European, Asian companies short on cyber insurance before ransomware attack

London/New York (Reuters): Many companies outside the United States may not have cover for a recent computer-system attack, leaving them potentially with millions of dollars of losses because there has been relatively little take-up of cyber insurance, insurers say.

A massive ransomware worm caused damage across the globe over the weekend, stopping car factories, hospitals, shops and schools, amid fears it could wreck fresh havoc when employees return to work.

Cybersecurity experts said the spread of the virus dubbed WannaCry – “ransomware” which locked up more than 200,000 computers in more than 150 countries – had slowed, but the respite might only be brief.

The overall cost of getting businesses going again could run into the billions of dollars, with companies in Europe, including Russia, and Asia particularly vulnerable.

Nearly nine out 10 cyber insurance policies in the world are in the United States, according to Kevin Kalinich, global head of Aon Plc’s cyber risk practice. The annual premium market stands at $2.5-$3 billion.

The biggest reason for the larger penetration in the United States, says Bob Parisi, U.S. cyber product leader for insurance broker Marsh, “is that the U.S. has been living with state breach notification laws for the past 10 years.”

The greater transparency created an incentive for U.S. companies to get insurance to compensate for damage from incidents they were required to report. An upcoming European Union directive is expected to have the same impact there.

Companies that were not prepared for WannaCry can expect to rack up business interruption costs that far exceed a ransomware payment, said Kalinich.

“If you’re a hospital that turned away patients, if you’re a global delivery company that can’t send package, or a telecom company in Spain, Russia or China, the financial statement impact from the business interruption is much larger than the $300 ransomware,” he said.

Organisations hit by the attacks, which lock up computer systems until the victims pay a ransom, included Britain’s National Health Service, French car manufacturer Renault, and Spain’s Telefonica.

Sources close to Telefonica said the company had insurance to cover the attacks but it was too soon to estimate the economic impact.

Renault and the NHS did not respond to requests for comment.

West Coast cyber risk modelling firm Cyence estimated the average individual ransom cost from Friday’s attacks at $300, and the total economic costs from interruption to business at $4 billion.

The U.S. Cyber Consequences Unit, a non-profit research institute that advises governments and businesses on the costs of cyber attacks, estimated more modest total losses. They were likely to range in the hundreds of millions of dollars, and unlikely to exceed $1 billion, the group forecast.

A typical cyber insurance policy will protect companies against extortion like ransomware attacks, which insurers say have spiked in the past 18 months. It would cover the investigation costs and also pay the ransom, according to Parisi.

But there are caveats. Companies that did not download a Microsoft patch issued in March to protect users from vulnerabilities may be out of luck, since many cyber policies exclude coverage in such an instance. Companies using pirated software are also unlikely eligible for an insurance payout, Kalinich said.

Most cyber insurance policies cover breaches of up to $50 million, with much of the losses related to the interruption of the firms’ business, Parisi said. Some policies can cover losses for as much as $500-600 million.

Cyber insurance policies also typically cover the cost of notifying those whose data has been breached, hiring a PR agency to address reputational damage and arranging credit monitoring for those affected, as well as potential legal suits. It is a high-margin business. Insurer Sciemus, for example, has previously said it charges around $100,000 for $10 million in data breach insurance and as much as seven times that to cover attacks causing physical damage. Other providers include Allianz, AIG, Chubb and Zurich as well as Lloyds’ of London insurers such as Beazley and Hiscox.

Even before the weekend attacks, demand in Europe was expected to rise after an EU directive is implemented in mid-2018 requiring companies to notify authorities of a data breach. With strong competition and uncertainty as to how many of the losses over the weekend were insured, the impact on insurance premiums, however, may be muted.

Insurers are likely to more carefully scrutinise risks they take on as well as how they word policies and exclusions, Kalinich said.

“They will want to pick the companies that are most prepared,” Kalinich said. Other firms might be eligible for coverage, but more exclusions may apply, he said.

For example, insurers may seek to deny coverage if companies pay the ransom without contacting their insurers first, he said.

“There are really important intricacies. You could end up losing a couple million dollars.”