From the Colonial Pipeline to the NBA, it may seem like a month can’t go by this year without another ransomware attack making its rounds in the news cycle. It begs the question: are we actually seeing an increase in ransomware attacks, or are they just becoming more high-profile?
Unfortunately, according to experts the answer is both. A 2021 report by the cybersecurity firm SonicWall found that ransomware attacks rose by 62 percent worldwide and by 158 percent in North America alone between 2019 and 2020. The FBI’s annual Internet Crime Report showed nearly 2,500 ransomware complaints had been received in 2020, which was about 20 percent more than what they received in 2019. Additionally, with the rise in the number of attacks has also come a rise in the price of ransoms, with the collective cost of ransomware attacks that were reported to the bureau increasing by more than 200 percent, from $8.9 million in 2019 to $29.1 million in 2020.
As businesses in practically every sector continue to become more digitized, it opens up more and more opportunities that ransomware criminals can take advantage of. The Ponemon Institute’s study on the cost of data breaches found that the average in 2020 had reached over $8 million. Cyber insurance may have once seemed like a frivolity to many, but in today’s world many businesses may not have the means to withstand a ransomware attack without it.
HAUSER insurance, a national risk advisory and insurance brokerage firm, believes that as ransomware attacks continue to skyrocket business leaders must become more adept at understanding the risks, so that they can be prepared should one occur and also better protect themselves to prevent a breach in the first place. With over 25 years experience in which it grew from a local insurance agency to a national brand, HAUSER believes that cyber insurance is quickly becoming an essential asset. Below, we explore with them the need-to-know information about ransomware and cyber insurance.
What is ransomware?
Ransomware is a type of malware –– software that is specifically designed to disrupt, damage or gain unauthorized access to a computer system. Using it, a cybercriminal can encrypt a user’s computer systems or files, making them impossible to access without a key. They will then demand a fee, or ransom, to unlock the encrypted data. While this model has existed in a more limited capacity since the late 1980’s, as technology has evolved to make our files secure, so too has this form of malicious software.
Today, not only is it increasingly getting easier to become a cybercriminal as ransomware technology gets more user-friendly and accessible, but the dynamic between companies and them have also become more complex. Hackers can now spend weeks or months embedded in an organization’s computer system undetected, allowing them to find the most valuable data to encrypt and exploit.
The resulting ramifications also go beyond the ransom that is demanded. A data breach can lead to bad press, as well as a loss of trust from both customers and employees, and while it may seem like this is a problem that only large, high-profile companies would have to worry about, According to HAUSER’s website, over 60 percent of cyber attacks are directed at small to medium-sized businesses.
What is cyber insurance?
Cyber insurance is an insurance policy that can help protect organizations from the ramifications of ransomware. A cyber insurance policy –– sometimes called cyber-liability insurance or cyber risk insurance–– can help both minimize disruptions to business activities during and after a ransomware attack and also aid in covering the financial cost of both the attack itself and recovery afterward. However, as with all insurance there are things that cyber insurance can’t protect against, which is why it is important that businesses and organizations need to make sure they fully understand what is covered and what isn’t when they sign up for a plan. For example, while companies like HAUSER will make sure to take clients through a consultative approach to help businesses maximize the value of their insurance coverage at every level, the onus of cybersecurity itself still falls on the business itself. Rather than see cyber insurance as the main solution to a ransomware attack, it should be considered a vital component in a comprehensive approach to cybersecurity.
How cyber insurance can protect an organization
Even prior to the coronavirus pandemic the American workplace was becoming increasingly more mobile. While allowing employees to take home laptops and do business on their personal devices has created a flexibility that many are arguing the workforce has desperately needed, it also creates a greater risk of such devices being stolen or otherwise compromised. While one lost laptop may not be a large cost on its own, if it falls into the wrong hands and results in exposed private or confidential data in the long run. From legal costs to investigation expenses, a lost device’s cost can quickly multiply. Some cyber insurance policies can include protection for failure to prevent unauthorized access to data containing the confidential or private information of others, but it is in the best interest of organizations to take steps to protect and limit the amount of data on these devices. One of the simplest ways they can do so is by educating employees on secure and effective passwords and mandating periodic changes of them.
Should a business be hit with a ransomware attack, they will often need to call in a computer forensics team who can determine the extent of a breach and whether private customer information may have been compromised. Cyber insurance policies will often cover reimbursement for such expenses, as well as coverage for potential business loss as well as other expenses that may be incurred while business is being returned to normalcy. The hours and days after a data breach are often critical, and cyber insurance can make sure you make the most of them.
As stated earlier, companies are ultimately responsible for their online data, whether it is stored in an offsite data warehouse, on property or in a third-party technology company cloud. If any personally identifiable information or protected health information is exposed in a ransomware breach, an organization could be held liable. Notifying customers of a breach, as well as other post-breach responses are mandated by law, and the cost of them can quickly add up. A cyber insurance policy opens up the possibility of coverage for breach notifications as well as remediation expenses, as well as defense expenses such as responding to and cooperating with regulatory investigators. However, to better prepare organizations can create and test policies and procedures concerning the collection and storage of data, as well as having procedures in place regarding document retention to avoid holding on to data that is sensitive but not needed.
Much of preparedness for a ransomware attack involves simply being aware of the risks and ensuring that the entire organization from the top-down is knowledgeable of them. However, as instances continue to rise and the cost of doing so along with them, HAUSER Insurance wants to ensure that as many people as possible are aware of their options for mitigating such risks.
