Insurance against Cyber Extortion.
Regulators are concerned about the possibility of businesses and individuals being victimized by ransomware attacks. They encourage the public to become aware of them and take steps to guard against them. One of the steps is to consider the purchase of a cybersecurity insurance policy.
Ransomware, sometimes called cyber extortion, is a type of malicious software that infiltrates computer systems and locks them down. Typically the data or system is then held hostage by encryption until payments are made or other demands are met. Once the data or system has been frozen, the hacker directs the victim to pay a sum of money (ransom) to regain access to the device or data. Ransomware is a type of cyber-attack that can infect virtually any type of computer, including desktops, laptops, tablets and smart phones. The goal of the hackers is not to destroy or permanently encrypt the data, but to secure fast payment of the ransom.
Ransomware attacks are on the rise and are considered an escalating threat for the foreseeable future. According to the FBI, an average of 4,000 ransomware attacks occurs every day with damages hovering around $1 billion annually. That number is up 300% from 2015. Moreover, according to SecureList, “The number of ransomware attacks on businesses tripled in 2016, jumping from one attack every two minutes in Q1 to one every 40 seconds by Q3.” As a result, the number of people and businesses at risk are increasing every year.
Although the temptation to pay the ransom is great, the FBI warns this carries its own risks. There is no guarantee the data will be restored after the ransom is paid. Additionally, there is some evidence victims who have paid ransoms are often targeted again as hackers share information about successful attacks. Recent studies have shown that business leaders today pay a lot more than people expect to only hope to get their files back. IBM conducted a survey of 600 U.S. business leaders to get their feedback on what they would do if faced this kind of situation. The results concluded that 70% of these leaders have in fact paid a ransom to regain access back to their business files. Of the companies responding to the survey, nearly half of them have paid more than $10,000, and 20% of them paid more than $40,000.
Insurance is a critical element of preparing for ransomware attacks. The forensic and information security experts available through cyber insurance policies are an important resource in examining the extent of damage and attempting to minimize downtime, for example, and some of the costs of paying a ransom and losses from business interruption may well be recoverable.
Losses from these attacks could fall under a few different lines of coverage, depending on how they play out and where policyholders want to file claims. Your agent can make sure that a customer who wants coverage for cyber extortion gets that coverage through a business or cyber policy.
