CRUCIAL INSURANCES

Companies nowadays either already have or know about crucial insurances that they need, i.e. directors and officers, third-party liability insurance, or property insurance. This was sufficient for some time. However, our current pandemic situation and the necessity to work from home and run business in a remote or hybrid manner have made us aware of the threats that lurk on the internet. 

CYBERATTACK DETAILS

First of all, to draw the bigger picture and set the stage for further analysis, let’s look at some numbers regarding cybercrime and cyberthreats in 2020:

•  One out of six businesses fell victim to ransomware attacks worldwide.

• Data breaches exposed over 7 billion personal data all around the world.

• In comparison to 2019, there was a 69% increase in the number of cybercrime reports — according to the FBI Internet Crime Complaint Center (IC3). 

•  IC3 received almost 2,000 cybercrime reports per day. 

As for the most common types of cyberattacks, we can see that the most frequent are attacks related to phishing, fishing, and pharming. In layman’s terms, all those attacks that can be conducted via social media are the easiest to perform. In 2020, we saw over a 195% increase in those types of attacks in juxtaposition with 2019. Second in line, in terms of growth, in 2020, cyberattacks related to identity theft increased by 169% in relation to 2019. Those were all the attacks that targeted sensitive data such as social security numbers, phone numbers, credit card PIN numbers, and medical data. The third increase in the number of cyberattacks relates to all kinds of investment scams, which increased since 2019 by 120% in 2020. The most common scams are related to the so-called advance-fee scams, i.e. fake lotteries, government grants, inheritance, opportunities to work from home. Finally, there is a whole galaxy of other threats lurking in cyberspace which has also seen growth in the frequency of attacks, such as malware applications that can infect notebooks, smartphones, printers, and ransomware that blocks access to crucial data and other applications. The so-called DoS attacks – denial of service — is one of the most common attacks, especially in the e-commerce industry. 

CYBERCRIME COSTS

To put things into better perspective, authorities, and specialists that handle cybercrime on a day-to-day basis prognosis that global economic cybercrime costs will grow 15% per year reaching almost $11 trillion in the year 2025. The above statistics arise the question: what can companies and institutions do to minimize the damages that such potential cyberattacks can inflict? Currently, there are dozens of companies in Poland that provide consulting on the matters of cybersecurity. A lot of them help to set up good contingency plans. They also help to secure the servers and e-mails of the company. However, we need to remember that the weakest link is always human error, and achieving 100% security against cyberattacks is impossible. That’s why cyber-risk insurances are becoming more and more popular and are starting to become one of the most wanted insurances on the market.

CYBER-RISK INSURANCE

Cyber-risk insurance provides a wide spectrum of coverage for companies and institutions, as this topic is quite potent and the sheer insurance coverage could fill up dozens of articles. The insurance provides coverage of violations of privacy and sensitive personal data. Most of the insurance companies provide coverage for violations such as data leaks of personal data, but also leaks of information regarding contractors. What is crucial in this aspect of the insurance is the coverage of GDPR-related administrative procedures and controls performed by the proper authorities. Cyber-risk insurance provides support in case of such actions taken against the insured entity and provides financing of lawyers, IT experts, and even PR companies that help to contain the negative effects of a data leak.

Another crucial aspect of coverage provided by cyber-risk insurance is the coverage of violations on the network security of the insured entity. This aspect covers all kinds of damages done by malware, hacking, DoS attack, and every unauthorized use or access. Ensuring the company finances the damages and expenses related to claims derived from the network security violations inflicted both within the insured company and third party. This insurance can also cover any liability resulting from intellectual property theft or breach of reputation. This aspect provides the insured entity with the necessary support (again from lawyers, IT specialists, and PR specialists) in case of a cyberattack or situation that caused harm to the company and requires immediate attention. Furthermore, cyber-risk insurance provides coverage of extortions that can be the effect of ransomware implanted in the network or extortions that emerge from data leaks or data thefts carried out by hackers or malware. 

MORE ASSISTANCE

Another equally important aspect of this insurance is the coverage of data breaches and business disruption. This aspect of cyber-risk insurance provides the necessary help in case of violations resulting in damaging or erasing certain data and therefore frequently resulting in business disruption. If the business disruption occurs, insurance provides compensation based usually on the difference between last year's net income in the given period, compared to the income that was achieved (or not) during the disruption period. Moreover, most of the cyber-risk insurances provide not only financing of legal, IT, or PR support, but also provide assistance of companies that provide help in handling a cyber-incident or a cyberattack. Those companies usually consist of IT experts that help to identify the breach and its scale, help in containing it, and set up future security and contingency plans.

All of the above aspects of cyber-risk insurance show us how vast is the scope of the given security. Cyber-risk insurance covers both third-party liability and the internal risk of the insured entity. However, it needs to be said, that due to the rising frequency of cyberattacks and increase in malware/ransomware activity, this insurance is not one of the cheapest and insurance companies do not take new clients with ease. Every entity that wants to be insured needs to prepare a set of documentation and questionnaires that will determine if they are eligible for cyber-risk insurance.

Equinum Broker is a leading Poland-based brokerage firm. Rafał Kowalski is an attorney-at-law at the company and specializes in civil and companies law, in addition to legal aspects of cyber-risks, GDPR, and new technologies.