Scroll down

Business Interruption and cyber attacks

Historically the typical business insurance programme protected a company's assets, profits and liabilities. Assets and profits would be covered for a range of traditional perils including fire, flood and theft. However, with technological development new risks are emerging and exposures are increasing.

Written by Paul Brown on 30th March 2020

Business Interruption and cyber attacks

Historically the typical business insurance programme protected a company's assets, profits and liabilities. Assets and profits would be covered for a range of traditional perils including fire, flood and theft. However, with technological development new risks are emerging and exposures are increasing.

The proliferation of connected devices enables businesses to automate manufacturing processes and production lines, however this serves to increase the hacking risk and the potential exposure can go way beyond that of say losing a machine to fire, flood or theft.  An operation that relies upon computer driven processes can be brought to a complete standstill by compromised technology.

A good example of this was the ransomware attack at energy company Norsk Hydro 1 in March 2019 which affected more than 22,000 computers across 170 different sites in 40 countries and forced it to halt many production lines. The company rejected the ransom demands and whilst their response won many plaudits amongst law enforcement organisations, the attack resulted in an extensive recovery period and a loss in excess of £45m.

So how have Insurers responded?

Clearly the Norsk Hydro experience and others, demonstrated a real and present risk that was not provided for by traditional policies.  A Business Interruption policy responds to claims arising from that loss of a machine by fire, flood or theft, but where there is no physical loss or damage, cover is not triggered.

 

 

However, the Insurance market traditionally responds to emerging risk exposures and as a result, Cyber Insurance policies began to appear. To price any line of cover, Insurers rely on statistics and with any new risk this can be a problem. This, and the level of exposure demonstrated by the Norsk Hydro incident and others, has led to a tightening up and the removal of so-called "silent cyber" a limited form of cover in packaged policies by a number of insurers.

Stand-alone Cyber Insurance remains available and can include cover for losses arising from a business interruption resulting from the organisation being hacked. When purchasing this cover careful consideration needs to be given to the length of the Indemnity Period being provided. The Norsk Hydro claim demonstrated that whilst computer systems can be restored relatively quickly, losses relating to the operational disruption, cancelled contracts and lost business can continue for many months.

As with all policies Cyber Insurance cover needs to be tailored to the exposures of the policyholder but another key element of cover, provided by some insurers, is an emergency response service, giving policyholders immediate access to forensic, legal and communications specialists to help mitigate losses following an attack.

Whilst the stand-alone Cyber Insurance market is developing, the take-up rate by UK businesses remains low and the Association of British Insurers (ABI) warns that only 11% of businesses are thought to have purchased specific Cyber Insurance.

Whilst it may be difficult to get Cyber Insurance onto the boardroom agenda, the statistics show there can be a real need for the cover. The UK government’s Cyber Security Breaches Survey 2019 states that 32% of businesses and 22% of charities had experienced a cyber breach, or attack, in the previous 12 months.

Business leaders are unlikely to consider an insurance programme that doesn’t insure fire, flood and theft, but the risk of a cyberattack is now much greater and remains largely uninsured.

To obtain a Cyber Insurance quotation speak to your usual Franklands contact on 01332 545720.

Source:

1 https://www.bbc.co.uk/news/business-48661152

https://www.abi.org.uk/news/news-articles/2019/08/cyber-insurance-payout-rates-at-99-but-uptake-still-far-too-low/

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/813599/Cyber_Security_Breaches_Survey_2019_-_Main_Report.pdf

 

 

 

 

See other blogs related to: Cyber liability , Insurance

Sign up for our newsletter

Get social

Quality insurance, expert advice - call us for your FREE no obligation review on

Tel: 01332 545720