CISA urges ALL organizations across ALL sectors to follow guidance to address the widespread domestic and international exploitation of Microsoft Exchange Server product vulnerabilities; see CISA’s newly released web page for details. https://t.co/VwYqAKKUt6. #Cyber#InfoSec
The alarm about the ongoing hack of Microsoft Exchange Server, which began as early as January, appears quite justified. Microsoft believes a state-sponsored Chinese group called Hafnium orchestrated the attack that exploited flaws in Exchange software to gain access to email accounts and install unauthorized software, gaining full control of affected systems.
Hafnium primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks and NGOs, according to Microsoft.
In a tweet, the United States Cybersecurity and Infrastructure Security Agency (CISA) urged “ALL organizations” across “ALL sectors” to follow its guidance to address the email software’s vulnerabilities.
The number of U.S.-based organizations affected is estimated to be at least 30,000, while worldwide that number is close to 100,000. The vulnerability can be exploited to compromise networks, steal information, encrypt data for ransom, or even execute a destructive attack. CISA advises business leaders at all organizations to ask IT personnel to immediately address this incident or get third-party IT support.
A Hafnium attack should trigger any cyber insurance an organization has in place, according to Lockton, an insurance broker. Lockton recommends that organizations contact their insurer only if they discover that the vulnerabilities being exploited are present in the system. If an attack is underway, it should be reported to cyber insurers immediately.
Social inflation – increasing insurance claims costs related to legislative and litigation trends – may be spreading beyond the United States, attendees were told at a webinar with the Greenberg School of Risk Management of St. John’s Tobin College of Business.
The webinar, held on February 10, was aimed to help lawyers and claims professionals understand the phenomenon, which is characterized by claims costs rising faster than general economic inflation can explain.
Annette Hofmann, Ph.D., professor of actuarial science at the Maurice R. Greenberg School of Risk Management, Insurance and Actuarial Science, pointed out that “though it is largely a U.S. issue, there are signs of social inflation in other countries with potential for further international contagion, albeit not to the same degree as in the U.S.”
She added that the impact of social inflation in the U.S. has been most evident in commercial auto liability insurance.
“Litigation finance, societal attitudes toward corporations and large jury payouts are all behind the phenomenon,” according to James Lynch, Chief Actuary of Triple-I and one of the presenters.
In his presentation, Lynch showed how incurred losses in commercial auto liability have been climbing steeply since 2010.
Lynch said Triple-I studied the link between social inflation and trends in actuarial data (rising loss development factors) by focusing on long-tailed liability lines including Commercial Auto, Medical Malpractice and Other Liability.
He said actuaries look at the pattern of reported losses – the sum of claims experts’ estimates of every known loss. Even if the ultimate amount of claims rises or falls from year to year, the pattern of emergence should stay the same. That hypothesis is at the core of standard actuarial practices.
In this case, it is increasing.
One interesting offshoot of this work is that actuaries can also predict how much in losses will be reported in any 12-month period. The chart on the right shows how actuaries analyzing countrywide data have not been able to do this in commercial auto. And this is not just happening in auto, medical malpractice occurrence, and other liability are seeing the same effect.
Lynch went on to discuss some of the potential reasons behind large jury payouts. One explanation is the darker view of life that people have. Confidence in government has plummeted, incomes and life expectancy have declined, and Google Trends indicates that searches for the word “dystopia” have increased by over 400 percent from 2005 to 2020.
In the meantime, Lynch and another presenter, Julie Campanini of Magna Legal Services, noted that huge amounts of money have been normalized by billion-dollar lottery jackpots, sky-high celebrity net-worth, and news reports of “nuclear” awards verdicts.
Other speakers included:
Jonathan E. Meer, partner at Wilson Elser, who spoke about the state of tort reform.
Jeff Cordray, a vice president and economist at Christensen Associates, who discussed the importance of determining economic damages, particularly when there is a potential for punitive damages in a case.
The vast majority of Americans believe COVID-19 relief should come via public policy solutions — and not litigation — according to polling released last week by the American Tort Reform Association (ATRA).
Key takeaways from the poll include:
59% say those harmed by the pandemic should get assistance from policies passed by elected officials, versus just 7% who say they should get payouts from lawsuits;
74% say small businesses affected by COVID-19 should be supported by government grants or loans versus 6% who say lawyers should help small businesses pursue legal claims.
Source: ATRA
More information on the polling results is available on ATRA’s website.
For information on the principles the broader insurance industry has put forth for a government-backed pandemic policy solution, click here
Insurance is a business that promotes and demands resilience, and 2020 was a year-long case study in our industry’s ability to respond rapidly to new challenges from a firm financial foundation. Triple-I’s virtual Joint Industry Forum (JIF) provided many examples from a range of industry and academic leaders, along with insightful discussions about what the industry faces in the near and longer terms.
At the 2020 JIF in New York City, it was clear from our various panels that the industry had a full plate of priorities for the year ahead. Then came COVID-19, and a whole new set of public health and economic concerns was added to the existing exposure mix. The virus brought a strong economy nearly to a halt; while officials assessed and responded to these threats, civil unrest on a scale not seen since the 1990s broke out on the streets of many cities; historic and near-historic weather and wildfire activity descended on communities whose resources were already strained by the pandemic.
And all of the above took place amid the uncertainty created by the most contentious, chaotic election year in modern U.S. history.
Through it all, as this year’s JIF speakers described, the property/casualty insurance industry managed to shine.
“Look at how our companies performed” in the real-time shift to fully remote work, noted Chuck Chamness, President and CEO of the National Association of Mutual Insurance Companies (NAMIC). “Then look at the dynamic changes in our businesses caused in large part by the pandemic, where we gave back $14 billion in premiums to policyholders and contributed a couple of hundred million dollars-plus in charitable contributions. We really did our job this year.”
David Sampson, American Property Casualty Insurance Association (APCIA) President and CEO, added that the “bulk of the industry came together to proactively work with agents and policymakers to create a solution that could work for all stakeholders to provide protection against widespread economic shutdown as a result of a viral outbreak.”
APCIA, NAMIC, and Independent Insurance Agents and Brokers of America proposed to Congress a Business Continuity Protection Plan (BCPP) that would allow businesses to buy revenue-replacement coverage for up to 80 percent of payroll and other expenses in the event of a pandemic through state-regulated insurance entities, with aid coming from the Federal Emergency Management Agency (FEMA), which would run the program.
Our industry also faced a literal existential threat in the form of efforts to require insurers to pay billions in business income (interruption) claims for which not one penny of premium had ever been paid. Thanks to industry leaders stepping up to educate policymakers and the media, much of this threat – though, by no means all of it – seems to have faded. Triple-I’s Future of American Insurance & Reinsurance (FAIR) campaign played a critical role in informing policy discussions on business interruption coverage, the uninsurability of pandemic risk, and the need for federal involvement to mitigate the financial impact of future pandemics.
Throughout this year’s virtual JIF, the emphasis on innovation is a consistent thread. Peter Miller, President and CEO of The Institutes, observed that the pandemic and its attendant operational and economic stresses forced the industry into innovation overdrive. He cited a member of The Institutes’ board saying 2020 “caused them to do 10 years of innovation in one,” adding that board members have told him work-from-home alone has saved their companies “one hundred-plus million dollars a year.”
Whether discussing the industry’s response to climate change and extreme weather or how to communicate the importance of risk-based pricing to policymakers, innovation is at the heart of solving every challenge (and seizing every opportunity) our industry faces. Peter emphasized the importance of using innovation strategically across the entire value chain – not just to solve specific problems as they emerge.
In addition to the panelists I mentioned above, the conversations featured a cross section of industry leaders, Triple-I subject-matter experts and non-resident scholars. If you weren’t able to attend, you can view and watch the panels here.
Dimitri Mikhaylov working the front register at Chelsea Bagel of Tudor City
By Kris Maccini, Social Media Director, Triple-I
In support of Small Business Saturday, November 28, the Insurance Information Institute spotlights Chelsea Bagel, a business that has stayed resilient during the pandemic.
Deciding on your local bagel shop is a quintessential part of becoming a New Yorker. I’ve made this city my home for the past 17 years now, and it’s the first thing I do every time I move into a new neighborhood. About four years ago, I made Midtown East, Manhattan my home, and it didn’t take long for Chelsea Bagel of Tudor City to become my go-to shop.
Chelsea Bagel of Tudor City is owned by Dimitri Mikhaylov. He opened the shop and its sister restaurant, Chelsea Bagel & Café , along with his brother in 2015. Owning his own bagel shop became a dream after Dimitri invested in another coffee shop a few years prior. Never did he imagine just five years later, the world would be in a global pandemic.
The bagel and spread counter at Chelsea Bagel of Tudor City
“Prior to the pandemic, we were doing fine covering expenses. We had a steady flow of regular customers and high traffic from tourists. Facing the pandemic and this tough economy has been one of our biggest challenges,” says Dimitri.
In the early days of the pandemic, Dimitri had to make some difficult decisions to keep his doors open. He made reductions in staff, changed hours of operation, and withheld his own paycheck in order to pay his employees.
“The first four weeks of the pandemic, I spent a lot of my own money to meet business expenses, and I didn’t pay myself for 10 weeks,” he says. “My wife and I also had to make the decision to postpone our home mortgage for six months in order to pay for the business.”
“During that time, I thought that my business interruption insurance would have been able to help cover our losses, but after contacting my insurer, I realized pandemics are not covered. The next step was to apply for a government PPP loan.”
The small business PPP loan allowed Dimitri both to cover his expenses and hire back some staff. Since the summer, business has picked up, and he’s slowly welcoming back his regulars. There has been a 25% increase in customers in recent months compared to the start of the pandemic where business decreased by 75%.
In addition to the PPP loan, Dimitri advises that small business owners really look at their expenses to see where they can cut off spending. At the height of the pandemic, he chose to do all the buying himself, which drastically cut down the cost of goods for his shop.
“I’m hoping that the economy returns and brings customers back,” Dimitri says. “This area [New York City] relies on tourists.”
“It crossed my mind not once but many times to give up the business during all this, but hope kept me going. I have a family to feed and my employees have families to feed.”
That the insurance industry alone can’t be expected to cover future pandemic risk seemed to be a given at yesterday’s hearings by the House Finance Subcommittee on Housing, Community Development, and Insurance.
But, as is so often the case, the devil is in the details.
The session – Insuring Against a Pandemic: Challenges and Solutions for Policyholders and Insurers – was chaired by Rep. William Lacy Clay. In his opening statement, Clay said, “It is not realistic or practical to expect the insurance industry to shoulder the astronomical cost of a global pandemic. The American Property and Casualty Insurance Association has estimated that paying all [COVID-19-related] claims, regardless of exclusions, would amount to $1 trillion per month.”
With respect to business interruption coverage claims currently being adjudicated, Clay referenced both the virus exclusions in most commercial property policies and the lack of “direct physical damage or loss” in COVID-19-related cases.
John Doyle, president and CEO of global insurance broker Marsh, testified on the importance of a public-private partnership to address pandemic risk, as well as to the need to “act now” on a solution for future pandemics.
“Acting now on a public-private pandemic risk solution will accelerate the economic recovery by reducing uncertainty,” Doyle said. “Moving forward, capital markets will seek assurances that companies have protection against prospective pandemic risk. The pace of recovery will depend upon the nature and degree of confidence in the marketplace.”
Doyle said the credit and power of the U.S. government is essential – “at the same time, I believe the insurance industry has a role to play.”
The Pandemic Risk Insurance Act (PRIA), introduced by Rep. Carolyn B. Maloney of New York, provided the jumping-off point for the testimonies and discussions of alternative proposals. PRIA, patterned after the Terrorism Risk Insurance Act (TRIA) put in place after the 9/11 terrorist attacks, was generally recognized as a good start – but several other structures were proposed to address perceived weaknesses.
One is the Business Continuity Protection Program (BCCP), advanced by the National Association of Mutual Insurance Companies (NAMIC), the American Property Casualty Insurance Association (APCIA) and the Independent Insurance Agents & Brokers of America (Big “I”).
Brian Kuhlmann, chief corporate counsel for Shelter Insurance, speaking on behalf of NAMIC and APCIA, described BCCP as a program that “would provide straightforward revenue replacement for businesses and nonprofits of all sizes” using a parametric approach that wouldn’t require claims adjustment. Unlike traditional insurance, which pays for damage if it occurs, parametric insurance automatically pays when specific conditions are met – regardless of damage incurred.
Michelle Melendez McLaughlin, chief underwriting officer for the small commercial and middle market at Chubb, presented a “bifurcated” framework that would treat small businesses differently from mid-size to large corporations.
“Pandemics affect small and large businesses differently,” she said. The Chubb framework would cover small companies for up to three months of payroll and other expenses. Policyholders would be paid a pre-determined amount when the policy is triggered. “This provides policyholders with certainty that they will receive timely financial assistance after an event.”
For businesses with more than 500 employees, the Chubb proposal would create Pan Re – a federal reinsurance facility. “Private insurance companies that choose to sell coverage would write pandemic policies at market terms and retain some portion of the risk. The rest of the risk would be reinsured through Pan Re.”
R.J. Lehmann, senior fellow at the International Center for Law and Economics, agreed with other witnesses that the insurance industry isn’t equipped to handle pandemic risk alone. He went further to question whether insurance is the best structure for addressing this problem.
“Insurance is a system of risk transfer, not a system of economic relief,” Lehmann testified. “Even if private insurers could provide this coverage—on their own or with government support—it is not clear their incentives would align with public health goals or with the aims members of Congress likely have in mind.”
The best argument for a public-private partnership, he said, is that insurers can help policyholders mitigate risks. “But it’s important to ask, ‘Mitigate the risk of what’? The risk you’re trying to reduce is the risk that a business will shut down. But, in a pandemic, you want businesses to shut down. We want them to have a safety net so they can shut down and survive.”
Hartmann counseled legislators to take their time and get the solution right, drawing from all the options that exist.
“Let’s be humble about how little we know, even about the current pandemic,” he said. “Get help to the businesses, workers, and communities who need it now. Don’t legislate for the next pandemic while we’re in the midst of the current one.”
By Sean Kevelighan, CEO, Insurance Information Institute
Sean Kevelighan
Insurers have responded quickly and effectively to 2020’s extraordinary volume of hurricanes, wildfires, and civil unrest. These events are resulting cumulatively in billions of dollars in insured claim payouts.
Yet a recent Forbes article stated that the owners of one of the largest Broadway theater chains were “shocked to learn that its insurance companies would not cover most of its losses during the COVID-19 pandemic.”
Making people more prepared and resilient is our fundamental goal at the Insurance Information Institute (Triple-I). We seek every opportunity to educate customers about how their insurance works before they suffer an insured loss. Part of this mission is to explain how pandemics are uninsurable. That’s because, unlike covered events, which are limited in time and geography, pandemics simultaneously affect everybody. This is something we’ve explained in briefings to legislators, legal experts and consumer and trade media.
Still, while insurers, regulators and the U.S. government work to deliver relief to business financially affected by future pandemics, we need to stay focused on the present. And to do this, we need to take a quick look into the past:
Insurance has been around for 350 years as a way for households, businesses and communities to recover and rebound after wildfires, hurricanes and other catastrophes. Time and again insurers have been there for their customers because that’s what they do. For example, in the months after 9/11, insurers paid out tens of billions of dollars to keep affected businesses afloat while New York and Washington, DC rebuilt from the rubble.
In 2020, insurers continue to perform their vital societal role, covering insured losses from record hurricane and wildfire seasons, as well as the most destructive civil demonstrations in more than a quarter-century. Insurance simplifies a rather complex risk management process and creates products that deliver simpler ways for people to be more prepared and resilient. Covering these hazards demands immense capital resources.
Questions? Your Policy Documents Have the Answers
Insurance is heavily regulated, and as the Triple-I reaffirmed at September’s annual summit of the National Association of Insurance Commissioners (NAIC), the industry we represent relies on a strong working partnership with regulators and government agencies across America to help make insurance work better for everybody.
One of the tangible results of this partnership is something that anybody can literally hold in their hands: insurance policy documents. Reading these documents to understand what you’re purchasing is an essential part of preparedness.
Business income (interruption) or BI insurance losses caused by a pandemic are not covered because direct physical damage, such as that caused by a hurricane or a fire, is what triggers a standard BI policy. As many courts and academics around the country have stated, neither a virus nor bacteria leads to the direct physical damage of a business’s structure. This contract language is well-established; moreover, every policy is approved by individual states before they are issued to BI policy holders.
We view it as a success when nobody is shocked by what’s covered, and what’s not, under their insurance policies. This is why the Triple-I regularly urges business owners to become familiar with their insurance documents and have regular conversations with their agent or broker to discuss anything they don’t understand.
In an age when we’re all accustomed to just clicking the “terms and conditions” box, ignoring agreements, paradoxically, has become something everybody can agree with. Social scientists consider this to be a form of cognitive dissonance: We know we should read our insurance policies, and yet few of us do. This is a behavioral pattern we’re all guilty of and the Triple-I understands there are many demands on a customer’s time.
Which brings us back to an essential point, that insurance companies prioritize their efforts and resources into making sure that everybody knows about the coverage they have and need.
Pandemics are uninsurable because insurers don’t collect premiums to cover business losses due to viruses and other pathogens. There are products available for this purpose, but an overwhelming majority of businesses decline to purchase them. These exclusions and the availability of pandemic insurance is a fact well known by many experienced professionals—notably risk managers and trial attorneys. The Triple-I is willing to work with anybody to make the public better aware of the risks and how to prepare for them.
The next pandemic surely will come. How insurers, their customers, and the federal government respond now will ensure our resources and energies are devoted to saving lives from all the threats the U.S. faces.
By John Miklus, President, American Institute of Marine Underwriters (AIMU)
While it’s not a panacea, a vaccine for COVID-19 is expected to go a long way toward reducing the number of cases and slowing transmission of the virus. Development and testing is moving at a frenetic pace, meaning that in the not too distant future a fully-approved vaccine will need to be shipped in unprecedented volumes.
Experts predict it will take anywhere from 8,000 to 15,000 fully loaded flights to transport 20 billion doses around the world. While air is often the preferred method for shipping pharmaceuticals because of time sensitivity, it’s likely that large ocean transport companies will take on some of the load.
Once a COVID-19 vaccine is approved and manufactured, cargo insurance will be imperative to ensure speedy and safe distribution. Insurance coverage for pharma products, which encompass vaccines, is widely available and written by a number of AIMU’s member companies.
When one considers the infrastructure required to ship billions of doses from manufacturing facilities to hospitals and clinics around the world, this could be one of the biggest logistical challenges in modern history. Pharma shipments such as vaccines present a number of unique underwriting challenges, including:
High valuations: According to one industry analyst, the market for COVID vaccines is estimated at $100 billion, with $40 billion in profits. Shipping companies will handle a lot of valuable inventory and pharmaceutical companies have a lot at stake. A single shipment could be valued into the millions of dollars.
Time and temperature sensitivities: Vaccines currently under development require precise handling. Some need to be stored at temperatures as low as -80C (-112F), which will require special refrigerated containers, along with rigorous temperature monitoring and quality control.
Careful packaging and handling requirements: The vaccine will require special packaging such as cold-resistant vials and boxes to hold multiple vials. Dry ice may be required, along with syringes and protective equipment for healthcare workers administering the vaccine. Besides pharmas, the vendors who supply these products will also have skin in the game.
High theft exposure: Pharma companies plan to use everything from GPS to track their product to fake shipments to confuse criminals. One glassmaker plans to use black-light verification to prevent counterfeiting. Since the start of the pandemic, tests, masks and other gear have gone missing, so it’s not a stretch to think professional thieves and cargo theft gangs will want to get their hands on a precious and valuable vaccine.
The involvement of experienced loss prevention experts is vital to provide advice on proper packaging, proper handling and storage, setting standards and procedures for transportation providers, and recommending security measures to ensure safe delivery. AIMU member companies believe in the old saying that the best loss scenario is preventing one from ever occurring.
A North Carolina court has ruled that Cincinnati Insurance Co. must pay 16 restaurants’ claims for business income (interruption) losses due to government-ordered COVID-19 shutdowns – a decision that runs counter to those of most judges who’ve ruled on similar cases.
As hundreds of COVID-19-related lawsuits regarding business interruption coverage make their way through U.S. courts, judge after judge has found in favor of insurer defendants. The central point has been that coverage depends – as specified in the insurance policies – on the policyholder suffering a “direct physical loss.”
“Business income (interruption) policies generally reimburse a business owner for lost profits and continuing fixed expenses when its facilities are closed due to direct physical damage from a covered loss, such as a fire, a riot, or a windstorm,” said Triple-I CEO Sean Kevelighan. “Insurers have been prevailing nationwide in nearly all of the litigated COVID-19 BI lawsuits because, as North Carolina’s Insurance Commissioner has noted, ‘Standard business interruption policies are not designed to provide coverage for viruses, diseases, or pandemic-related losses because of the magnitude of the potential losses.’ ”
“Policy language controls whether COVID-19 interruptions are covered,” said Michael Menapace, a professor of insurance law at Quinnipiac University School of Law and a Triple-I Non-Resident Scholar. “The threshold issue will be whether the insureds can prove their business losses are caused by ‘physical damage to property’.”
Cincinnati Insurance has said it plans to appeal the ruling.
By Loretta Worters, Vice President, Media Relations, Triple-I
Advanced Persistent Threat groups and cybercriminals are likely to continue to exploit the COVID-19 pandemic over the coming weeks and months. Weak and stolen passwords, back doors, applications vulnerabilities, malware and insider threats have been among the most common causes of data breaches in the past. But according to a recent Willis Towers Watson reportnew threats include:
Phishing, using the subject of coronavirus or COVID-19 as a lure;
Malware distribution, using coronavirus or COVID-19-themed lures;
Registration of new domain names containing wording related to coronavirus or COVID-19; and
Attacks against newly and often rapidly deployed remote access and teleworking infrastructure.
Security breaches have increased by 67% since 2014, yet businesses fail to take the proper precautions. Ransomware has become big business for “professional” criminals, crippling large and small businesses alike. But small businesses are especially attractive targets because they have information that cybercriminals want, and they typically lack the security infrastructure of larger businesses.
A remote workforce due to COVID-19 has made many organizations address issues of remote access and the need for multifactor authentication and virtual private networks (VPNs). But others – less cyber savvy— have left themselves exposed to cyberattacks.
In addition, vishing (via telephone) and smishing (via text message or WhatsApp) attacks have also increased in frequency, and in a work from home environment where colleagues and clients are increasingly connecting via mobile phones, vulnerability increases, according to a new AON Report. Short message attacks will generally seek to redirect a victim to a compromised website in order to harvest user credentials.
According to a recent survey by the Small Business Administration , 88% of small business owners felt their business was vulnerable to a cyber-attack – and that was before the pandemic. Yet many businesses can’t afford professional IT solutions, have limited time to devote to cybersecurity, or don’t know where to begin.
In observance of National Cybersecurity Awareness Month, Triple-I offers U.S. businesses these seven tips for improving their cybersecurity and averting data breaches:
Understand yourcyber risks. Businesses are vulnerable to cyberattacks through hacking, phishing, malware, and other methods.
Train Staff. Those engaged in cyberattacks find a point of entry into a business’ systems and network. A business’ exposure can be reduced by having and enforcing a computer password policy for its employees.
Keep Software Updated. Businesses should routinely check and upgrade the major software they use.
Create back-up files and store off-site. A business’ files should be backed up either as an external hard drive or on a separate cloud account. Taking these steps are vital to data recovery and the prevention of ransomware. Ransomware is when a cyberattack results in a situation where a business is asked to pay a fee to regain access to its own data.
