Cyber insurance premiums have soared by almost a third in the last year thanks to an explosion in ransomware incidents.
That's according to a report, titled Cyber Insurance: A Hard Reset, from international insurance broker Howdens. The company recorded a 32% rise in premiums between June 2020 and June 2021, and said that it shows no sign of slowing.
"With major cyber (re)insurers increasing their loss picks in response to higher claims inflation, clients can expect pricing to continue to rise through 2021 and potentially into 2022," Howdens said.
Claims have accelerated dramatically, according to the report, and ransomware is largely to blame. First-party claims under dedicated cyber insurance policies reached almost 9,000 in 2020, compared to just 1,000 in 2015.
This increase in claims, along with a jump in payment sizes, has sent the loss ratio (the ratio of insurance losses to premiums earned) among US underwriters soaring to 70% in 2020 from under 30% in 2018.
This rise in claims is also prompting underwriters to pull back from cyber insurance. The proportion of brokers in the US reporting diminishing capacity for cyber insurance coverage grew from 10% in Q1 2020 to over 70% in Q1 2021. Demand also rose from 60% to over 90% in that period, creating a classic supply crunch.
RELATED RESOURCE
IT Pro 20/20: Does cyber security's public image need a makeover?
Issue 18 of IT Pro 20/20 looks at recent efforts to retire the 'hacker' stereotype, and how the threat landscape has changed over the past 20 years
When they do take on cyber risk, companies are far more strict about their clients' cyber security measures, the report warns. They are also adopting new measures to mitigate the risk, including sub-limits and coinsurance, where the client pays a proportional amount of the cost for a cyber incident.
Policy coverage for cyber events have been reliable, suggests the report, citing the OECD. All policies across Australia, Canada, Japan, the Netherlands, the UK, and the US covered data breaches and network security liability, while fewer covered communication and media liability.
Technology disruption and cyber extortion garnered the least coverage, but more than nine in ten policies still covered these incident types, the report found.
However, Howdens noted that many cyber incident exposures are still covered by property and casualty contracts, and insurers are likely to adjust their risk profiles in dedicated cyber insurance contracts.
"The prevailing mood is one of caution, and a number of businesses are finding themselves in a ‘catch 22’ situation where cyber exclusions or sublimits are being imposed in their property or liability policies and they are encountering supply issues in the dedicated cyber market," the report said.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
