue offering coverage for that class of insurance.