Colonial Pipeline, JBS, Kaseya and other major attacks of last year have demonstrated that if ransomware wasn’t already a common part of the global vocabulary, it certainly is now.
Executive Summary
Gaps in understanding between insurers and policyholders seem to be widening as attacks grow more widespread and sophisticated, says Josephine Wolff, a professor of cybersecurity policy and author of a new book about cyber insurance. Here, Wolff, policyholder representatives and a cyber insurance executive provide views of coverage restrictions and claims denials from both insured and insurer vantage points, weighing expectations against a changing landscape that increasingly includes the prospect of state-sponsored cyber attacks.However, the first reported incident of ransomware goes back much further than last year. In 1989, according to ransomware.org and other reports, a form of ransomware was released on floppy discs and distributed to 20,000 attendees at the World Health Organization (WHO) AIDS conference. The incident came with a $189 payout demand.
This ransom demand may seem like a drop in the bucket now, as incident costs have increased dramatically since then. Fitch Ratings reported in April that annual claims filings for insurers have doubled in the last three years. For standalone cyber coverage, direct incurred losses and defense and cost containment expenses expanded by more than 300 percent for the industry since 2018.
