No One’s Safe from Cyber Threats. Train Your Employees to Defend Your Company Now or Risk Millions

Chubb's 2021 Personal Cyber Risk Survey finds no one is safe from the chance of a cyber attack, from health care providers to businesses to remote work employees.

By: Maura Keller | July 9, 2021

Topics: Cyber

Gone are the days when health care organizations stored valuable patient information on disorganized stacks of floppy disks in dusty back corners of offices.

Today, medical organizations are using data storage systems that deliver universal connectivity in a networked environment that are easily accessed and managed. But with the prolific amount of data being captured, the possibly of security breaches grows exponentially.

The health care industry is one cyber risk area that Chubb evaluated in their 2021 Personal Cyber Risk Survey, which gauged respondents’ attitudes and beliefs toward cyber risks throughout all areas of their lives.

Health Care Privacy Risks

According to Christie Alderman, cyber innovative solutions officer at Chubb, the survey found that people are giving more thought to the risks of sharing medical data — but inconsistently.

The most interesting aspect to this medical data security conundrum? Americans are not nearly as concerned about the security of their medical data and records as you’d think.

While 57% of those surveyed were concerned with having to share their COVID-19 vaccination status, only 24% were concerned with the vulnerability of their medical records in general.

This in spite of the fact that health care related breaches of privacy have increased over three-fold in the past 10 years according to Chubb Cyber Index. Today, more than 1 in 20 U.S. adults have fallen victim to a health care-related privacy breach.

Why are so few Americans concerned? As Alderman explained, media coverage helps to play a key role in increasing awareness about privacy considerations on COVID-19 vaccines, but people are generally unaware of how their medical data can be used and the harm it can cause.

“For example, most people are not aware that individual health data is sold on the black market to identity thieves who use the data for fraudulent purposes, including tax fraud and home equity loan fraud, and obtain medical care under the victim’s name,” Alderman said.

“This crime can ‘pollute’ the victim’s health records and potentially cause physical harm, such as recording an incorrect blood type. Additionally, most people do not take into account the potential for significant legal and financial ramifications of a cyber incident.”

Today’s Business Vulnerabilities

While Chubb’s 2021 Personal Cyber Risk Survey focuses on individual attitudes toward cyber risks, it also gives a view into business vulnerabilities — namely vulnerabilities caused by employees.

According to Alderman, in particular, respondents viewed working from an office as making them more vulnerable to cyber attacks than working from home; however, this is the opposite of reality.

“The same issues making individuals more personally vulnerable to cyber attacks, such as reusing easy-to-guess passwords, are bad habits that employees bring to their employers and are making employers vulnerable to cyber incidents,” Alderman said.

Christie Alderman, Cyber Innovative Solutions Officer, Chubb

From a business perspective, and based on Chubb’s claims experience, The Chubb Cyber IndexSM highlights significant increases in cyber attacks in specific industries, such as education, manufacturing, professional services and public entities.

“While a company’s revenue may make them more prone to a cyber attack, our data shows that businesses under $25M in revenue have seen the most dramatic increase in cyber incidents over the past several years, with a more than 16-fold frequency of cyber incidents,” Alderman said.

“Put simply, all sizes of businesses are susceptible and experiencing an increase in cyber attacks. Even local ‘mom-and-pop’ shops are at risk and should be aware of cyber crimes and the potential impact to their operations.”

The Chubb report also found that younger generations have more faith in the preparedness of small businesses to protect consumer information in the case of a cyber attack: 60% of ages 18-34; 49% of those age 35-54; 12% of those 55 and up.

Cyber Risk in a Remote Work Environment

So how has the recent pandemic impacted individuals’ views of being cyber safe when working remotely?

Chubb’s 2021 Personal Cyber Risk Survey shows that Americans understand their increase in online activity, spurred on by the pandemic, has left them more vulnerable to cyber attacks.

As Alderman pointed out, while one-third of respondents are making some improvements in online safety, for example, more regularly changing passwords, less sharing passwords with others, and using a VPN, that still leaves two-thirds of people who are not, meaning people are still not often taking the right precautions.

“The gap in individual cyber education has and will continue to impact businesses as their employees work from home or have hybrid working arrangements,” Alderman said.

“The spate of cyber attacks showing up daily in the media is in a large part because bad actors are leveraging companies’ vulnerabilities. As a result, employers will need to continue to not only focus on the security of their IT configurations but also on employee education — teaching them about the importance of password hygiene and how to spot phishing emails, for example.”

The Role of Insurance in Cyber Risks

Both businesses and individuals are facing the increased prospect of cyber attacks, and insurance can help fill gaps should a person experience a breach.

Cyber insurance provides a financial solution while helping to navigate the victims through the complexities of resolving a cyber attack with much-needed services. What’s more, Alderman said, from a business perspective, cyber insurance is an essential part of business continuity planning and can mean the difference in business-as-usual or a catastrophic financial loss.

“From an individual perspective, cyber insurance needs to be as much a part of the insurance conversation as home and auto insurance,” Alderman said. “Chubb’s 2021 Personal Cyber Risk Survey shows that individuals rely on trusted sources like an insurance agent to direct them to the policy they need.”

The line between business cyber risk and personal cyber risk has never been blurrier. That’s why companies and individuals cannot afford to ignore it.

“And while it’s true that many companies have already addressed cyber exposures, cyber attacks are continuing to evolve at a rapid pace,” Alderman said.

“Everyone is at risk, making it imperative for more education in the marketplace for both consumers and businesses.” &

Based in Minneapolis, Minnesota, Maura Keller is a writer, editor and published book author with more than 20 years of experience. She has written about business, design, marketing, health care, and a wealth of other topics for dozens of regional and national publications. She can be reached at [email protected].

Vermont’s Future Is Golden

Challenging market conditions are driving insureds to captives. Vermont offers a reliable domicile.

By: State of Vermont | November 21, 2024

Hard markets in commercial insurance lines have been a problem for years now. Many lines don’t show signs of softening, though some, like cyber, have ebbed over the past few years.

High claims volumes and costs have caused carriers to tighten terms and conditions, introduce new exclusions and increase premiums. A variety of different risks are included in this market tightening, and it’s affecting both public and private companies.

As Sandy Bigglestone, deputy commissioner for the State of Vermont’s captive insurance division, explained, schools, churches and other nonprofits are contending carriers are “excluding sexual abuse and molestation from coverage for a lot of these types of entities. These organizations understand the risk and the public needs to have confidence the organizations are addressing the risks, so they must have the coverage.”

Though many commercial lines are affected, property has perhaps been hit the hardest. Increased claims, inaccurate property valuations and other challenges have caused insurers to tighten their books in recent years. 2024’s spate of hurricanes will likely make matters worse.

“There continues to be challenges in the commercial market,” Bigglestone said. “Some companies are coming to us with risks that they say they’ve been self-insuring on their balance sheet, and why not transfer that to a captive to receive greater benefits?”

Consistency and Stability

Sandy Bigglestone, Deputy Commissioner for the State of Vermont’s Captive Insurance Division

With the commercial insurance market so unstable, companies are turning to captives to house their exposures. Vermont, a long-time domicile, is getting increased attention because of their strong reputation and their leadership as the top domicile worldwide.

“All stakeholders enjoy the stable political and regulatory environment Vermont has to offer to operate in,” Bigglestone said.

Of course, a lot of consideration goes into deciding whether or not a captive is the right choice for a particular company. Businesses need to assess their exposures and their books to make sure they can adequately operate a captive.

There are significant advantages, however. “For low frequency, high severity risks, captives can access the reinsurance markets directly, so it’s very attractive for businesses to put a captive in place,” Bigglestone said.

And carriers are more accepting of captives as part of a broader insurance program.

“Captives are changing the relationship businesses have with commercial carriers,” Bigglestone said. “Commercial carriers are wanting to see companies with skin in the game; therefore, the relationships have evolved to be less transactional and more strategic.”

Balancing Bureaucracy

With 76 global domiciles, companies have a lot of options when it comes to selecting a captive partner. “Captive insurance domiciles compete globally for the business,” Bigglestone said. “If you were to put all 7,000-plus captive insurance companies around the world, all in New York, it wouldn’t have the same economic impact as 700 captives in Vermont does. The captive insurance industry is very important to our state and we will continue to support it in any way we can.”

Businesses should look for domiciles that balance a need for quality regulations with a process that isn’t overly bureaucratic and is seamless for business owners to navigate.

“Companies are attracted to an environment with quality regulatory standards and a stable regulatory environment,” Bigglestone said. “Vermont sets the regulatory standard in terms of financial analysis and examinations.”

In addition to quality regulations, firms will want to seek out a domicile that is agile enough to license captive insurance companies that fit their unique needs. It is important that a domicile have firm but fair regulation and the experience to consider new ideas and implement them. Companies must consider a variety of factors when choosing a domicile and not everyone will be the right fit for every company.

“You have to consider the captive owner and the industry sector that that owner operates in, as well as the insurance risks that are going into the captive program,” Bigglestone said. “Captive laws and regulations have to have a reasonable degree of flexibility to accommodate all the varying needs of owners and then impose rules based on the merits of each captive program.”

She added that creativity is a critical part of the process: “The ability to vet concepts and ideas with trusted individuals is key to having quality standards,” Bigglestone said. “And it can make captives appealing to insureds who are tired of commercial carriers not meeting the needs of the business, and who desire more control over their insurance programs.”

“When you think about the commercial marketplace, commercial insurers are supposed to operate in each jurisdiction in a competitive manner. Commercial carriers often look the same. They sell auto coverage to anyone with a driver’s license. The rules and regulations imposed upon commercial insurance companies are designed to be more formulaic for that reason,” Bigglestone said.

“Uniform regulatory standards apply to commercial carriers for the protection of the policyholders. These are standards all insurance regulators focus on, and standards captive insurance regulators need to understand, but with a specialized focus.”

A Quality Domicile Built for the Future

A combination of experience, regulatory standards and talent make Vermont a top domicile for companies looking to form a captive. The longevity of licensing captive insurance companies for over forty years is a testament to the quality work they’ve provided in the past and will continue to provide for many years to come.

Vermont’s reputation has helped the state attract and retain top captive talent, ensuring the businesses it serves are in good hands. The state has 32 employees dedicated to captives, and their average employee retention is 15 years. The Vermont Captive Insurance Association, the largest captive insurance trade organization, also helps companies connect with professional services needed to make their captive successful.

“There’s a whole host of service providers with proven expertise right here in Vermont,” Bigglestone said.

Taken together, Vermont’s resources, expertise and talent make it a prime domicile. They’ve been on a growth trajectory over the last few years and that’s unlikely to change anytime soon. Companies can trust their captive will be in good hands when they choose Vermont.

“Vermont has always competed on quality,” Bigglestone said. “We do have a mission and that hasn’t changed in over 40 years. It’s to maintain a system, or domicile that attracts quality business to Vermont, to promote our reputation in the industry, and to uphold a regulatory framework to protect the solvency of the companies that choose to place their business here.”

To learn more, visit: www.vermontcaptive.com

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with State of Vermont. The editorial staff of Risk & Insurance had no role in its preparation.

The State of Vermont, known as the “Gold Standard” of captive domiciles, is the leading onshore captive insurance domicile, with over 1,200 licensed captive insurance companies, including 48 of the Fortune 100 and 18 of the companies that make up the Dow 30.