This year, it’s predicted that a ransomware attack will strike a business every 14 seconds. While hackers continually find new ways to infiltrate systems and make a profit off stolen data, ransomware remains one of the most common types of cyber theft.  

In 2016, there were roughly 1 billion ransoms demanded. Just two years later, that number ballooned to 8 billion. 

“We’ve definitely seen increased frequency and severity as the attacks have become more targeted and sophisticated,” said Jeremy Gittler, practice leader and head of cyber and technology claims, North America, AXA XL.   

Prior to 2018, the market was dominated by un-targeted ransomware attacks. The ransoms were quite low because criminals didn’t know who they were infecting. They threw hundreds of lines in the water and hoped a few would take the bait.  

But then hackers started doing their homework, gathering intel on companies first so they could understand their financials, network size, employee accounts, etc. That knowledge enabled them to set higher ransom amounts with confidence that their targets could afford to pay.  

“Originally, ransoms were about $300, but now we see ransoms in the millions. This year the highest demand we’ve seen was $16 million,” Gittler said. 

A Need for Help in High-Pressure Situations 

Jeremy Gittler, Practice Leader and Head of Cyber and Technology Claims, North America, AXA XL

Naturally, having your system taken hostage and facing a demand of millions can cause panic.  Indeed, companies have to act quickly in order to minimize business interruption and reduce the likelihood that the attackers will exfiltrate private data. But paying the ransom is not always a surefire way to end the incident.  

“There is no guarantee the hackers will deliver the promised decryption key. Even with the key, it could still take a few weeks to restore your network. It may be a better idea to restore from backups, which also takes time but saves the ransom,” Gittler said.  

Recognizing insureds’ need for quick, expert guidance in these high-pressure situations, AXA XL’s cyber team established a 24/7 breach hotline. Unlike other carriers who outsource this service to law firms, AXA XL’s in-house claim professionals, all attorneys, personally monitor this hotline around the clock, 365 days a year. 

That in-house expertise ensures that clients get the best guidance, no matter when a breach occurs. Since the hotline’s inception, the claims team has fielded well over 1000 tough calls, often at the most inopportune times.  

Here are some of their more interesting cases, as told by hotline operators: 

1. A story fit for the 6 o’clock news. 

The VP of Finance at one software company was just sitting down to Sunday night dinner when she decided to check on some updates her team had been working on the previous week. She opened up her company laptop and went to open some files when her stomach sank.  

The files were encrypted. All of them. She was staring at a message demanding that $40,000 in bitcoin be delivered to an anonymous group of hackers who had taken the system hostage the previous night. Otherwise, her company would never receive a decryption key, and all of their work would be lost.  

She called the cyber hotline for advice … but not before notifying her IT director first. 

“I advised that I would immediately schedule a call with privacy counsel as well as a forensic company who could effectuate the ransom payment in bitcoin,” said the hotline operator on duty that night. 

“That’s when she told me that her IT director had already figured how to make that payment himself — and was currently on his way to meet a bitcoin broker at a Starbucks off the highway with more $40,000 in cash.” 

A little imagination can surely conjure many ways in which this story ends badly.  

“Luckily it all worked out,” the operator said.  

The IT director delivered the payment safely. Forensic investigators were able to pinpoint how the hackers gained entry to the system and recommend security fixes. And the company’s cyber policy was able to reimburse them for related expenses as well as the ransom payment. 

“We were able to salvage the situation,” the operator said. “But I was positive this would be a story on the six o’clock news.”

2. Ensuring a productive New Year at the last hour.  

At exactly 10:49 p.m. on New Year’s Eve, the operator on duty received a ping from the breach hotline.  

“I excused myself from the family party I was attending to check the message. Sure enough, one employee at a law firm was trying to squeeze in some extra billable hours before the end of the year while everyone else was out of the office and discovered that they were the victim of a ransomware attack,” the operator said. 

The attorney was in a panic. To be hit with a cyber attack is bad enough, but for it to happen in the middle of a holiday was the worst-case scenario. No one, he thought, would be available or willing to help him address the issue at the 11th hour.  

“Luckily, I only had a sip of champagne at that point in the evening,” the operator said. “I called the attorney to assess the situation, figure out next steps and get the ball rolling on a response as soon as possible.” 

Within minutes, the operator contacted a privacy attorney that AXA XL frequently works with. Together they were able to assemble an incident response team overnight including forensic investigators and security specialists. Of prime concern was whether any confidential information of the law firm’s clients had been breached.  

“We optimized the downtime on New Year’s Day to sort through various issues, including getting the system back online and assessing the damage,” the operator said.  

Fortunately, the firm was able to restore its data from a backup system and confirm the safety of private client information. By the time the holiday was over, all employees were back to logging those billable hours. 

3. Making a Merry Christmas for one unlucky insured.  

Industry never takes a holiday. On December 24th, 2018, an Italian automotive distributor was still running its assembly line. It had to be prepared to meet the increased demand that often accompanies holiday specials and sales.  

One disgruntled employee, perhaps understanding how critical this time was for the success of the distributor the coming year, chose this night to hack into the company’s system and pull a prank.  

He replaced about 100,000 inventory part descriptions with a cheery “Merry Christmas.” The distributor was forced to halt all operations until they could fix the issue.  

Luckily, AXA XL’s cyber hotline operators never take a holiday either.  

“I had just had my first sip of eggnog when I got the call around 4 p.m.,” that night’s on-duty claim professional said. “I immediately reached out to the insured and we scheduled a call with privacy counsel at the insured’s earliest availability — 6 a.m. on Christmas morning.” 

While other families were opening gifts, the operator and the insured were assembling an incident response and recovery plan as quickly as possible.  

“We learned a few weeks later the issue was a practical joke by an unhappy worker and confirmed that no other data had been corrupted. The insured was able to return to business as usual without any long-term damage,” the operator said.

Expertise Matters as Cyber Risks Evolve 

In each of these scenarios, the hotline operator was able to quarterback a response and help mitigate the damage as much as possible. Calling the hotline also kickstarts the claim process, so insureds can recover losses from their cyber policy as quickly as possible.  

AXA XL’s ransomware policy covers restoration of the corrupted network and/or data, the ransom payment itself, and the business interruption impact. But the hotline is about much more than fast reimbursement.  

“We’re providing a service. It’s not just writing checks.” Gittler said. “Everyone on the claims team is an attorney with years of experience handling specifically cyber and technology claims. The team takes turns manning the hotline to ensure we are always available when clients need us.” 

That dedication and expertise is exactly what companies need when they’re facing perhaps one of scariest incidents in their history. And as new cyber risks continue to emerge, businesses who rely on their carrier’s expertise will be best equipped to withstand new threats.  

Biometric data privacy, for example, is the latest cyber-related risk to emerge that is already costing companies millions. As retinal, fingerprint and facial scans become more commonly used as “passwords” and personal identifiers, companies who collect and guard this data stand a greater chance of violating privacy statutes. Lawsuits alleging illegal collection of biometric data have already topped $50 million.  

“Staying ahead of the cyber curve is tough. Whether it’s managing biometric data, ransomware, or some other type of security breach, there’s no need for companies to try and figure it out on their own,” Gittler said. “We are here to help companies move forward in their time of need.” 

To learn more about AXA XL’s cyber policies and risk management services, visit https://axaxl.com/insurance/insurance-coverage/professional-insurance/cyber-and-technology.  

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with AXA XL. The editorial staff of Risk & Insurance had no role in its preparation.