The growing threat—and opportunity—of insuring for cyber crime

In May 2021, a cyberware attack purportedly originating out of eastern Europe shut down the Colonial Pipeline company, freezing its systems and disrupting fuel supplies for a week. The stalemate was resolved only when the company paid a ransom of $4.4 million (although later reports stated the US Department of Justice managed to recover some part of it).

It is against this backdrop that Moody’s has released a report, “Proliferation of Cyberattacks Prompts Re-Evaluation of Cyber Insurance Risk”. To talk about it, Michael Dion, vice president and senior analyst, joined Intelligent Insurer’s Re/insurance Lounge.

“Cyber crime has been a hot topic over the last couple of years,” said Dion, and it is an area that is set to grow. As Moody’s writes in its report: “Cyber crime will cost the global economy an estimated $6 trillion in 2021 according to Cybersecurity Ventures, and will grow at an estimated average 15 percent annual rate over the next five years.”

It was in 2020 and 2021 that the proliferation in cyber crime really began to take hold. Ransomware payments hovered between $800 million and $1,000 million in 2016 and 2017, increasing gradually to a little over $1,200 million in 2019. But, from then, they boomed a third in one year to reach $1,600 million in 2020. Correspondingly, the loss ratio over this time has also increased from just over 30 percent in 2016 to a little more than 60 percent in 2020.

Much of this, said Dion, is down to the fact that the COVID-19 pandemic led to increasing numbers of people working from home, often from their personal computers where security was laxer than on a closed system. And many of these people have not made their way back to the office, and likely never will.

“It’s partly driven from the work-from-home environment that began in March 2020, but attacks have been increasing over the last few years. But it was the catalyst of the pandemic, with people working remotely and the increased use of digital devices being used for work-related materials that escalated the overall number of cyber attacks,” he said.

Another factor is the rise of cryptocurrency, notably Bitcoin, which has allowed attackers to demand payment and easily cover their tracks.

“The lack of ability for insurance companies and legal authorities to track down payments sent to hackers is driving the escalation. Another reason is that many of these attacks are emanating from overseas, from countries or individuals that are not friendly towards the US. That often makes it difficult to track and apprehend the culprits,” he explained.

For more content like this visit the Reinsurance Lounge

A small section

Even with the growing frequency and number of attacks, this area—despite its profile—remains a small part of the insurance sector.

“Based on US regulatory financial data direct cyber insurance premiums written grew to $2.5 billion in 2020, a cumulative annual growth rate of 103 percent since 2016,” reads the Moody’s report. “Despite rapid growth, cyber insurance represents less than 1 percent of US industrywide premium revenue, which is dominated by personal automobile and homeowners’ insurance as well as standard and specialty commercial insurance.”

“It is a small line of coverage within the US compared to motor insurance, property insurance, or commercial lines coverage,” Dion agreed.

“Cyber premiums were only about $2.5 billion in 2020, which is the last full year of data that we have. But that has still increased over 100 percent when you compare it to 2016. So it’s a rapidly growing area, even if the slice of premiums is still only about 1 percent of the total P&C premiums in the US.”

It is a market that is dominated by a handful of big players. Dion estimated that over three quarters of the market is split between the top 10 players, with other companies trailing behind. The largest share is held by Chubb, which has a 16.5 percent slice of the pie. The 10th-largest player, BCS, holds only 3.5 percent.

Moody’s prediction for 2021 was that escalating losses would drive rates for cyber insurance significantly.

“Primary insurers mindful of the dynamic nature of the risk and potential for aggregation, have been actively reinsuring cyber risk primarily through quota share arrangements,” says the report.

“Some companies may also have aggregate stop-loss reinsurance. According to Willis Re ‘1st View Emerging Equilibrium’ published in July 2021, reinsurance pricing is up between 30 and 40 percent given rising losses and higher demand from primary companies.

“Some reinsurers have added aggregate caps to quota share reinsurance agreements to manage the accumulation risk.”

While the news may sound grim, Dion feels that we should be hopeful.

“What looks promising is that the Biden administration has made cyber crime a priority. We have the industry working with the government and law enforcement. So although things look bad now around the escalating losses and the number of attacks increasing, there’s been a lot of progress made this year, with certainly more to come,” he concluded.

To view the full Re/insurance Lounge interview click here