Companies could face a $45 billion loss from a big cyberattack because they do not have enough insurance to cover the threat, according to Lloyd’s of London.
The losses could come from a wide-ranging assault on their cloud service provider that causes failure for their own company, customers and suppliers, Lloyd’s warns today.
In another scenario, exploiting a chink in a company’s software could lead to $26 billion of losses not covered by insurance, Lloyd’s believes.
The insurance market has formed a partnership with Cyence, a firm specialising in analysing the economic impact of cyber risks, to urge companies and its own underwriting members to focus more on their potential losses.
Inga Beale, chief executive officer of Lloyd’s, said: “This report gives a real sense of the scale of damage a cyberattack could cause the global economy.
Advertisement
“Just like some of the worst natural catastrophes, cyber events can cause a severe impact on businesses and economies, trigger multiple claims and dramatically increase insurers’ claims costs. Underwriters need to consider cyber cover in this way and ensure that premium calculations keep pace with the cyber threat reality.”
A global cyberattack could trigger $53 billion of economic losses, similar to a natural disaster like Hurricane Sandy in 2012, the research found.
The insurance market can cope with these types of losses, but needs more investors who want to plough capital into familiar types of underwriting such as hurricanes and earthquakes to switch to new areas such as cyber, Ms Beale said. Lloyd’s is investing in detailed modelling and making cyber a priority in its public statements in order to “get that capital into new risks”, she added.
In May, WannaCry ransomware locked computers across the world and demanded payment for them to be unlocked. The NHS was particularly badly affected. In 2014, Sony Pictures Entertainment became the target of a major cyberattack, linked to its satirical film about North Korea, The Interview.
Insurers’ understanding of cyber liabilities and the way risks could aggregate is still evolving, the report notes.
Advertisement
Smaller and middle-market businesses are particularly exposed to attacks through their lack of insurance. There is also a general lack of standardisation around cyber insurance offerings, which makes it hard for risk managers to choose which products to buy. Stephen Tester, a partner at the law firm CMS, said: “There will always be cyber-related losses that are not insurable. Long-term reputational damage and drops in share prices are almost impossible to calculate or cover and some losses are so huge that they exceed the Lloyd’s market’s capacity to cover them”.
Insurers can help by providing rapid response experts to clients to stem the damage from cyberattacks, Mr Tester added. “These enable companies to benefit from IT forensic, legal and PR advice during the critical first 48-72 hours of a breach. This usually enables the insured to mitigate both covered and non-covered consequences.”
Lloyd’s believes the global cyber market is worth between $3 billion and $3.5 billion in terms of premiums. By 2020, some analysts estimate that it could be worth $7.5 billion.
