Why Mainstream Media Coverage of Cyber Insurance Is Driving Underwriters Crazy

It's proving just as challenging for reporters to cover the nuances of cyber insurance as it is for carriers to underwrite it.
By: | April 25, 2019

There’s a trend in recent mainstream media’s reporting on commercial insurance coverage disputes that is causing considerable frustration in the underwriting and brokering community.

In referring to the Mondelez/Zurich coverage dispute over losses from the NotPetya attack, for example, reporters keep referring to Mondelez’s coverage as “cyber insurance,” when it is more accurately described as a property policy that had some cyber coverage bolted onto it.


After a well-meaning insurance professional posted the mainstream media’s latest attempt to cover cyber insurance on LinkedIn, the messaging and networking platform lit up with comments from frustrated cyber insurance specialists who believe many media outlets are conflating terms and misrepresenting their products.

“Finally, as more (and more damaging) cyber attacks appear to be directed by national governments or their proxies, what is the point of having cyber insurance if such attacks are excluded from coverage? This is the question that many clients will ask themselves if the insurers win these two cases. In other words, a tactical victory for the insurers could spawn a strategic defeat,” said one Slate article.

Cyber underwriters are begging reporters to use correct terms to describe their product, but the reporters aren’t listening. The policy in question in the Mondelez case is a property policy with a bolted-on cyber element; it is not a stand-alone cyber policy, which carries a much higher premium and is more robust.

“I literally wrote the article’s author asking if I could educate him on what a cyber insurance policy is and explaining the importance of not conflating that product with traditional P&C products that may have some incidental coverage. No response yet. I think the media is in love with the byline that cyber insurance doesn’t work, accurate or not. This kind of coverage drives me nuts,” wrote one underwriter in a LinkedIn post.

“To me, these cases should bring to the forefront the difference between cyber liability insurance and ‘cyber as a peril’ on other lines of coverage (property, GL, auto, comp, etc.)” said another insurance professional.

“I think the cyber liability market is prepared for these attacks and is more than willing to respond (many carriers paid out numerous NotPetya related claims), conversely I think the other property and casualty lines are generally not fully prepared for fielding claims and paying losses for cyber as a peril,” he continued.

Graeme Newman, chief innovation officer for CFC Underwriting, gave us some of his time on May 10 and provided some valuable perspective.

“We paid out multiple NotPetya claims or at least claims attributed to the malware that has broadly been described as NotPetya,” Newman said.

“We paid one limit loss on a policy, not as significant as the Mondelez policy, but it was a reasonably significant limit all the same; multiple millions. Just like we do every single day.”

“I think the NotPetya piece is slightly overplayed because it is just yet another form of malware,” Newman said.

“We know full well that malware is spread by nation state actors, terrorist cells and organized gangs.  If you look at our claims profile, we receive roughly four to five cyber claims a day.  Out of those claims at least 30 percent of them relate to some form of malware or ransomware. And on all of those claims there will be a significant percentage that relate to rogue actors, specifically nation/state rogue actors,” he said.

In our March coverage of cyber risks and the cyber insurance market, we quoted Aon’s Stephanie Snyder on this confusion, which she referred to as the “bane of her existence.”

“What is interesting about Mondelez/Zurich is that it is a property policy. The issue at hand is a war exclusion,” said Snyder. “We have not yet seen coverage denials under cyber insurance policies related to war exclusions. We have seen over time certain denials, but those were due to basic insurance issues” either involving misinformation contained within the application or late reporting issues, she added.

Read More: Cyber Insurance Does Pay Claims. You Can’t Afford Not to Be Covered

“Even going back to 2018 there has been this ongoing challenge of misrepresentations about what cyber coverage does and does not do,” Snyder told Risk & Insurance® in a more recent interview.

And still the drumbeat of misinformation goes on.

Continued Mis-Coverage

Yet another piece, this time from the New York Times, similarly made a muddle of the difference between a property policy with a bolted-on cyber element and a stand-alone cyber insurance policy, which is generally a much more robust coverage.

Here is what one commentator had to say after reading that piece. He thinks, by the way, that Zurich will end up paying on the policy: “Zurich provides cyber insurance policies and could have recommended that Mondelez buy one of them, which would have covered this type of NotPetya event,” he said.

“Mondelez decided to rely upon an addition to their property policy without really making it fully comprehensive. My guess is that Mondelez knew of the existence of cyber insurance policies but did not want to pay the additional premium. Zurich’s property underwriters wanted to keep a client happy and added cyber wording to their property policy without broadly understanding the consequences,” he added.

Stephanie Snyder, cyber executive, Aon

“Now that an unexpected claim has occurred, Zurich property underwriters have seized on a war exclusion. I suspect that Mondelez may actually get the benefit of the insurance, because the difficulties in proving that Russia is behind the attack are significant. If that is so, the premise behind the article that they did not get benefit of the insurance bargain will turn out not to be true,” he said.

“However, any insurance policy worth its premium should pay without the need for litigation and so insurers should be clear when they are extending their non-cyber insurance policies to cover cyber risks,” he said.

“One of the problems is that for a long time cyber insurance was called cyber liability insurance and people see it as another form of liability cover,” said CFC’s Newman.

“The majority of claims that we deal with are actually first-party property coverages; and I think this is where some of the confusion comes from. I think the more that we think of cyber insurance as akin to a property policy, the easier it is to understand. Therefore, if clients are thinking of it as a liability policy the more mistakes they’ll make; the more they’ll miss,” he said.

“I think there is a different way to view cyber insurance and that is as an asset-based policy. I see it very simply. The property market looks at a physical tangible asset and that is the asset base that the market is designed to insure. I think we should see the cyber insurance market as the corollary of that,” Newman said.

“If you think of it as an asset-based policy that is protecting the intangibles, the data, there is a much easier way to view it. It’s not a peril-based policy that is triggered by some kind of event, it’s an asset-based policy. If you think of it like that, life becomes much, much clearer.”

Newman said carriers and others might be approaching cyber risk in the wrong way, in terms of how the exposure matches the cover.

“A lot of people start with the control environment. The security industry tends to look at the control environment,” he said.

“They look at the maturity of the control system, do they have good controls or bad controls, and that equates to a good risk or a bad risk. We might find that a business with a lot of exposure has a lot of controls. Well, does that make them a good risk or a bad risk? We try to see if the controls they have in place are equal to or greater than the exposure they have.”

“Cyber insurance is not necessarily an end-all-be-all for all things digital,” Aon’s Snyder said.

“It is really incumbent on risk managers to understand what their risk profile is and insure it appropriately. If they are concerned about cyber risk, a cyber insurance policy is the most robust type of coverage available to address cyber risk exposures,” she said.

“We are seeing a ton of interest in the business interruption components of coverage.”

The post commentator, who happens to work in the insurance industry, added, “Sophisticated companies like Mondelez might want to be wary of the bolt-on solution when a more expensive dedicated solution is available.”

As it relates to insurance in general, whether it be a homeowners’ policy, an auto policy or a property policy, the media’s take tends to be, ‘Insurance didn’t pay on the claim, therefore insurance companies are evil.’ But the truth is more nuanced than that.

The Takeaway

The issue here is perhaps one of perception, which also showcases the difficulties in providing coverage for a rapidly expanding risk capable of generating big losses.


As a provider of capital to cover losses, insurance carriers are in the unenviable position of seeing their learning curve, and the learning curve of their insureds as it relates to cyber insurance, playing out in the court of public opinion.

Tighter terms and a better understanding of how insurance can respond to cyber events will result. Carriers just need to manage a public relations challenge in the interim.

As to the take up of the stand-alone product, Snyder estimates that 30% to 40% of organizations do purchase a stand-alone cyber insurance policy.

“The remainder do not, they are still relying on these more traditional property/casualty policies, which may be silent relative to cyber risks, meaning that there is no affirmative coverage grant — or exclusion — relative to cyber,” she said.

Graeme Newman
Chief Innovation Officer
CFC Underwriting

“Bolt-on coverage doesn’t necessarily get you that affirmative coverage guarantee if there is no other clarifying policy language,” Snyder said. “When you look at cyber policies, cyber policies have indemnified for the NotPetya loss.”

Newman said the cyber insurance market at his firm is thriving.

“We happen to be in the hottest insurance market that there is right now,” Newman said.

“The cyber insurance market continues to grow and outpace any other line of insurance that you can think of. Our cyber insurance book last year grew over 63%. That is incredible growth. We are one of the largest writers in the world and seeing more and more demand,” he said.  

That said, Newman still sees an incredible imbalance in how risk transfer is being handled in our current economy.

“Eighty %-plus of the world’s assets are intangible assets and yet 90% of the world’s insurance spend is on tangible assets. And that cannot be right,” Newman said.

“We have all collectively lived through the most significant events in economic history.  The revolution that has played out in the last 20 years has been the most fundamentally emphatic impact on the economy in the world’s history and yet the insurance industry hasn’t changed that much.  The cyber insurance market is a relatively new market which is designed to address those changes.”

Overall, based on US sales, Fitch Ratings estimated that standalone cyber insurance premiums grew 12% in 2018. &

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.


Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.


As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.


Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &


Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]