Skip to content

Cyber insurance market undergoing tumultuous changes as guidance from Lloyd's gets revised

escalating cyber extortion incidents and increased ransom demands have taken a toll on insurance companies, leaving multiple entities in peril and susceptible to attacks

Cyber insurance industry is experiencing chaos, as evidenced by alterations in guidelines from...
Cyber insurance industry is experiencing chaos, as evidenced by alterations in guidelines from Lloyd's

Cyber insurance market undergoing tumultuous changes as guidance from Lloyd's gets revised

In a move that could reshape the cyber insurance market, Lloyd's, a prominent insurance market, has announced a decision to phase out coverage for state-sponsored cyberattacks. This decision comes amid financial pressure faced by the insurance market for years due to the rise in ransomware attacks in recent years.

According to a study released earlier this month from Blackberry and Corvus, widespread issues with coverage among small to midsize organizations have been identified. The study reveals that only 55% of respondents had cyber insurance coverage, and 78% added on cyber-related coverage to a previously existing policy. This highlights the importance of insurance coverage in the digital age, yet the availability of adequate protection remains a concern.

Heidi Shey, a principal analyst at Forrester, states that insurers are under pressure to reduce their risks to be profitable and are imposing more restrictive underwriting standards. The new guidance encourages managing agents to apply due diligence to the specific complexities of state-sponsored attacks.

Munich Re, a Germany-based reinsurer, has disclosed plans to add additional language into cyber coverage that protects against acts of war. This move aims to eliminate systemic cyber war exposure. Cindy Jordano, a partner at Cohen Ziffer Frenchman & McKenna, a law firm specializing in insurance recovery, states that the policy changes could cause difficulties for companies obtaining cyber policies, particularly as the Lloyd's exclusions make it more difficult for companies to obtain coverage for a wide range of cyberattacks.

The decision by Lloyd's to phase out coverage for state-sponsored cyberattacks raises questions for U.S. companies about their preparedness and long-term risks. Andrea DeField, a partner at Hunton Andrews Kurth in Miami, notes that the new exclusions from Lloyd's are essentially a continuation of the cyber war and cyber operation exclusion clauses from the Lloyd's Market Association.

However, recent months do not show publicly announced plans by specific insurance companies to change their cyber insurance terms specifically to improve coverage against state-sponsored cyberattacks. Most cyber insurances follow model conditions from the German Insurance Association with typical coverage including worldwide protection and modular add-ons, but no detailed company-specific amendments related to state-sponsored attacks are identified in the available information.

The rise in ransomware attacks has led to a 232% increase in ransomware claims from 2019 to 2021, and a 54% rate of nonpayment for ransomware claims during the first quarter of 2022. The Virtu Financial case, in which Axis Insurance initially denied coverage on a social engineering attack that led to almost $11 million in losses, was settled earlier this year. The settlement amount was not publicly disclosed.

Jordano also notes that enforcement of the new Lloyd's exclusion will present challenges, as insurers face the burden of proving that exclusions unambiguously exclude coverage, and with the Lloyd's exclusion, insurers will likely face challenges proving that cyberattacks are, in fact, state-backed given the undercover nature of many of these attacks.

Data from S&P Global Ratings shows cyber insurance premiums are expected to rise 25% per year to reach $22.5 billion in 2025. Despite the challenges, it is clear that cyber insurance will continue to play a crucial role in protecting businesses from the financial impact of cyberattacks.

In conclusion, the decision by Lloyd's to phase out coverage for state-sponsored cyberattacks is a significant development in the cyber insurance market. It underscores the need for businesses to be vigilant and proactive in their cybersecurity measures, and to ensure they have adequate insurance coverage to protect against the financial fallout from cyberattacks.

Read also:

Latest