The Rapid Evolution of Cyber Threats
It seems like only yesterday that the biggest cyber threat was the theft of credit card information. And in fact, it was only a few years ago when that was the case.
But recent events show just how quickly the risk has evolved. The ‘WannaCry’ ransomware attack that struck hundreds of companies around the globe in May, causing an estimated $4 billion in total losses, is a testament to how the risk has grown.
Technology forms the backbone of business for companies of every shape and size. The amount of information generated and stored on the Internet is growing exponentially, doubling every few days. And businesses are drawn closer together through reliance on interconnected systems.
As a result, there are more access points than ever for cyber criminals to exploit. System failure can impact multiple parties at a time, and companies of every size and sector are at risk.
As cyber exposures evolve, insurers are doing their best to adapt and keep up.
“We’ve come a long way from the early days when the biggest concern around cyber risk was the protection of credit card information,” said Tom Iorio, Senior Vice President of Management Liability and Specialty, Nationwide.
The Latest Threats: Phishing and Ransomware
Cyber risk initially was a question of network security and data privacy, and it was focused on retailers and financial institutions.
“But now, credit card data has flooded the market and become less valuable for cyber thieves. It’s not worth their time to steal,” Iorio said.
As technology grows more sophisticated, so do hackers. Cyber attackers have turned to new, more lucrative tactics to exploit and profit from companies’ network vulnerabilities.
Social engineering scams and cyber extortion in the form of ransomware have emerged as the second wave of cyber threats.
Social engineering or “phishing” schemes don’t necessarily involve a breach of a company network or any inside access to sensitive data. Rather, phony emails purported to be sent by a senior manager, or others externally, are directed to employees, typically asking them to wire a sum of money into an external account. They can be very believable imitations of the real deal.
“I myself have received three of these “spear phishing” emails,” Iorio said. “They were supposedly sent by my former boss, asking me to pay a claim and deposit money into an external account. But there were a few problems that stuck out. For one thing, I don’t have the capability to wire money out to pay a claim, and my boss would never ask me to do so. There were also technical flaws. The email was misspelled, for example.”
When employees do fall for these tricks, however, companies stand to lose thousands of dollars. An incident like this is more likely to be covered in a crime policy than a cyber policy, since phishing is a form of computer fraud for funds transfer rather than an outright hack of proprietary information.
Cyber extortion in the form of ransomware, on the other hand, involves hijacking a company’s internal system to hold its data hostage, rendering it inaccessible and unusable until a ransom is paid. And it’s a more difficult risk to insure.
“For the sake of protecting their reputations, companies typically like to keep these incidents quiet, resolving them quickly without attracting attention of the press,” Iorio said. “Unlike theft of personally identifiable information, there is no regulatory requirement to report theft by ransomware. There could be many incidents that nobody hears about.”
“Without a solid understanding of the loss history, it’s harder to understand the risk and to write appropriate coverage. But it seems logical that someday soon, cyber and crime policies will be blended to respond to these incidents.”
When cyber attackers look to steal dollars, not just data from their victims, potential targets expand to industries beyond finance and retail. Hospitals, universities and government bodies are some common targets for cyber extortionists.
“These organizations may not have the dollars to devote to hack-proofing their systems. Many hospitals, for example, are nonprofit. They prioritize the services they provide,” Iorio said. Apart from the losses incurred from paying a ransom or fulfilling a fraudulent wire request, these institutions also have to consider the risk of downtime.
Risks on the Horizon
A ransomware attack — or any system failure that halts operations, malicious or otherwise — can incur large business interruption losses. Retailers lose sales if their websites or POS systems go down. Manufacturers lose productivity and fall behind on deadlines if computer-operated machinery fails. For some industries, network downtime can have residual effects for days.
“Airlines offer a good example. If a major airline is hit with a denial-of-service attack, or experiences some other kind of network failure, it may take several days to get planes back to their regular schedule and re-allocate passengers whose flights were cancelled,” Iorio said. “A downtime of just 20 minutes could still cost the airline millions of dollars. That loss would be a direct result of a cyber event.”
Most cyber policies include coverage for business interruption on a contingent basis. Like first and third party liability for network security, the coverage has become fairly standard.
But as cyber exposures continue to evolve, the question of liability will be up for debate.
Property damage and bodily injury resulting from a cyber event, for example, is on the horizon, especially as the Internet of Things grows.
“IoT comes down to cloud exposure. With so much interconnectivity, and so many access points, the exposure is huge. But there are still questions around where the liability will fall,” Iorio said.
He pointed to autonomous cars. If a car gets hacked and is driven off the road, who is liable? The manufacturer? The software creator? The driver’s auto insurer?
Staying Steady through Changes
“We’re experiencing not just an evolution of cyber risk, but an evolution of cyber coverage. Cyber risk seems to take on new forms all the time, and nobody is certain of what the impact could be,” he said. “But we do know that cyber touches everything, and we as an industry are trying to connect the dots and cover the gaps between other coverages that are related.”
Insurers that are focused on building quality, lasting relationships with clients will be best positioned to weather the changes ahead. As cyber risk intersects with crime, property, general liability and other policies, companies will benefit most from partnering with a carrier that wants to work with them across their whole portfolio.
That way, when a loss occurs, carriers and their clients can work together to decipher what is or is not considered a cyber event and where the coverages lie. That relationship also makes it easier to fine tune the program to meet a company’s specific exposures going forward.
“At Nationwide, we’re very client focused. “We work with the top brokers in the nation and choose our clients wisely and create personal as well as a business relationship,” Iorio said. “When we know we have a quality client, we want to be there for them across their entire portfolio: directors and officers, professional liability, employment practices, crime and cyber.”
“The market may go up and down, but we stay consistent with our clients, and the same is true for cyber. We won’t be in it one day, and out the next.”
To learn more, visit https://www.nationwide.com/business-insurance.jsp.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Nationwide. The editorial staff of Risk & Insurance had no role in its preparation.