Sponsored Content by Nationwide

The Rapid Evolution of Cyber Threats

As technology grows more sophisticated, so do hackers. Insurers must do their best to adapt and keep up.
By: | June 7, 2017 • 6 min read

It seems like only yesterday that the biggest cyber threat was the theft of credit card information. And in fact, it was only a few years ago when that was the case.

But recent events show just how quickly the risk has evolved. The ‘WannaCry’ ransomware attack that struck hundreds of companies around the globe in May, causing an estimated $4 billion in total losses, is a testament to how the risk has grown.

Technology forms the backbone of business for companies of every shape and size. The amount of information generated and stored on the Internet is growing exponentially, doubling every few days. And businesses are drawn closer together through reliance on interconnected systems.

As a result, there are more access points than ever for cyber criminals to exploit. System failure can impact multiple parties at a time, and companies of every size and sector are at risk.

As cyber exposures evolve, insurers are doing their best to adapt and keep up.

“We’ve come a long way from the early days when the biggest concern around cyber risk was the protection of credit card information,” said Tom Iorio, Senior Vice President of Management Liability and Specialty, Nationwide.

The Latest Threats: Phishing and Ransomware

Tom Iorio, Senior Vice President of Management Liability and Specialty

Cyber risk initially was a question of network security and data privacy, and it was focused on retailers and financial institutions.

“But now, credit card data has flooded the market and become less valuable for cyber thieves. It’s not worth their time to steal,” Iorio said.

As technology grows more sophisticated, so do hackers. Cyber attackers have turned to new, more lucrative tactics to exploit and profit from companies’ network vulnerabilities.

Social engineering scams and cyber extortion in the form of ransomware have emerged as the second wave of cyber threats.

Social engineering or “phishing” schemes don’t necessarily involve a breach of a company network or any inside access to sensitive data. Rather, phony emails purported to be sent by a senior manager, or others externally, are directed to employees, typically asking them to wire a sum of money into an external account. They can be very believable imitations of the real deal.

“I myself have received three of these “spear phishing” emails,” Iorio said. “They were supposedly sent by my former boss, asking me to pay a claim and deposit money into an external account. But there were a few problems that stuck out. For one thing, I don’t have the capability to wire money out to pay a claim, and my boss would never ask me to do so. There were also technical flaws. The email was misspelled, for example.”

When employees do fall for these tricks, however, companies stand to lose thousands of dollars. An incident like this is more likely to be covered in a crime policy than a cyber policy, since phishing is a form of computer fraud for funds transfer rather than an outright hack of proprietary information.

Cyber extortion in the form of ransomware, on the other hand, involves hijacking a company’s internal system to hold its data hostage, rendering it inaccessible and unusable until a ransom is paid. And it’s a more difficult risk to insure.

“For the sake of protecting their reputations, companies typically like to keep these incidents quiet, resolving them quickly without attracting attention of the press,” Iorio said. “Unlike theft of personally identifiable information, there is no regulatory requirement to report theft by ransomware. There could be many incidents that nobody hears about.”

“Without a solid understanding of the loss history, it’s harder to understand the risk and to write appropriate coverage. But it seems logical that someday soon, cyber and crime policies will be blended to respond to these incidents.”

When cyber attackers look to steal dollars, not just data from their victims, potential targets expand to industries beyond finance and retail. Hospitals, universities and government bodies are some common targets for cyber extortionists.

“These organizations may not have the dollars to devote to hack-proofing their systems. Many hospitals, for example, are nonprofit. They prioritize the services they provide,” Iorio said. Apart from the losses incurred from paying a ransom or fulfilling a fraudulent wire request, these institutions also have to consider the risk of downtime.

Risks on the Horizon

A ransomware attack — or any system failure that halts operations, malicious or otherwise — can incur large business interruption losses. Retailers lose sales if their websites or POS systems go down. Manufacturers lose productivity and fall behind on deadlines if computer-operated machinery fails. For some industries, network downtime can have residual effects for days.

“Airlines offer a good example. If a major airline is hit with a denial-of-service attack, or experiences some other kind of network failure, it may take several days to get planes back to their regular schedule and re-allocate passengers whose flights were cancelled,” Iorio said. “A downtime of just 20 minutes could still cost the airline millions of dollars.  That loss would be a direct result of a cyber event.”

Most cyber policies include coverage for business interruption on a contingent basis. Like first and third party liability for network security, the coverage has become fairly standard.

But as cyber exposures continue to evolve, the question of liability will be up for debate.

Property damage and bodily injury resulting from a cyber event, for example, is on the horizon, especially as the Internet of Things grows.

“IoT comes down to cloud exposure. With so much interconnectivity, and so many access points, the exposure is huge. But there are still questions around where the liability will fall,” Iorio said.

He pointed to autonomous cars. If a car gets hacked and is driven off the road, who is liable? The manufacturer? The software creator? The driver’s auto insurer?

Staying Steady through Changes

“We’re experiencing not just an evolution of cyber risk, but an evolution of cyber coverage. Cyber risk seems to take on new forms all the time, and nobody is certain of what the impact could be,” he said. “But we do know that cyber touches everything, and we as an industry are trying to connect the dots and cover the gaps between other coverages that are related.”

Insurers that are focused on building quality, lasting relationships with clients will be best positioned to weather the changes ahead. As cyber risk intersects with crime, property, general liability and other policies, companies will benefit most from partnering with a carrier that wants to work with them across their whole portfolio.

That way, when a loss occurs, carriers and their clients can work together to decipher what is or is not considered a cyber event and where the coverages lie. That relationship also makes it easier to fine tune the program to meet a company’s specific exposures going forward.

“At Nationwide, we’re very client focused. “We work with the top brokers in the nation and choose our clients wisely and create personal as well as a business relationship,” Iorio said. “When we know we have a quality client, we want to be there for them across their entire portfolio: directors and officers, professional liability, employment practices, crime and cyber.”

“The market may go up and down, but we stay consistent with our clients, and the same is true for cyber. We won’t be in it one day, and out the next.”

To learn more, visit https://www.nationwide.com/business-insurance.jsp.



This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Nationwide. The editorial staff of Risk & Insurance had no role in its preparation.

Nationwide, a Fortune 100 company, is one of the largest and strongest diversified insurance and financial services organizations in the U.S. and is rated A+ by both A.M. Best and Standard & Poor’s.

Risk Management

The Profession

Pinnacle Entertainment’s VP of enterprise risk management says he’s inspired by Disney’s approach to risk management.
By: | November 1, 2017 • 4 min read

R&I: What was your first job?

Bus boy at a fine dining restaurant.

R&I: How did you come to work in this industry?

I sent a résumé to Harrah’s Entertainment on a whim. It took over 30 hours of interviewing to get that job, but it was well worth it.

R&I: If the world has a modern hero, who is it and why?


The Chinese citizen (never positively identified) who stood in front of a column of tanks in Tiananmen Square on June 5, 1989. That kind of courage is undeniable, and that image is unforgettable. I hope we can all be that passionate about something at least once in our lives.

R&I: What emerging commercial risk most concerns you?

Cyber risk, but more narrowly, cyber-extortion. I think state sponsored bad actors are getting more and more sophisticated, and the risk is that they find a way to control entire systems.

R&I: What is the riskiest activity you ever engaged in?

Training and breaking horses. When I was in high school, I worked on a lot of farms. I did everything from building fences to putting up hay. It was during this time that I found I had a knack for horses. They would tolerate me getting real close, so it was natural I started working more and more with them.

Eventually, I was putting a saddle on a few and before I knew it I was in that saddle riding a horse that had never been ridden before.

I admit I had some nervous moments, but I was never thrown off. It taught me that developing genuine trust early is very important and is needed by all involved. Nothing of any real value happens without it.

R&I: What about this work do you find the most fulfilling or rewarding?


Setting very aggressive goals and then meeting and exceeding those goals with a team. Sharing team victories is the ultimate reward.

R&I: What is the most unusual/interesting place you have ever visited?

Disney World. The sheer size of the place is awe inspiring. And everything works like a finely tuned clock.

There is a reason that hospitality companies send their people there to be trained on guest service. Disney World does it better than anyone else.

As a hospitality executive, I always learn something new whenever I am there.

James Cunningham, vice president, enterprise risk management, Pinnacle Entertainment, Inc.

The risks that Disney World faces are very similar to mine — on a much larger scale. They are complex and across the board. From liability for the millions of people they host as their guests each year, to the physical location of the park, to their vendor partnerships; their approach to risk management has been and continues to be innovative and a model that I learn from and I think there are lessons there for everybody.

R&I: What is the risk management community doing right?

We are doing a much better job of getting involved in a meaningful way in our daily operations and demonstrating genuine value to our organizations.

R&I: What could the risk management community be doing a better job of?

Educating and promoting the career with young people.

R&I: What have you accomplished that you are proudest of?

Being able to tell the Pinnacle story. It’s a great one and it wasn’t being told. I believe that the insurance markets now understand who we are and what we stand for.

R&I: Who is your mentor and why?


John Matthews, who is now retired, formerly with Aon and Caesar’s Palace. John is an exceptional leader who demonstrated the value of putting a top-shelf team together and then letting them do their best work. I model my management style after him.

R&I: What is your favorite book or movie?

I read mostly biographies and autobiographies. I like to read how successful people became successful by overcoming their own obstacles. Jay Leno, Jack Welch, Bill Harrah, etc. I also enjoyed the book and movie “Money Ball.”

R&I: What is your favorite drink?

Ice water when it’s hot, coffee when it’s cold, and an adult beverage when it’s called for.

R&I: What does your family think you do?

In my family, I’m the “Safety Geek.”

R&I:  What’s your favorite restaurant?

Vegas is a world-class restaurant town. No matter what you are hungry for, you can find it here. I have a few favorites that are my “go-to’s,” depending on the mood and who I am with.

If you’re in town, you should try to have at least one meal off the strip. For that, I would suggest you get reservations (you’ll need them) at Herbs and Rye. It’s a great little restaurant that is always lively. The food is tremendous, and the service is always on point. They make hand-crafted cocktails that are amazing.

My favorite Mexican restaurant is Lindo Michoacan. There are three in town, and I prefer the one in Henderson as it has the best view of the valley. For seafood, you can never go wrong with Joe’s in Caesar’s Palace.

Katie Dwyer is an associate editor at Risk & Insurance®. She can be reached at [email protected]