The growth and challenges of cyber insurance

Abstract

Cyberattacks have grown in frequency and cost over the past decade, with high-profile cases, such as the 2013 Target data breach, the 2017 Equifax data breach, and the leak of Democratic National Committee emails during the 2016 election making national headlines. Ransomware attacks, intellectual property theft, and fraud cost companies billions in recovery expenses, fines, and lost revenues every year. More firms are purchasing cyber insurance as a way to cover losses and expenses resulting from cyber incidents. However, cyber insurance alone is not a panacea, and even firms that have cyber insurance may not be as protected as they think. Unlike traditional lines of business such as private auto insurance, where standardized policies provide liability or collision coverage, cyber insurance policy language is not standardized. The types of risks covered under cyber insurance vary significantly across policies and businesses, and insurers do not always agree on what loss events are covered under those policies. The features of cyber events, including a limited loss history, the unreliability of past data when predicting future events, and the possibility of a large-scale attack where losses are highly correlated across companies and/or industries, make it difficult to write comprehensive policies. In this Chicago Fed Letter, we examine the extent to which cyber insurance can help protect businesses and the wider economy from the costs of cyberattacks and how institutional factors and legal uncertainties may obstruct the development of this market. What is cyber insurance? Most observers trace the history of cyber insurance back to Steven Haase, who helped AIG write the first internet security liability policy in the spring of 1997. The first cyber insurance policies were geared toward information technology companies responsible for managing networks and systems used by other businesses and consumers. But the cyber insurance market has since expanded, and current cyber protection comes in three forms: third-party written coverage, first-party written coverage, and implicit silent cyber coverage (sometimes called nonaffirmative cyber exposure). We define and discuss each of these in turn. Third-party liability cyber insurance reimburses said entities for the costs incurred by their clients because of data breaches, malware infections, or other cyberattacks in which the insured entity was at fault. Third-party liability coverage is the cyber equivalent of medical malpractice, where businesses are insured against harm they inflict on their clients by their action (or, as is usually the case with cyber risk, inaction). Many early policies were of this form. Even firms that have cyber insurance may not be as protected as they think.