Category Archives: Business Risk
Coronavirus Wrap-up: Property and Casualty (4/8/2020)
An article in Claims Journal: Anticipated Coronavirus Claims Scenarios Across Major Coverage Lines discusses the wide range of insurance lines in which claims could rise, whether as a direct result of the pandemic or of social, institutional, and governmental reactions to it.
The Financial Times reports on two shareholder lawsuits relating to coronavirus that have already been launched in the United States, one against Norwegian Cruise Lines, the other against a pharmaceutical company called Inovio.
And, in a new publication, Allianz Global Corporate and Specialty (AGCS), Coronavirus: Safety Measures for Businesses Forced to Temporarily Close Their Premises, AGCS experts provide an overview of general security and prevention measures to help avoid physical damages.
An NBC6 (Miami) report highlights actions that some major insurers are taking to provide relief to their customers who are facing financial difficulties due to the coronavirus pandemic. Said Sean Kevelighan, CEO of Triple-I, “In the insurance community, we refer to ourselves often as financial first responders and you’re really starting to see that kick in right now.” Some companies are allowing customers to delay payments without penalties or initiate a personal payment plan. A few are offering relief in the form of paybacks to customers.
Other recent articles related to coronavirus from a property and casualty insurance perspective:
Auto
A New York Daily News article describes the rebates auto Insurers are offering to their customers due to coronavirus-induced driving lull. Liberty Mutual, American Family and Allstate are among the companies offering refunds.
Triple-I’s CEO Sean Kevelighan was quoted in a Los Angeles Times column and appeared in a Miami NBC affiliate segment about economic relief for drivers.
A Winknews report discusses the assistance available to customers during the coronavirus pandemic and includes an anecdote from a policyholder who was told by his insurer that he couldn’t get an extension. Triple-I’s Mark Friedlander says this customer’s experience is not the norm.
Business Interruption
Triple-I CEO Sean Kevelighan was quoted in Washington Examiner and Santa Rosa, Calif. Press Democrat articles on business interruption coverage.
Artemis published this interview with PCS’s Tom Johansmeyer on silent pandemic risk.
The Financial Times reported on the growing controversy over how much companies can claim from their business interruption insurance policies related to the coronavirus pandemic.
Cyberrisk
Cyber Perspectives on Coronavirus – Audio panel on the PLUS Blog
The National Insurance Crime Bureau (NICB) and the Cybercrime Support Network (CSN) announced they are partnering to educate online users about scams surrounding COVID-19, and what consumers need to watch out for when surfing the web, working online, or e-learning from home. NICB and Cybercrime Support Network Partner to Warn the Public About COVID-19 Scams
Additional resources:
- Cybercrime Support Network Scam Alerts
- NICB ID Theft Brochure
- ID Theft Infographic
- FraudSupport.org
- FBI Urges Vigilance During COVID-19 Pandemic
- FTC: Coronavirus Scams
Flood
As local, state and federal agencies scramble to react to the public health needs of COVID-19, cities and towns must also keep one eye on the weather forecast and river levels, according to this Chicago Tribune article.
Workers Compensation
The Minnesota Legislature passed a workers’ compensation bill Tuesday to cover first responders, health care workers and daycare workers. The legislation is effective April 8 and is in place until May 1. Minnesota to Ensure Workers Comp to Responders With COVID-19
Triple-I’s Daily newsletter covered many of the preceding stories this morning. To subscribe to the Triple-I Daily contact daily@iii.org.
Triple-I: Insurers Offer Solutions For COVID-19 Recovery
U.S. insurers are meeting the challenges faced by their customers, communities, and employees amid the COVID-19 crisis, according to a fact sheet released April 3 by the Insurance Information Institute (Triple-I).
“The nation’s insurers continue to work actively on immediate and forward-looking solutions that will assist its customers and communities in recovering from COVID-19,” said Sean Kevelighan, CEO, Triple-I.
The fact sheet, Insurers Offer Forward-Looking Solutions for COVID-19 Recovery, outlines how the industry is easing its customers’ financial burdens, working with government to create a COVID-19 Recovery Fund, and making sure it has the resources to pay future claims from events such as hurricanes, tornadoes, and wildfires.
Immediate Customer Solutions: Insurers are offering payment relief and extending coverage to customers who are in financial distress while at the same time keeping its employees on the job to serve these same customers, the Triple-I notes.
Government-Backed Solutions: Trade groups representing insurers have voiced support for the proposed COVID-19 Business and Employee Continuity and Recovery Fund. It would be financed by the federal government and provide essential funds to impacted employers and employees.
Facing Challenges Head-On: Workers compensation insurers in multiple states are covering the healthcare workers and first responders who face exposure to COVID-19 while auto, home, and business insurers are setting aside the resources needed to pay the claims arising out of future natural disasters even as insurer investment portfolios have faced their own headwinds. A Triple-I non-resident scholar predicted yesterday the likelihood of an ‘above-normal’ Atlantic hurricane season.
Insurers have also contributed financially to food banks and organizations providing medical supplies.
RELATED LINKS:
Triple-I Presentation: The Impact of COVID-19 On P/C Insurance
Triple-I Publication: A Firm Foundation: How Insurance Supports the Economy
Triple-I Blog:
COVID-19 coverage
Proper decontamination before and after coronavirus exposure is crucial
While insurance policies might not cover the mitigation or cleanup costs related to commercial facility exposure to the coronavirus, preserving a healthy and safe place of business remains a critical risk management issue.
As the coronavirus (COVID-19) continues to spread rapidly around the world, it’s important to know what to do if someone carrying the highly contagious virus comes in contact with any of your facilities or those of your customers. Even the potential of your business premises being exposed to COVID-19 can create a possible need to engage risk mitigation efforts. Understanding the importance of utilizing a professional, credentialed decontamination contractor both before and after facility exposure is crucial to protecting your business.
“COVID-19 has presented new challenges for businesses around the world, and it’s necessary to understand the importance of ensuring the safety of all employees and customers,” said Larry Thomas, global president of Crawford Specialty Solutions, a division of Crawford & Company that includes Contractor Connection. Contractor Connection, an industry leader in managed repair services, provides insurance carriers, brokers and consumers a global network of more than 6,000 contractors vetted and managed for performance in residential and commercial work, including specialists in technical areas like cleanup after a biological event.
“Experts have warned that we have just begun to feel the impact of the virus in the U.S., and it is expected to continue to affect lives for the foreseeable future.”
With that in mind, it’s essential you ensure you are utilizing a decontamination contractor who is rigorously vetted, held to the highest standards, and professionally equipped to restore affected sites through proper remediation and containment procedures. Here are some best practices for how to approach this critical work while reducing risk for you and your customers.
Prevention protects you, your customers and others
Prevention is the first step toward reducing exposure to the virus. Even before an incident occurs, a decontamination contractor can work with your business to provide cleaning and disinfecting services designed to reduce the opportunity for infection and keep facilities operating longer. When administered by a trusted, licensed and insured provider, preventative cleaning provides a cleaner, safer work environment and enhances employee and customer satisfaction.
Decontamination services limit business interruption
If you or your customers’ facilities are exposed to coronavirus, legitimate decontamination services using proper techniques, equipment and materials, and following CDC, state and local protocols should be employed to restore your places of business back to operation as quickly as possible, limiting business interruption. Time is critical, so you should engage with a service that provides 24/7 assignment processing and emergency response.
“Providing access to a rapid-response decontamination service can help reduce the potential impact of contamination in the workplace and return the environment to full operational status as quickly as possible,” said Lance Malcolm, U.S. president of Contractor Connection. “The focus must be on helping companies limit business interruptions and ensure that the affected facilities are completely safe for those who use them.”
Safe biohazard waste disposal reduces future risk of exposure
As part of decontamination services, it’s also important to utilize contractors trained to handle and properly dispose of biohazard waste, safely removing any affected materials from the facility. Services that provide quality assurance review and project monitoring ensure speedy completion and provide peace of mind knowing exposure to the virus has been properly reduced or eliminated.
Business Interruption Claims Related to COVID-19
By Michael Menapace, Esq.
The COVID-19 pandemic is unprecedented in many ways. The human toll is first and foremost on our minds (as it should be), but as an insurance professional, I’ll stay in my lane and address one of the economic impacts – business interruption.
Businesses Looking to Mitigate Losses
Among the ways in which we are in uncharted territory is the scale of how businesses are impacted. Unsurprisingly, in reaction to slow-downs and shut-downs in many business sectors, businesses are looking for ways to mitigate their losses or recover lost revenue. One avenue that businesses are exploring is the availability of business interruption coverage under their property insurance policies. Other potential claims include communicable disease coverage found in some policies purchased by hotels or event cancellation insurance, but those claims are beyond the scope of this article.
Property insurance was designed originally to cover fire losses and similar losses of physical property following the Great London Fire of 1666. Of course, property policies have evolved since then to cover additional risks including, in many instances, business interruption losses caused by physical damage to property. A property policy may, for example, pay to repair the damage caused by a fire and may cover the loss of business during the reconstruction period. But here’s the rub. Are the business interruptions related to COVID-19 caused by physical damage to property?
Policy Language Will Control
The language of an insured’s policy will control whether COVID-19 interruptions are covered. Unfortunately, much of the media commentary on business interruption claims related to COVID-19 has inappropriately treated all insurance policies as though they are identical. Policyholders have a wide array of different policies they can purchase. For example, some policyholders have purchased an ISO Businessowners Policy (BOP) with standard terms and exclusions, others have purchased all-risk policies, and others have purchased a variation of these types.
This commentary does not try to provide sweeping pronouncements or give the impression that a single outcome will apply equally to all situations. Instead, the following is a starting point for a more detailed analysis under individual circumstances. Details matter and the analysis for a particular claim must start with the policy terms and facts specific to that policyholder.
Is Coverage Triggered?
There have already been a handful of lawsuits filed related to business interruption claims, some of which suits were filed before the insurers even denied a claim. For example, the Oceana suit filed by a restaurant in NOLA and a suit filed by chef Thomas Keller, owner of The French Laundry in California. Also, a group of tribal nations that own casinos filed a lawsuit in Oklahoma and the owner of a restaurant/movie chain filed suit in Illinois. Policyholders in these lawsuits are seeking a ruling that they are entitled to coverage for losses sustained during their current shutdowns. A review of the policies at issues underscores the point made above – the outcomes in these suits and others may not all be the same because different policies are at issue.
Nonetheless, there are some overall issues to consider. While the scope of business shutdowns is unprecedented, we do have similar experiences as a guide, albeit on a smaller scale, that may indicate how the current COVID-19 business interruption claims may play out.
The threshold issue will be whether the insureds can prove that their business losses are caused by “physical damage to property,” which is the standard language in many business interruption policies. While the concept of causation focuses on assigning blame for an accident in some legal contexts, it is important to realize that in the insurance context the issue of causation is different.
In insurance, the concept of causation addresses whether a particular loss triggers coverage, not who is responsible for causing the loss. In this regard, we can replace the word “causation” with “trigger.” So, the question with the COVID-19 losses becomes, can these policyholders prove that their business interruption losses were triggered by physical damage to property akin to the fire loss damage mentioned above?
Past Experience
A series of cases from Minnesota demonstrates how the COVID-19 business interruption claims might be resolved.
Where there is direct physical loss to property, such as contaminated oats that could not be sold or a building rendered useless because of asbestos contamination, the courts have found that business interruption coverage was triggered. That is, these losses fit the definition of direct physical loss to property. General Mills, Inc. v. Gold Medal Ins. Co., 622 N.W. 2d 147 (Minn. Ct. App. 2001); Sentinel Mgmt. Co. v. New Hampshire Ins. Co., 563 N.W. 2d 296, 300 (Minn. Ct. App. 1997).
But, where an earthquake caused a power loss in two Taiwanese factories, and as a result, those factories could not supply products to the Minnesota insured, the court found that the outages caused no injury to the Taiwanese factories other than a shutdown of manufacturing operations, and that this did not constitute “direct physical loss or damage.” Pentair, Inc. v. Am. Guar. & Liab. Ins. Co., 400. F.3d 613 (8th Cir. 2005).
More recently, a federal appellate court considered a claim related to mad cow disease. Source Food was a company that sold products containing beef tallow. The USDA prohibited the importation of the tallow from Canada in 2003 after a cow in Canada tested positive for mad cow disease. The border was closed to Source Food’s sole supplier of beef product in Canada. There was no evidence that the beef product specifically destined for Source Foods was contaminated by mad cow disease, but after the border was closed to the importation of beef products, Source Food was unable to fill orders and lost business as a result. Source Food submitted a business interruption claim. It argued that the closing of the border caused direct physical loss to its beef product because the beef product was treated as though it were physically contaminated by mad cow disease and lost its function. But, the court held that to characterize Source Food’s inability to transport its truckload of beef product across the border and sell the beef product in the United States as direct physical loss to property would render the word “physical” meaningless. Additionally, the policy’s use of the word “to” in the term “direct physical loss to property” was significant. The court explained that the policy did not cover loss “of” property, it covered loss “to” property. As a result, the cause of Source Food’s business interruption was the government shutdown of the border, not direct physical loss to its property. Source Food Tech., Inc. v. U.S. Fid. & Guar. Co., 465 F.3d 834 (8th Cir. 2006).
What About the Current Claims?
Here, are the business interruptions related to COVID-19 the direct result of the government restrictions on businesses or are they due to the physical loss to their property? Under the reasoning of the Source Food case, much of the current business interruption claims would seem not to trigger the standard business interruption coverage in a commercial business interruption policy or BOP. As cautioned above, this is not a universal outcome under all policies. For example, an all-risk policy would generally not distinguish between business interruption losses due to government action or direct physical loss because all-risk policies cover all losses except those specifically excluded. While it is possible that an all-risk policy could specifically exclude losses due to civil authority orders, that is not a standard exclusion in all-risk policies.
With regard to business interruption policy exclusions, there are exclusions to consider even if a policyholder can meet its burden to trigger coverage under the standard business interruption policy. For example, some policies have an exclusion that precludes coverage for losses that result from mold, fungi or bacteria. However, because COVID-19 is a virus, that exclusion may not apply. But, other policies have exclusions for viruses, diseases or pandemics. That type of exclusion appears problematic for policyholders, even those who satisfy the initial question of causation/trigger.
The result may not be all-or-nothing. Might claims be partially covered? It is possible. For example, if a restaurant were shut down because it had been contaminated by COVID-19 and needed to be cleaned and closed for a two-week period to ensure no lingering virus remained, that period of shutdown might be considered direct loss to property even though the shut-down period after the cleaning period was not covered because the following shutdown period was attributable to a government order. Likewise, there may be a different analysis applied to some business interruption claims that result from supply chain impacts. However, claims related to supply chain disruptions are beyond the scope of this article.
Legislation and Duties of Insureds
It is notable that legislators in several states recently proposed bills that would retroactively void the exclusions that would apply to COVID-19 business interruption claims. Although well-intentioned, these bills are deeply troubling because, among other things, they could severely impact the financial stability of the insurance market, which took in premiums based on such claims being excluded. And, because the legislation would not help the 60 percent of businesses that do not purchase business interruption coverage, the risk of crippling the insurance market is even more questionable. Moreover, these bills would address only the exclusions and do nothing to impact the initial question of whether policyholders can trigger coverage.
Nevertheless, if a policyholder believes it may have a claim under its insurance policy(ies), it should provide prompt notice to its insurer(s) so that it does not risk a denial based on late notice. Likewise, once the claim has been made, it is essential that the insured cooperate with the insurer, including providing timely proof of loss.
Michael Menapace is a Triple-I Non-Resident Scholar, a partner at Wiggin and Dana LLP, and a professor of Insurance Law at the Quinnipiac University School of Law.
Battle Plays OutOver Coronavirusand Business Insurance
The Financial Times reports that U.S. lawmakers and lawyers are considering efforts to force insurance companies to pay claims related to the coronavirus pandemic. Congress also is debating the need for legislation to require insurers to cover costs from business interruption caused by the pandemic. U.S. insurers contend that their business interruption policies exclude coverage for pandemics and that making such coverage retroactive would cause the industry to collapse. Joseph Wayland, general counsel for the U.S. insurer Chubb, said the losses would overwhelm insurers’ ability to pay and that forcing these companies to take responsibility for risks they never underwrote nor charged for represented an existential threat. Bruce Carnegie-Brown, chair of Lloyd’s of London, agreed that such a revision to insurance contracts would jeopardize the industry.
A Wall Street Journal editorial argues that forcing costs of the economic disruption caused by the coronavirus pandemic upon insurers would cause long-term economic damage unless a federal backstop is put in place. The editorial says if business interruption insurance “can be stretched and exclusions nullified during a crisis” insurers will conclude that such coverage is not worth the risk and will drop the product.
Triple-I: Insurers are engaged in COVID-19 crisis
A Triple-I Fact Sheet, Insurers Are Engaged In the COVID-19 Crisis, outlines how the industry’s financial stability allows insurers to keep the promises made to policyholders in the event of tornadoes, hurricanes, or wildfires. It also notes how insurers are contributing to COVID-19 related charities, such as food banks and medical supplies.
“Pandemics are an extraordinary catastrophe that can impact nearly every economy in the world, so it is hard to predict and manage the risk,” said Sean Kevelighan, Triple-I CEO. “Pandemic-caused losses are excluded from standard business interruption policies because they impact all businesses, all at the same time.”
APCIA on how insurers are helping customers
David A. Sampson, president and CEO of the American Property Casualty Insurance Association (APCIA), described in a statement how property/casualty insurers are working “to proactively help consumers in this time of crisis.”
Examples include temporary arrangements for:
- Flexible payment solutions for families, individuals, and businesses;
- Suspending premium billing for small-business insureds, such as restaurants and bars;
- Waiving premium late fees;
- Pausing cancellation of coverage for personal and commercial lines due to non-payment and policy expiration;
- Wage replacement benefits for first responders and medical personnel who are quarantined;
- Suspending personal auto exclusions for restaurant employees who are transitioning to meal delivery services using their personal auto policy as coverage;
- Adding more online account and claims services for policyholders;
- Shifting more resources to anti-fraud and cyber security units, in recognition that bad actors prey on victims during times of crisis; and
- Suspending in-person loss control visits and inspections.
On the subject of exclusions for contagious diseases in business interruption policies, the statement said:
“If policymakers force insurers to pay for losses that are not covered under existing insurance policies, the stability of the sector could be impacted, and that could affect the ability of consumers to address everyday risks that are covered by the property casualty industry.”
It went on to say:
“APCIA’s preliminary estimate is that business continuity losses just for small businesses with 100 or fewer employees could fall between $220-383 billion per month. The total surplus for all of the U.S. home, auto, and business insurers combined to pay all future losses is roughly only $800 billion, with the combined capital of the top business insurance underwriters representing only a fraction of that amount.”
Related articles:
New York introduces bill on pandemic-related business interruption claims
Policyholders finding out that business interruption insurance doesn’t cover coronavirus
P/C Insurers Put a Price Tag on Uncovered Coronavirus Business Interruption Losses
More coronavirus insurance cover than people think, says Lloyd’s CEO
Standard insurance for Florida businesses likely won’t cover COVID-19 losses
French Laundry restaurateur Thomas Keller sues insurer for coronavirus losses
Momentum for pandemic backstop?
Business Insurance reports that, according to sources inside the federal government, progress is being made on legislation that would provide a federal backstop for pandemic risk insurance and that a related bill could be introduced within the next 30 days. According to the sources, the bill would set up a pandemic risk insurance program that would be similar to the federal terrorism insurance program. They also report that Rep. Maxine Waters (D-Calif.), chair of the House Financial Services Committee, is circulating a draft bill including the proposal.
Related articles:
As Business Losses Mount, Pandemic Backstop Discussions Grow
Triple-I Webinar Covers COVID-19’s Economic and Health Implications
The Insurance Information Institute invited its members to a webinar titled “Covid-19’s Impact on Health, the Economy and Growth” on March 5 at 11:00 a.m. EST presented by Triple-I Vice President and Senior Economist Michel Léonard, PhD, CBE.
Dr. Lèonard will discuss the following key points:
• Economic impact likely to continue into Q3/Q4 2020 and 2021
• Could reduce global growth by as much as 1 percent and delay recovery by up to 12 months
• Fiscal and monetary policy, rates cuts, unlikely to be effective
• Insurance industry to see higher claims, reduced premium growth
He will also preview the Global Macro and Industry Outlook report before it is made available to the public.
To find out more about the benefits of Triple-I membership click here.
COVID-19: Learn From History to AddressThe Current Outbreak
By Dr. Steven Weisbart, CLU
COVID-19, the new coronavirus, has killed more than three times as many people as the 2003 SARS epidemic.
The World Health Organization (WHO) reported that, as of 10 a.m. Central European Time (CET) on March 1, there were 87,137 confirmed COVID-19 cases and 2,977 of the infected people had died. From November 2002 through July 2003, according to the U.S. Centers for Disease Control and Prevention (CDC), 8,098 people worldwide became sick with severe acute respiratory syndrome (SARS) and 774 died.
More people are believed to have been infected with COVID-19 than official statistics show. This is because confirmed infections are based on positive tests for the virus, and some countries—including the United States—have been doing very little testing. Further, the estimated 2 percent death rate attributed to the disease is based on this unreliable infection count.
Instead of SARS, some are now comparing COVID-19 with the Ebola pandemic of 2014 to 2016. Ebola is believed to have killed about 50 percent of those it infected, but that outbreak was contained before it reached the same number of infections as COVID-19.
So, is there a useful historic comparison to be made with COVID-19? I would argue that there is: the “Spanish Flu” of 1918-19.
There is no vaccine for COVID-19, and experts suggest it could take a year or more to develop, test, manufacture, and distribute a vaccine. This suggests there are few medical strategies for dealing with the current outbreak. It’s as though we’re medically in the world of 100 years ago.
The 1918 flu virus had an estimated mortality rate of about 2 percent and was very infectious. It is estimated that as many as one-third of the entire world population was infected at some time, so even a 2 percent mortality rate caused millions of deaths.
This raises a scary thought about how the COVID-19 pandemic might play out: the Spanish Flu swept around the globe in three phases. The first was in the Spring of 1918 and, although it infected widely, had a relatively low mortality rate. The second phase occurred in the Fall of 1918. This phase saw faster infection spread and was much more deadly. The third phase was in February and March of 1919 and was less infectious and less deadly than either of the two prior phases.
World War I – with large concentrations of soldiers in barracks and trenches and truck convoys moving across Europe – may have contributed to this infectious arc. But the virus killed more people than the war on every continent except Europe.
Insurance industry impact
What would a COVID-19 pandemic mean for insurers? The main impact would likely be on health insurers, since the number of people seeking hospitalization would likely spike claims far beyond anything their rate structures have anticipated. In 1918 hospitals were so overwhelmed that auditoriums, indoor sports arenas, and similar spaces were set up to house patients. Scarcity rates would apply; for example, the number of respirators available currently is far short of what would be needed, and prices for new supply would likely surge.
As I’ve written previously, for life insurers the effect of a severe pandemic would depend on which segments of the population are likely to die. In 1918, in addition to the very old, that virus struck unusually strongly at people in the prime working years, triggering benefits from both individual and group life insurance. The sudden impact of such unpredicted losses would affect all life insurers, particularly the weaker ones.
In the property and casualty sector, the line most directly affected is likely to be workers compensation, particularly for health care workers and others exposed to the virus as a result of their work—such as police, fire, and EMT. Another possible line affected is various liability lines, involving claims from people who became sick from manufacturing, dispensing, or receiving a vaccine or other treatments. In recent years, Congress passed laws blocking such liability claims, but it’s not clear that it will do so again today.
Beyond the direct effects to insurance, there are growing forecasts that the global economy, and especially particular sectors, could see dramatic cutbacks. Businesses and other organizations that involve people gathering in crowds are already seeing such effects, and insurance premiums that reflect these downturns are likely to follow. However, claims are also likely to turn down (e.g., fewer auto accidents), so the effect on those lines might actually be neutral or positive.
Learn from history
Today people and goods move around the world with unprecedented speed. Urban environments and the transit systems that serve them are as packed with people as any military convoy or trench network.
If COVID-19 follows a similar track to that of the Spanish Flu, the current outbreak would turn out to have been a mild phase. If this scenario is correct, the first phase would taper off in a month or two, followed by several months in which the virus would appear to have ended its threat.
We should continue developing vaccines and other preventive/mitigating measures during this lull to better prepare for the more virulent phase that might manifest in the second half of 2020. Failure to do so would mean we’ve learned nothing from the worst global pandemic in the last 100 years.
Emerging cyber terrorism threats and the Federal Terrorism Risk Insurance Act
On December 20, 2019, President Trump signed a federal funding package that includes a seven-year extension of the Terrorism Risk Insurance Act (TRIA). TRIA provides for a federal loss-sharing program for certain insured losses resulting from a certified act of terrorism.
Passage of the act was met with resounding approval by the insurance industry. You can read more about it here.
A critical mandate of the TRIA extension is for the Government Accountability Office (GAO) to make recommendations to Congress about how to amend the statute to address emerging cyberthreats. Triple-I recently hosted an exclusive members-only webinar featuring Jason Schupp of the Centers for Better Insurance, who discussed issues likely to be addressed by the GAO report.
Schupp said the report will likely serve as a starting point for a discussion about cyber threats and how the insurance industry can better meet the needs of businesses, nonprofits and local governments for cyber insurance. It will address:
- Vulnerabilities and potential costs of cyber-attacks to the United States;
- Whether adequate coverage is available for cyber terrorism;
- Whether cyber terrorism coverage can be adequately priced by the private market;
- Whether TRIA’s current structure is appropriate for cyber terrorism events; and
- Recommendations on how Congress could amend TRIA to meet the next generation of cyber threats.
Cyber terrorism is already covered under TRIA, but such acts don’t fit neatly into the TRIA framework. Because cyber limits and conditions are already narrow, TRIA’s current make available requirement has not been effective in providing coverage for cyber-terrorism events at the same limits and conditions as non-cyber events.
Schupp proposes that the requirement be amended so the coverage doesn’t exclude insured losses specific to the loss of use, corruption or destruction of electronic data or the unauthorized disclosure of or access to nonpublic information.
But expanding the requirement carries considerable risk. If insurers are required to make more coverage available for cyber events than they are comfortable with the result could be a pullback in property and liability insurance generally – not just for cyber events. Any expansion must be balanced with the terms of the backstop.
Schupp concluded that the GAO’s investigation and report (which is required to be completed by June 2020) is likely to kick off a multi-year debate that could substantially redefine U.S. cyber insurance markets. Insurers, policyholders and other stakeholders should engage accordingly.
To learn about how to become a member of Triple-I visit iiimembership.org.
Ransomware payments doubled in fourth quarter 2019
The average ransomware payment increased by a whopping 104 percent in the fourth quarter of 2019, spiking to $84,116 from $41,198 in Q3, according to a report from Coveware, a security vendor.
Ransomware, also known as cyber extortion, involves the use of malicious software designed to block access to a computer system until a sum of money is paid. The 4Q increase reflects the diversity of the cyber criminals attacking companies.
Some ransomware variants are focusing on large companies where they can attempt to extort the organizations for seven-figure payouts. Small businesses, on the other hand, are bombarded with ransomware variants with demands as low as $1,500.
The total cost of a ransomware attack depends on its severity and duration and includes the costs of the ransom payment (if one is made), as well as remediation costs, lost revenue, and potential brand damage.
In Q4, ransomware actors also began exfiltrating data from victims and threatening to release it. In addition to remediation and containment costs, this complication adds to the potential costs of third-party claims.
Other key takeaways from the report include:
- 98 percent of companies that paid the ransom received a working decryption tool in Q4 2019, unchanged from Q3.
- Victims who paid for a decryptor successfully decrypted 97 percent of their data, a slight increase from Q3.
- Average downtime increased to 16.2 days, from 12.1 days in Q3 of 2019. The was driven by a higher prevalence of attacks against larger enterprises, which often spend weeks fixing their systems.
- Cyber criminals demand Bitcoin almost exclusively now in all forms of cyber extortion because it’s easier to swap extortion proceeds into a privacy coin after they collect, than to require a victim to purchase a less liquid type of digital currency.
- Less sophisticated and well-financed attackers will target small companies with small IT budgets.
- Public sector organizations continued to account for a high percentage of ransomware attacks in Q4. The attacks are expected to continue until these organizations are able to increase their security budgets.