Introduction
Greetings readers, my name is Sarah and I work as a cyber risk analyst in the insurance industry. In this blog post, I wanted to take some time to discuss an increasingly important issue that all property and casualty insurers are facing – cybersecurity risks.
While many tend to think of cyber threats primarily in terms of data breaches and hackers stealing customer information, the reality is that cyber risks extend far beyond just that. Today’s advanced technologies and digital connectivity mean that virtually every component and process within the insurance industry is potentially exposed to some form of cyber risk. From underwriting and claims processing, to customer communication and policy administration – cyberattacks can disrupt all areas of business operations.
What’s more, the risks are constantly evolving as new threats emerge almost daily. Ransomware, business email compromises, distributed denial of service attacks, and malware infections are just a few examples of the cyber dangers insurers must defend against. The financial and reputational costs of a successful cyber incident can be immense. With sensitive customer data on file and reliance on technology for day-to-day functioning, insurance companies have a huge target on their backs.
In this post, I aim to comprehensively discuss the main cybersecurity risks insurers face from both a first and third-party perspective. I’ll analyze how different types of cyberattacks can impact various lines of business, as well as explain emerging cyber perils and their broader implications for the industry. My goal is to help raise awareness of this critical issue and spark further discussion around strengthening cyber defenses. Insurance exists to transfer risk – but companies must first understand the risks to effectively underwrite and price them. I hope readers find this overview informative and thought-provoking as cybersecurity becomes ever more central to property and casualty insurance.
Let’s get started!
Property and Casualty Insurance: First Party Cyber Risks to Insurers
When most people think of cyber risk and insurance, their minds likely jump straight to data breaches. But from the perspective of an insurer itself, the largest cyber exposures actually stem from potential first party damages – costs resulting directly from a cyber event affecting the company’s own operations. Here are some of the key first party risks property and casualty insurers face on the cyber front:
Property and Casualty Insurance: Business Interruption
One of the biggest fears for any organization is suffering an extended outage or disruption to critical systems and infrastructure. For insurance carriers that rely heavily on technology to underwrite policies, process claims, manage accounts and communicate with customers – a significant system failure could paralyze operations. A ransomware infection encrypting important files, a hacker group launching a DDoS attack, or even a simple technical glitch – any of these could bring business to a grinding halt.
Insurers would incur substantial costs covering employees’ salaries while they’re unable to work, tech support expenses to restore functionality, loss of new business, and damage to reputation. The longer systems are down, the higher these losses accumulate. While most insurers purchase cyber policies with business interruption coverage, the real damage is much harder to quantify and could threaten solvency in an extreme event. This is why cyber resilience is so crucial.
Property and Casualty Insurance: Data Loss
Another costly first party risk from cyberattacks is permanent data loss due to malware, system crashes or accidental deletion/corruption. For insurance data specifically, this could include confidential underwriting files, claims records, policy documents, customer account details and more. Recreating information from scratch requires immense time and manpower. Meanwhile, delayed claims processing harms customer satisfaction and loyalty. Data recovery services help, but are no substitute for proactive security and backups. Strong encryption also deters hackers from profiting off purloined customer files.
Extortion Payments
Ransomware infections forcing ransom payments to restore access are skyrocketing among all organizations. Insurance systems storing sensitive personal details present a highly valuable target for ransomware gangs. Even if the attacker is unable to infiltrate core underwriting systems, they may encrypt desktop files, backups or domain controllers – meaning the company has no choice but to pay up or risk extended outages. While some insurers cover ransom payments through specific endorsements, cooperation with law enforcement is critical to prevent repeated attacks.
IP Theft & Fraud
Beyond direct damages, cybercriminals also threaten insurers through intellectual property (IP) theft and ongoing fraud risks. Underwriting algorithms, new product designs, pricing models – all represent valuable IP that competitors could exploit if stolen through cyber-espionage. Additionally, stolen customer records enable fraudulent policies to be opened, false claims submitted and accounts compromised – driving up costs. Multi-factor authentication, digital certificates and other identification techniques help mitigate these secondary perils.
Third Party Cyber Risks to Insurers
Of course, insurers also bear significant exposure through third party cyber risks affecting their policyholders. This includes both first party and third party liability damages that insureds incur due to cyber incidents – which their property and casualty policies may be responsible for covering. Some of the most pressing third party cyber exposures insurers currently face include:
Data Breaches
As the amount of personal data collected and shared electronically grows exponentially, data breaches have become an endemic peril for practically any organization with digital operations or an online presence. For insurers, this means increased costs through liability claims and privacy litigation stemming from policyholders suffering breaches. One hacking campaign targeting a major retailer could trigger thousands of third party breach claims across many carriers’ books of business.
Property Damage
The physical world is also increasingly vulnerable to cyber-attacks. Examples in recent years include hackers briefly disrupting the operations of a German steel mill by targeting its industrial control systems, as well as the infamous 2015 Ukraine power outage believed caused by a cyber-intrusion. While rare currently, the potential liability from property damage due to cyber-physical attacks is a risk insurers are beginning to factor in. For example, could a breach of building management systems trigger property policies?
Business Interruption
Just as insurers themselves face BI exposure, their customers are equally at risk of prolonged outages should cyber-criminals paralyze core IT systems or infrastructure. Revenue loss from such an incident could amount to millions depending on the policyholder. Property policies may need to be adjusted to account for new classes of insurable cyber business interruption events. However, without standard definitions and actuarial data, initial underwriting involves significant uncertainty.
Professional Liability
Errors and omissions policies sold to industries like accounting, law firms and consultancies increasingly include cybersecurity responsibilities. Breaches stemming from service providers failing to secure client data open the door for costly professional liability claims. As firms take on heightened cybersecurity obligations in contracts, the cascading risks transfer to their professional lines insurers as well. Clear policy language around emerging cyber standards is key.
Property and Casualty Insurance:Emerging Cyber Risks for Insurers
While these represent some of the prime cyber perils on insurers’ radar today – the threat landscape evolves endlessly. Here are a few notable emerging risks on the horizon that property and casualty carriers must prepare for:
Internet of Things (IoT) Liability
As more “smart” devices populate our homes, cities and critical infrastructure – new vectors for hackers to attack open up through unsecured IoT networks. Imagine liability stemming from a breach enabling intrusion of an entire building’s security system or hack of networked medical devices in a hospital. Insurance underwriters are exploring how to handle IoT cyber risks that span first and third party exposures across multiple traditional policy types.
Supply Chain Attacks
By targeting software updates and cloud infrastructure of managed service providers, cyber-criminals can more easily infiltrate the networked ecosystems of partner companies and customers. WannaCry and recent SolarWinds attacks showcase this risk. Insurers must strengthen supply chain security diligence while also limiting spill-over liability when vendors are breached. Building strategic vendor alliances helps.
Ransomware as a Service
Easier access to ransomware kits and affiliates means the global community of hackers sharing strains is booming. While most groups still target consumers, the financial incentive exists for “RaaS” to also target larger, high-value corporations. This multiplies potential ransom demands insurers may face through coverage. Strict “no pay” policies could backfire by encouraging more attacks however.
Deepfakes & Social Engineering
Synthetic media and improved impersonation tactics allow bad actors to increasingly bypass traditional security perimeters through human fallibility. Advanced deepfake audio could automate vishing phone scams targeting insurance customer service. Social engineering also enables scope for fraudulent claims and account takeovers. Vigilance and employee training is paramount.
Property and Casualty Insurance: Cloud Migration Risks
The allure of cloud offerings sees many firms storing valuable digital assets off-premise. Yet migrating complex legacy systems while retaining adequate security and access controls requires immense diligence. Cloud configuration errors and third party compromises could inadvertently expose sensitive underwriting data. Insurers must ensure appropriate cloud cybersecurity is addressed in their own operations and those of clients migrating assets.
Managing Cyber Risk Through Prevention & Preparedness
Faced with such a complex and dynamic threat landscape, how can insurers manage ever-mounting cyber risks in a sustainable manner? Here are a few strategic steps all carriers should prioritize:
Strengthen Governance & Oversight
Board-level oversight of the cyber risk management program is crucial to establish clear policies and accountabilities throughout the company. Designate a Chief Information Security Officer and consider forming an executive cyber risk committee. Periodic risk assessments identifying worst exposures aid preparedness.
