Cyber Decoder: December 2020 - How Ransomware Will Affect the Cost of Cyber Insurance

The complexity, frequency, and severity of ransomware incidents have risen significantly in the last 18 months. The total cost of ransomware attacks is expected to be around US$20 billion by 2021. This constitutes a year-over-year increase of 97% since 2015, when the total cost was around US$345 million.

In 2019, the UK witnessed the second-highest number of ransomware events globally at a cost of £365 million.

The threat of ransomware attacks has never been more prevalent, due to the sharp increase in remote working caused by the COVID-19 pandemic. The third quarter of 2020 saw the daily average of ransomware cases rise by 50% globally, compared with the first six months of the year.

Rising insurance costs

In some cases, ransomware accounted for 40%–50% of cyber insurance claims in the first half of 2020. Additionally, the severity of recent ransomware claims has been more than double that of other cyber claims, with some of them settled for well over US$2 million.

More targeted attacks on key data have created potential liability issues, which have brought regulatory and privacy litigation into the equation.

Insurers that offer cyber protection are therefore under increased pressure. In the latter part of 2019 and first quarter of 2020, insurers often quoted low single-digit percentage increases; but it is now common for insurers to quote double-digit increases.

Ransomware incidents pose an even bigger challenge, when hackers steal the data before encrypting the network and restricting access. In case the data is leaked, the cost of dealing with the breach could run into millions of dollars, while also negatively impacting the firm’s reputation and exposing them to regulatory investigations.

Managing the rising cost of insurance

Firms renewing their cyber insurance cover in 2021 should expect a significant rise in premiums. Proactive early engagement is key to preparing for upcoming renewals, while also assessing the ongoing adequacy of the current insurance programme.

Robust cybersecurity protocols are critical for firms to safeguard themselves. In particular, the following steps can help:

1. Focus on employee training – email phishing is the most common form of ransomware and can be managed with adequate training and diligent scanning infrastructure.
2. Conduct regular penetration tests to identify system vulnerabilities.
3. Back-up data – put in place regular data back-up protocols.

With remote working an integral part of how companies operate in the current pandemic, hackers will have more opportunities to target network vulnerabilities. Consequently, ransomware incidents are very unlikely to slow down in 2021. This will likely affect the cost of cyber insurance, as insurers will look to readjust the price in line with the rising exposure.