Category Archives: Cyber Risk

Man-made and Natural Hazards Both Demand
a Resilience Mindset

This weekend’s ransomware attack that forced the closure of the largest U.S. fuel pipeline provides another powerful illustration of the need for a resilience mindset that applies to more than just natural catastrophes.

Colonial Pipeline Co. operates a 5,500-mile system that transports fuel from refineries in the Gulf of Mexico to the New York metropolitan area. It said it learned Friday that it was the victim of the attack and “took certain systems offline to contain the threat, which has temporarily halted all pipeline operations.”

Individually, the event demonstrates the threat cybercriminals pose to the aging energy infrastructure that keeps the nation moving. More frighteningly, though, it is yet another example of how vulnerable the complex, interconnected global supply chain is to disruptions of all kinds – a message that isn’t lost on risk managers and insurers.

Last year, a ransomware attack moved from a natural-gas company’s networks into the control systems at a compression facility, halting operations for two days, according to a Department of Homeland Security (DHS) alert

The DHS described the attack on an unnamed pipeline operator that halted operations for two days.  Although staff didn’t lose control of operations, the alert said the company didn’t have a plan in place for responding to a cyberattack.

“This incident is just the latest example of the risk ransomware and other cyber threats can pose to industrial control systems, and of the importance of implementing cybersecurity measures to guard against this risk,” a CISA spokesperson said at the time.

Not just energy companies

It isn’t only energy and industrial companies that need to be paying attention. According to cyber security firm VMware, attacks against the global financial sector increased 238 percent from the beginning of February 2020 to the end of April, with some 80 percent of institutions reporting an increase in attacks.

“Cyber is an existential issue for financial institutions, which is why they invest heavily in cyber security,” says Thomas Kang, Head of Cyber, Tech and Media, North America at Allianz Global Corporate & Specialty (AGCS). “However, with such potentially high rewards, cybercriminals will also invest time and money into attacking them.”

He pointed to two malware campaigns – known as Carbanak and Cobalt – that targeted over 100 financial institutions in more than 40 countries over five years, stealing over $1 billion.

An ACGS report shows technical failures and human error are the most frequent generators of cyber claims, but the financial impact of these is limited:

“Losses resulting from the external manipulation of computers, such as distributed denial of service attacks (DDoS) or phishing and malware/ ransomware campaigns, account for the significant majority of the value of claims analyzed across all industry sectors (not just involving financial services companies).”

According to the report, regulators have turned their attention to cyber resilience and business continuity.

“Following a number of major outages at banks and payment processing companies, regulators have begun drafting business continuity requirements in a bid to bolster resilience.”

Not just cyber

The COVID-19 pandemic has taught the world a lot of lessons, not the least of which is how vulnerable the global supply chain – from toilet paper to semiconductors – is to unexpected disruptions. Demand for chlorine increased during 2020 as more people used their pools while stuck at home under social distancing orders and homeowners also began building pools at a faster rate, adding to the additional demand. Such disruptions can ripple through the economy in different directions.

Business interruption claims and litigation have been a significant feature of the pandemic for property and casualty insurers.

When the container ship Ever Given got wedged in the Suez canal – one of the most important arteries in global trade – freight traffic was completely blocked for six days. Even as movement resumed, terminals experienced congestion and the severe drop in vessel arrival and container discharge in major terminals aggravated existing shortages of empty containers available for exports. The ship’s owners and the Egyptian government remain locked in negotiations over compensation for the disruption, and the ship is still impounded.

Spurred in part by this event, the Japanese shipping community is considering alternative freight routes to Europe, both reliant on Russia: the Trans-Siberian Railway and the Northern Sea Route. Neither option is devoid of risks.

In an increasingly interconnected world, there is no bright line distinguishing man-made from natural disasters. After all, the Ever Given grounding was caused, at least in part, by a sandstorm. April’s power and water disruptions that left dozens of Texans dead and could end up being the costliest disaster in state history were initiated by a severe winter storm.

A resilience mindset focused on pre-emptive mitigation and rapid recovery is called for in both cases. There is no “either/or.”

Businesses are urged to take steps immediately to mitigate massive data breach tied to Chinese hackers

The alarm about the ongoing hack of Microsoft Exchange Server, which began as early as January, appears quite justified. Microsoft believes a state-sponsored Chinese group called Hafnium orchestrated the attack that exploited flaws in Exchange software to gain access to email accounts and install unauthorized software, gaining full control of affected systems.

Hafnium primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and NGOs, according to Microsoft.

In a tweet, the United States Cybersecurity and Infrastructure Security Agency (CISA) urged “ALL organizations” across “ALL sectors” to follow its guidance to address the email software’s vulnerabilities.

The number of U.S.-based organizations affected is estimated to be at least 30,000, while worldwide that number is close to 100,000. The vulnerability can be exploited to compromise networks, steal information, encrypt data for ransom, or even execute a destructive attack. CISA advises business leaders at all organizations to ask IT personnel to immediately address this incident or get third-party IT support.

A Hafnium attack should trigger any cyber insurance an organization has in place, according to Lockton, an insurance broker.  Lockton recommends that organizations contact their insurer only if they discover that the vulnerabilities being exploited are present in the system. If an attack is underway, it should be reported to cyber insurers immediately.

Businesses Large and Small Need to Be Cyber Resilient in a COVID-19 World

By Loretta Worters, Vice President, Media Relations, Triple-I

Advanced Persistent Threat groups and cybercriminals are likely to continue to exploit the COVID-19 pandemic over the coming weeks and months.  Weak and stolen passwords, back doors, applications vulnerabilities, malware and insider threats have been among the most common causes of data breaches in the past.  But according to a recent Willis Towers Watson report new threats include:

  • Phishing, using the subject of coronavirus or COVID-19 as a lure;
  • Malware distribution, using coronavirus or COVID-19-themed lures;
  • Registration of new domain names containing wording related to coronavirus or COVID-19; and
  • Attacks against newly and often rapidly deployed remote access and teleworking infrastructure.

Security breaches have increased by 67% since 2014, yet businesses fail to take the proper precautions.   Ransomware has become big business for “professional” criminals, crippling large and small businesses alike.  But small businesses are especially attractive targets because they have information that cybercriminals want, and they typically lack the security infrastructure of larger businesses. 

A remote workforce due to COVID-19 has made many organizations address issues of remote access and the need for multifactor authentication and virtual private networks (VPNs). But others – less cyber savvy— have left themselves exposed to cyberattacks.

In addition, vishing (via telephone) and smishing (via text message or WhatsApp) attacks have also increased in frequency, and in a work from home environment where colleagues and clients are increasingly connecting via mobile phones, vulnerability increases, according to a new AON Report. Short message attacks will generally seek to redirect a victim to a compromised website in order to harvest user credentials.

According to a recent survey by the Small Business Administration , 88% of small business owners felt their business was vulnerable to a cyber-attack – and that was before the pandemic. Yet many businesses can’t afford professional IT solutions, have limited time to devote to cybersecurity, or don’t know where to begin.

In observance of National Cybersecurity Awareness Month,  Triple-I offers U.S. businesses these seven tips for improving their cybersecurity and averting data breaches:

  1. Understand your cyber risks. Businesses are vulnerable to cyberattacks through hacking, phishing, malware, and other methods. 
  2. Train Staff. Those engaged in cyberattacks find a point of entry into a business’ systems and network. A business’ exposure can be reduced by having and enforcing a computer password policy for its employees.
  3. Keep Software Updated. Businesses should routinely check and upgrade the major software they use.
  4. Create back-up files and store off-site. A business’ files should be backed up either as an external hard drive or on a separate cloud account. Taking these steps are vital to data recovery and the prevention of ransomware. Ransomware is when a cyberattack results in a situation where a business is asked to pay a fee to regain access to its own data.

Victimized Twice? Firms Paying Cyber Ransom Could Face U.S. Penalties

Recent advisories from two U.S. Treasury agencies –  the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) – indicating that companies paying ransom or facilitating such payments to cyber extortionists could be subject to federal penalties are a reminder of the importance of good cyber hygiene.  

The notices also underscore businesses’ need to consult with knowledgeable, reputable professionals long before a ransomware attack occurs and before making any payments. 

Ransomware on the rise 

In a ransomware attack, hackers use software to block access to the victim’s own data and demand payment (usually in Bitcoin or another cryptocurrency) to regain access. It has been a growing problem in recent years, and such attacks have intensified since the COVID-19 pandemic has led to many people working from home for the first time.  

The FBI warns against paying ransoms, but studies have shown that business leaders today pay a lot in the hope of getting their data back.  An IBM survey of 600 U.S. business leaders found that 70% had paid a ransom to regain access to their business files. Of the companies responding, nearly half have paid more than $10,000, and 20% of them paid more than $40,000. 

Sanctioned entities 

The OFAC advisory specifically targets transactions benefiting individuals or entities on OFAC’s Specially Designated Nationals and Blocked Persons List, other blocked persons, and those covered by comprehensive country or region embargoes (e.g., Cuba, the Crimea region of Ukraine, Iran, North Korea, and Syria). 

If you pay ransom to anyone in these categories, you could be fined or even jailed for breaching the  International Emergency Economic Powers Act (IEEPA) or the Trading with the Enemy Act (TWEA). Penalties can vary widely, depending on the circumstances.  

How is a business owner to know?  

“Companies should rely on experts to assist with their due diligence and work with the FBI,” writes law firm BakerHostetler in a recent blog post. “Experience in incident response is key, and your counsel should be an informed, confident partner as you navigate this rapidly evolving area.” 

“Before a payment is made,” the law firm writes, “a company generally retains a third party to conduct due diligence to ensure that the payment isn’t being made to a sanctioned organization or a group reasonably suspected of being tied to a sanctioned organization. Additionally, checks are in place to ensure that anti-money laundering laws are not being violated.”

Many insurers are working with their clients to put such practices in place and taking a variety of other steps to address the threat of ransomware attacks. Cyber-insurance premiums started rising 5% to 25% late last year, according to Robert Parisi, U.S. cyber product leader at insurance broker Marsh & McLennan. Parisi called the increases “dramatic” but said insurers have not scaled back coverage. 

Marsh has issued a client advisory — What OFAC’s Ransomware Advisory Means for US Companies — explaining what U.S. businesses need to know about the OFAC advisory and the importance of completing an OFAC review before payment of ransom demands.  Marsh’s advisory also makes recommendations for re-assessing ransom incident response plans, mitigating ransomware risk, and preparation for and recovery from ransomware and cyber extortion attacks. 

Ransomware claims rise in severity since start of pandemic

During the last week in September, Universal Health Services Inc., one of the largest hospital chains in the United States, began taking some ambulances out of service because of disruptions caused by a ransomware attack. Universal said no patients were harmed, but systems that support medical records, laboratories and pharmacies were taken offline at approximately 250 facilities.

This incident is part of a disturbing trend of healthcare institutions being targeted by ransomware attacks  as the software used by hackers becomes more sophisticated and their attacks broader.

While cyber insurance claims impacted businesses of all types and sizes certain industries, including consumer businesses (retail, hospitality and food), healthcare and financial services were more frequent targets of cyberattacks in the first half of 2020, according to a recent report by Coalition, a provider of cyber insurance.

Overall, ransomware (41 percent), funds transfer loss (27 percent), and business email compromise incidents (19 percent) were the most frequent types of loss—accounting for 87 percent of reported incidents and 84 percent of claims paid in the first half of 2020.

“We’ve seen a sharp increase in ransom demands over the past quarter as threat actors have exploited COVID-19 and changes in company operating procedures. Although the frequency of ransomware claims has decreased by 18 percent from 2019 into the first half of 2020, we’ve observed a dramatic increase in the severity of these attacks,” said the Coalition report.

Since email is the single most targeted point of entry for a hacker, taking a few basic email security measures and implementing an anti-phishing solution would go a long way toward securing your business from criminals.

Coalition reports that, for each claim processed, cyber insurance played a critical role in helping the insured recover operationally. For example, a nonprofit organization providing child and family services grants to other nonprofits was duped into transferring $1.3 million to criminals. Coalition worked with law enforcement and the financial institutions involved to recover the stolen funds.

Senate Panel Meets
On COVID-19 Fraud

The Senate Judiciary Committee last week held a  hearing  titled “COVID-19 Fraud: Law Enforcement’s Response to Those Exploiting the Pandemic.”   

The hearing included testimony by William Hughes, associate deputy attorney general, U.S. Department of Justice; Craig Carpenito, U.S. attorney, District of New Jersey; Calvin Shivers, assistant director, Criminal Investigative Division, Federal Bureau of Investigation; and Michael D’Ambrosio, assistant director, U.S. Secret Service, Department of Homeland Security. 

Testimony focused on the response to fraud that has resulted from the COVID-19 pandemic. Examples included sale of fraudulent personal protective equipment (PPE) and cyber-enabled fraud; price gouging and hoarding; and fraud relating to the CARES Act’s Paycheck Protection Program (PPP). 

As demand for PPE has been greater than the supply, the environment created has been “ripe for exploitation,” Shivers said.  

In addition to sales of counterfeit PPE, he cited “advance fee” schemes – in which a victim prepays for goods like ventilators, masks, or sanitizer that are never received – and business email compromise (BEC) schemes, which involve spoofing an email address or using one that’s nearly identical to one  trusted by the victim to instruct them to direct funds to bank accounts controlled by the fraudsters. 

Shivers said the FBI is working to educate “the health care industry, financial institutions, other private sector partners, and the American public of an increased potential for fraudulent activity dealing with the purchase of COVID-19-related medical equipment.”  

He added that millions of units of PPE have been recovered from price-gouging and hoarding operations and the FBI is working to determine next steps for how to redistribute or sell the PPE. 

D’Ambrosio said that although “criminals throughout history have exploited emergencies for illicit gain, the fraud associated with the current COVID-19 pandemic presents a scale and scope of risks we have not seen before.” 

He described four categories of threat: 

  1. COVID-19-related scams, including the sale of fraudulent medical equipment and nondelivery scams;  
  1. Cybercrime like BECs, exploiting increased telework; 
  1. Ransomware and other activities that could disrupt pandemic response; and 
  1. Defrauding government and financial institutions associated with response and recovery efforts. 

Thus far, the Secret Service has initiated over 100 criminal investigations, prevented approximately $1 billion in fraud losses, and disrupted hundreds of online COVID-19-related scams, D’Ambrosio said. 

CORONAVIRUS WRAP-UP: PROPERTY AND CASUALTY (4/21/2020)

Automobile Insurance
Acting on ‘Thin’ Data, Auto Insurers Retain Flexibility With Premium Credits
Speeders Take Over Empty Roads — With Fatal Consequences
Business Interruption
Triple-I Economists: Enforced COVID-19 Business Interruption Payouts Would Damage Industry
Fight Over Pandemic Insurance Intensifies
Restaurants vs. Insurers Shapes Up as Main Event In D.C. Lobbying Fight
Cyber Risk
Hacking Against Corporations Surges as Workers Take Computers Home
Directors & Officers
D&O Insurance May Help Non-Public Companies With COVID-19 Claims
Financial Impact
Despite Recent Market Rally, Pandemic Will Continue to Hit Insurers’ Investments
COVID-19 to deter M&A activity in 2020: Conning
Kidnap & Ransom
Pandemic Exposes Organizations to Kidnap for Ransom Risk
Litigation
U.S. Businesses Bring Wave of Class Action Lawsuits Against Insurance Companies for Denial of Business Interruption Claims in Wake of COVID-19Pandemic
Hiscox Faces Legal Action From Chef Raymond Blanc: Reports
Ending Virus Shutdowns Too Soon Poses Legal Risk for Businesses
Reinsurance and Insurance-Linked Securities
Lack of Exclusions, Poor Wordings the COVID-19 BI Threats to Reinsurers & ILS
Workers Compensation
Utah Passes Bill to Provide First Responders With Comp for COVID
Comp Premiums Likely to Dip as Employment Declines: NCCI

From The Triple-I Blog:
MIXED REACTIONS TO WORKERS COMP COVID-19 EXPANSIONS

CORONAVIRUS WRAP-UP: PROPERTY AND CASUALTY (4/17/2020)

Auto Insurance
Stay-at-home Pandemic Orders Reduce Auto Claims Almost by Half
As Coronavirus Empties Streets, Speeders Hit the Gas
Business Interruption
UK Watchdog Orders Insurers to Pay Small Business Claims Quickly
Cannabis Insurance
Pandemic Could Shrink Cannabis Insurers’ Premiums, Market
Cyber Insurance
Preventing Losses Due to Growing Cyber Crime During Coronavirus Crisis
As Attacks Rise, Paladin Offers Cybersecurity Platform Free to Insurance Agencies
Disaster Preparedness
‘Uncharted Territory’ as Wildfire Fighting Adapts to Pandemic
Insurance-Linked Securities
Artemis Live: Interview with Tom Johansmeyer, Head of PCS
Litigation
Nashville Bar Sues Insurer Over COVID-19 Loss Claim. Experts Say It Won’t Be the Last
Businesses Warn Fear of Liability Lawsuits Could Stall Rebooting of Economy
P/C Industry Impact
Suddenly There is Big Demand for Pandemic Cover, Says Underwriter
Chubb CEO: Forcing Insurers to Pay Pandemic Loss Claims is ‘Plainly Unconstitutional’
Allianz CEO: Pandemic Hit “Like a Metororite”
From Hacker Attacks to Shareholder Lawsuits, Insurance Industry Braces for COVID-19 Fallout
Public Health and Safety
What FDA Says About Food Safety Amid COVID-19
Travel Insurance
Travelers Consider Their Risk Tolerance
HOLIDAY HELL How to Get a Refund on Your Holiday if it’s Cancelled and How Long Should it Take to Get Cash Back
Workers Compensation
Workers Compensation in Wake of COVID-19

From the Triple-I Blog:
INSURERS RESPOND TO COVID-19 (4/17/2020)
TRIPLE-I BRIEFING: SURPLUS IS KEY TO INSURERS KEEPING POLICYHOLDER PROMISES
PUTTING CAR INSURANCE PRICES INTO PERSPECTIVE

CORONAVIRUS WRAP-UP: PROPERTY AND CASUALTY (4/16/2020)

Legislation and regulation
Democrats Plan Legislation to Force Insurance Companies to Pay Out for Pandemic Losses
Thompson Introduces the Business Interruption Insurance Coverage Act
Lawmakers Advocate Stimulus Aid to Insurers on Business Interruption
SC Proposes Bill Over Coronavirus-related Business Interruption Claims
NJ offers grace period for insurance premium expenses
Coronavirus Regulations: A State-By-State Week In Review
Litigation
COVID-19, business interruption and bad faith litigation
P/C Industry Impact
No Evidence COVID-19 Industry Loss Will Match Large Catastrophe Years: Flandro
How Insurance Claims Pros Are Adjusting to Pandemic Complications
COVID-19 Response ‘Could Bankrupt the Insurance Industry’: Insurance Defense Lawyer
Coronavirus response: Short- and long-term actions for P&C insurers
Auto Insurance
Analysts: Auto Insurance Coronavirus Rebates a Solid Move in Short Term
Will Fewer Drivers on the Road Mean Lower Auto Losses? It Depends
Auto Insurers Offer Rebates as Traffic Abates During Pandemic
Business Interruption
Neglecting Idle Facilities Amid COVID-19 Will Cost Companies, Warns FM Global
Cyber
Working From Home? Don’t Let Cyber Criminals Break In
Hospital Hackers Seize Upon Coronavirus Pandemic
Workers Compensation
COVID-19 Comp Expansions Could Have Significant Impact on Industry

CORONAVIRUS WRAP-UP: PROPERTY AND CASUALTY (4/13/2020)

Auto Insurance
Car Insurance Refunds Become Standard Issue
State Farm Rolls Out $2 Billion Consumer Financial Relief Program
The Landscape Has Changed Dramatically’: Donelon Calls for Lower Car Insurance Rates
Business Interruption Insurance
COVID-19, Business Interruption Coverage, and the ‘Physical Loss or Damage’ Requirement
S.C. Bill Would up Pressure on Insurers to Cover Business Interruption
Insurers Can’t Cover Everything
With Hollywood on Hiatus, Studios Bracing for Fights With Insurers Over Coronavirus Losses
Proposed Backstop Would Cover Pandemic Business Interruption
Claims
Best’s Insurance Law Podcast Discusses Impact of COVID-19 on Claims
Coronavirus comp claims present challenges: Experts
Cyber
State-Backed Hackers Taking Advantage of Outbreak: Officials
The Line Between Biological and Cyber Threats Has Never Been So Thin
Hackathons Target Coronavirus
Impacts by Industry
Shifts in Manufacturing Create New Exposures: Experts
6 Critical COVID-19 Risks Facing the Health Care Industry
Tracking U.S. Small and Medium Business Sentiment During COVID-19
Pharmacy Workers Are Coming Down With COVID-19. But They Can’t Afford to Stop Working
6 Critical COVID-19 Risks for the Construction Industry