What Should I Do If My Company Gets Hit With a Ransomware Demand?

By: Jeremy Gittler | February 28, 2019

Jeremy Gittler is the Practice Leader and Head of Cyber Americas at AXA XL. He and his team coordinate and implement data breach response and crisis management services for AXA XL insureds that have suffered a cyber-attack. Jeremy and his team also evaluate coverage and draft detailed analyses pursuant to cyber, technology, media, and miscellaneous professional liability policies. He advises senior management, underwriters, brokers and insureds on coverage, litigation / dispute resolution strategies, and the business impact of lawsuits. Jeremy joined AXA XL in 2012 after working six years in the Cyber / Technology / Media Liability claims group at AIG, where he rose to the position of Senior Complex Claim Director. He can be reached at [email protected].

Your company has just been the victim of a network security breach. Cyber criminals have locked you out of your company’s system and are now demanding a ransom to allow you to continue with your business. Do you pay?

It’s a question far too many companies are facing each and every day. Ransomware attacks are forever increasing, as are the dollar amounts hackers are demanding. Cybersecurity Ventures statistics predict that the global annual total of ransomware attacks will top $11.5 billion in 2019, up from a 2018 estimate of $8 billion.

Moreover, the targets of these attacks: every company. A ransomware attack is the one crime that can strike at any company of any size or from any industry. The most vulnerable companies, however, are those that are smaller entities — businesses that typically don’t have the large budgets to combat cyber crime or the IT departments to monitor cyber security measures regularly.

Plus, many businesses do not have the financial means by which they can pay a ransom if it’s large enough. In some instances, cyber criminals demand lower ransoms — hundreds of dollars instead of tens of thousands — and businesses are more inclined to simply pay the ransom and hope they can get back up and running. But now, ransoms are increasing exponentially — hundreds of thousands of dollars is more and more common.

Should Your Company Pay the Ransom?

That depends. Typically, when a ransom attack occurs, companies that have network system backups may not need to pay. If the threat stems from your company being unable to conduct business because you can’t access your files, paying a ransom makes little sense since your company’s files are still accessible through the backup system.

However, many ransomware attackers will lock both the main systems and the backup systems.

In that case, ransom may be the only option. Yet your company should not go it alone. Victims can negotiate both on ransom amounts and time constraints, such as when an office is closed or when the demand occurs on a holiday.

It’s Not Just Ransom

Whether or not your company pays a ransom, regaining control of your company’s system is not the full extent of the attack. Unless you know your systems are no longer infected, you can’t be certain the attackers won’t return in the future demanding more ransom.

Also, a compromise of your systems equals a compromise of your data. Information on employees, customers, vendors, along with financial records, could have been exposed or worse, stolen. Paying a ransom is not the end in many cases.

For example, a client company, a municipality, received a ransom demand when thieves locked their systems. The ransom demand was for $300. The municipality paid the demand, regained control of their systems and assumed all was well. Problem solved.

Except the problem wasn’t solved. In this case, the client’s systems were still infected. A forensics investigation determined that there were many instances of data compromise that impacted most of the residents in the community. The municipality was then required to contact those people who were affected by the breach and inform them of the event.

Even if your company is able to pay the ransom and get back up and running, you still have an obligation to ensure the affected parties are notified in a timely manner and that systems are actually secure and data is no longer vulnerable.

Responding to a Ransom Demand

So when a ransom demand is made, the first call should be to your insurance carrier. Have a conversation to determine the level of risk your company faces and gain a complete understanding of your insurance coverage. A top insurance carrier will be able to help you navigate this extremely stressful situation in a professional and cost-effective manner, beginning with putting you in contact with a capable attorney to understand legal ramifications, your obligations and next steps.

Your attorney will contract a forensics firm to complete a thorough investigation of your systems. They will determine the extent of the compromise, what data was exposed, and whether an encryption key promised by the attackers will work. In the event you do have to pay a ransom, forensics firms often provide bitcoin payment capabilities.

Dealing with ransom demands alone is not an option. Few companies have the mechanisms in place or the experience to handle negotiating with attackers, make bitcoin payments or even how to communicate with the thieves. It is always advised that risk management bring in ransomware experts and legal counsel, no matter how small the ransom may be.

Preventing Future Attacks

Before a ransom attack, there is much that risk managers can do. A must-have item: cyber insurance. Cyber insurance products offer two benefits: monetary relief and a team of crisis response experts. The real value in a ransomware policy is in the services provided. Navigating the situation effectively while reducing the damage takes expertise.

Also, risk managers should work with IT to build a strong overall prevention solution that includes educating employees on phishing scams and other social engineering ploys.

Risk management can serve as the catalyst for creating a company-wide focus on ransomware prevention. By working with everyone along the chain of command, risk managers can involve every employee in ensuring that the potential for ransomware attacks is reduced and that a clear response plan is in place.

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

By: Risk & Insurance | April 3, 2024

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.