The cyber insurance market has experienced a rollercoaster ride in recent years, with periods of growth followed by setbacks. Just as insurers were beginning to see profitability return, the industry faces a new wave of losses stemming from ransomware attacks, business email compromise (BEC), and privacy litigation. A report from Tokio Marine HCC highlights the potential threats that could hinder the market’s turnaround and calls for increased vigilance in the face of evolving cyber risks.

Ransomware: A Persistent Threat:
Ransomware attacks have proven to be a persistent and costly problem. While there was a temporary decline in 2022, cyberattacks have once again surged, setting the stage for a potential record-breaking year in financially motivated cyber incidents. The ransomware ecosystem has shown remarkable adaptability to security improvements and government actions, making it a formidable challenge for insurers and businesses alike. As ransomware incidents resurge, the cyber insurance market may face significant changes and increased pressure.

The Changing Landscape of Cyber Insurance:
After witnessing skyrocketing cyber insurance rates, the market saw a decline in average rate increases, dropping to single digits or even experiencing decreases. The initial price hikes were implemented to cope with ransomware losses, but the report suggests that other factors such as stricter underwriting, cyber threat intelligence utilization, and vulnerability scans have equally contributed to the market’s stabilization. This resulted in a highly competitive market in early 2023.

Ransomware and BEC: A Tale of Decreasing Losses:
While ransomware remains the costliest driver of loss, there has been a reduction in both the average loss and the number of ransomware incidents between 2021 and 2022. The average loss across Tokio Marine HCC’s book decreased from $518,000 in 2021 to $234,000 in 2022. Similarly, BEC incidents saw a decline of 35%, with the average loss dropping from $82,000 to $80,000 during the same period. However, recent developments indicate a resurgence of ransomware attacks, raising concerns about cyberwar and the potential for more sophisticated attacks facilitated by artificial intelligence.

Privacy Litigation: A Growing Concern:
The report also highlights the potential impact of privacy litigation resulting from website tracking and biometric scanning of personal data. Recent rulings by the Illinois Supreme Court, which allow for the stacking of fines per violation and a five-year statute of limitations, could lead to a significant increase in settlement amounts. Already, there has been a 65% surge in lawsuits alleging violations of the Illinois Biometric Information Privacy Act (BIPA). Insurers and businesses must be prepared for the potential financial implications of such litigation.

The cyber insurance market has experienced periods of growth, setbacks, and now faces new challenges. The resurgence of ransomware attacks, coupled with the rising threat of BEC and the potential impact of privacy litigation, necessitates a renewed focus on cybersecurity and risk management. Insurers, businesses, and individuals must remain vigilant in the face of evolving cyber risks and adapt their strategies to effectively mitigate potential losses. The cyber insurance market’s ability to navigate these challenges will determine its future resilience and profitability.