Ifrah Yousuf graphic of computer

Cyber-Insurance Rates Soaring Thanks to Rise in High-Cost Ransomware Attacks

Insurers have made “dramatic” increases in premiums for cyber-insurance and are considering lowering the ransom amounts they will pay.

Cyber-insurance rates are set to increase by as much as 25 percent thanks to insurance companies having to pay out expensive claims related to ransomware attacks, according to a Reuters report.

While ransomware attacks happened slightly less frequently in 2019 as compared to the year before, hackers are beginning to ask for higher payoffs and are doing more damage when they attack businesses or governments. Some cybersecurity experts have even gone so far as to blame insurance companies for exacerbating the problem, as many insurers would rather pay the ransom than deal with ongoing cybersecurity costs for their clients.

“The onus isn’t on the insurance company to stop the criminal, that’s not their mission,” Loretta Worters, a spokeswoman for the Insurance Information Institute, told ProPublica in August. “Their objective is to help you get back to business. But it does beg the question, when you pay out to these criminals, what happens in the future?”

Cyber-insurance premiums began to rise 5 percent to 25 percent late in 2019, Robert Parisi, the U.S. cyber product leader at Marsh & McLennan Companies, told Reuters. Policies often cover data recovery, legal liabilities and negotiators who can translate from hackers’ native languages, according to the report. Insurers have made “dramatic” increases but have not scaled back coverage, Parisi said.

Some insurers, like Sompo, are considering lowering the amounts they will pay for ransomware attacks against high-risk companies and require clients to pay 20 to 30 percent of ransomware claims, according to Reuters. Other insurance companies are thinking about making ransomware a separate product from general cyber-insurance coverage.

The high costs associated with ransomware attacks are also associated with the increasing amount of attacks on managed service providers responsible for the IT services of several companies, particularly hospitals and medical businesses. This means that one successful attack can encrypt sensitive data for dozens of facilities or companies at once, incentivizing the managed service provider to pay the ransom so that their clients can get access to crucial data as fast as possible.

In turn, malicious actors see that they can continue to raise ransoms and be rewarded by insurers and the desperate companies themselves.

While ransom payment can encourage attackers, it’s up to insurers to decide the cost-benefit analysis and make the right decision for all involved, according to Michael Lee, the city spokesman for Lake City, Florida, which was a ransomware attack victim in 2019.

“The insurer is the one who is going to get hit with most of this if it continues,” Lee told ProPublica. “It’s kind of hard to argue with them because they know the cost-benefit of [paying ransoms]. I have a hard time saying it’s the right decision, but maybe it makes sense with a certain perspective.”

Illustration courtesy of Ifrah Yousuf, via the Cybersecurity Visuals Challenge

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • 2024 Gun Violence Report: Fewer Overall Incidents, but School Deaths and Injuries Are on the Rise

    Omnilert, provider of gun detection technology, today released its compilation of Gun Violence Statistics for 2024 summarizing gun violence tragedies and their adverse effects on Americans and the economy. While research showed a decrease in overall deaths and injuries, the rising number of school shootings and fatalities and high number of mass shootings underscored the need to keep more people safe in schools as well as places of worship, healthcare, government, retail and commerce, finance and banking, hospitality and other public places. Read Now

  • Survey: Only 7 Percent of Business Leaders Using AI in Physical Security

    A new survey from Pro-Vigil looks at video surveillance trends, how AI is impacting physical security, and more. Read Now

  • MetLife Stadium Uses Custom Surveillance Solution from Axis Communications

    Axis Communications, provider of video surveillance and network devices, today announced the implementation of a custom surveillance solution developed in collaboration with the MetLife Stadium security team. This new, tailored solution will help the venue augment its security capabilities, providing high-quality video at unprecedented distances and allowing the security team to identify details from anywhere in the venue. Read Now

  • U.S. Cyber Trust Mark Launches for Consumer Internet-Connected Devices

    The White House recently announced the launch of a cybersecurity label for internet-connected devices, known as the U.S. Cyber Trust Mark, completing public notice and input over the last 18 months. During that time, FCC Commissioners decided in a bipartisan and unanimous vote to authorize the program and adopt final rules, as well as the trademarked, distinct shield logo that will be applied to products certified for the U.S. Cyber Trust Mark label. Read Now

Featured Cybersecurity

Webinars

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3