The "WannaCry" ransomware attack, which affected hundreds of thousands of computers worldwide, triggered cyber insurance claims around the globe, but insurance experts estimate that losses in the world's major insurance markets will be modest.
Cyber insurance products offered by many insurers can cover attacks similar to the WannaCry virus and are becoming increasingly popular worldwide. The United States is currently the world's largest cyber insurance market, but most of the damaging attacks this time occurred in Europe and Asia.
The large-scale ransomware incident has sparked a surge of interest in cyber insurance worldwide. Last week, European organizations were the first to report a wave of ransomware attacks, including the impact on the UK's National Health Service. Over the weekend and into Monday, attacks demanding ransoms of US$300 began spreading across Asia.
Tom Reagan, a financial and professional products specialist at insurance brokerage Marsh, said the cyber attack has hit many insurers, but the ransoms demanded are very small—almost within the deductibles of the smallest companies. However, the subsequent data loss and business interruption suffered by these companies can be very significant. Many existing policies include extensions that can cover ransom payments, business interruption and the cost of hiring outside experts.
Ben Beeson of Lockton Cos., a cyber risk leader based in Washington, said most cyber insurers offer cyber extortion coverage within their policy terms, but policyholders must check that option and pay an additional premium. The clause has existed since the 1990s and has grown increasingly popular, yet policyholders often fail to pay attention to selecting coverage for liability related to the loss of personal data.
Ben Beeson also said cyber insurance policies also cover business interruption or network interruption liabilities, but usually with a 12-hour waiting period. Many U.S. companies have purchased such protection, but the losses caused by this WannaCry attack occurred mostly in Europe and Asia.
Anthony Dagostino, global head of cyber at Willis Towers Watson in New York, said the United States remains the largest buyer, driven by the regulatory and legal environment, but "we are seeing surging demand from the UK, Europe and Asia."
Mr. Reagan of Marsh said this attack will prompt many non-U.S. companies to buy cyber insurance, and "we have already received many calls asking about it."
Brian J. Dusek, a cyber risk and professional liability attorney at Chicago-based McCullough Campbell & Lane, said that as ransomware incidents increase, more insurance clients are opting for business interruption and ransom coverage. This helps reduce future liability disputes.
According to reports, the ransomware mainly targeted earlier Windows operating systems and systems that failed to install the patch released in March.
Mr. Dusek said many policy terms require policyholders to take reasonable security measures—and the patch had indeed been issued in March.
Pascal Millaire, vice president and head of cyber insurance at San Francisco-based technology security company Symantec, said that although the ultimate insurance industry losses from WannaCry remain unclear, the attack clearly illustrates the growing uncertainty around the accumulation risk insurers face in today's society: a single unexpected event can cause losses for multiple policyholders, and the risk of accumulated insurance events is no longer confined by geography. Insurers should stress-test their cyber insurance products to avoid accumulation risk.
According to Symantec data, 463,841 ransomware attacks occurred in 2016, up 36% from 340,665 in 2015.
Source: Business Insurance 2017-05-16