Cyber Threats and the Insurance Response

Transcription

1

2 Cyber Threats and the Insurance Response Scott Reeves & Laurence Yan Munich Reinsurance Company This presentation has been prepared for the Actuaries Institute 2014 General Insurance Seminar. The Institute Council wishes it to be understood that opinions put forward herein are not necessarily those of the Institute and the Council is not responsible for those opinions.

3 Cyber Threats and the Insurance Response Landmark Events Exposures The Government and Industry Response Insurance Coverage Options & Market Actuarial Context and Concerns Case Study

4 Sony Playstation Network Date April 2011 Extent of Breach Source of Breach Insurance 77 million records Compromise of System Administrator s account via malicious Coverage denied under GL policy

5 Target (United States) Date 27 November 15 December 2013 Extent of Breach Source of Breach Insurance 40 million credit cards 70 million other records RAM Memory Scraping Malware $100m Cyber Policy $65m D&O Policy

6 Other Recent Breaches Target Location Date Extent of Breach Kmart US Sept 2014 Credit card information Home Depot US April - Aug million credit cards CHS US July million patient records EBay US May 2014 User login details JP Morgan US August million customer records ABC AUS February ,000 User login details Telstra AUS May ,000 User login details

7 Denial of Service Extortion Electronic Vandalism Theft of data Computer Virus Cyber Risk Exposures Security Privacy laws HIPAA + HITECH Gramm-Leach-Bliley Future Legislation Reputation Compliance & Privacy Primarily First Party Primarily Third Party Massive distribution of false information Systematic posting of incorrect info on web pages Liability Intellectual Property infringement Product/Service failure Privacy violation

8 Accumulation Concerns Global Outage of External Networks client 2 nd tier Worldwide spread Many services interrupted Prevention by insured not possible client bank bank company bank credit company 1 st tier sub cloud provider end user sub cloud provider Self-reproducing Computer Viruses company bank Worldwide spread Many systems infected per event invalid supplier pharma hospital Cloud provider Onlineshop end user end user Outage of a Large Cloud Service Provider Accumulation triggered by one company Many clients affected per event lab doc lab hospital doc pharma industry end user sub cloud provider sub cloud provider sub cloud provider hospital end user sub cloud provider

9 Government Responses Privacy Amendment (Privacy Alerts) Bill 2014 Possible introduction of mandatory data breach notification. Under consideration by the House of Representatives Australian Privacy Principles, March 2014 OAIC now has more powers to investigate breaches and seek civil penalties ALRC Report: Serious Invasions of Privacy in the Digital Era Recommendation for the creation of a tort for breach of privacy

10 Industry Response: PCI-DSS Payment Card Industry Data Security Standards Credit card industry self-regulating body (worldwide) All entities processing credit card transactions are required to comply Designed to reduce fraudulent transactions Authority to fine non-complying entities in the event of a data breach

11 Insurance Response Traditional Covers Property: Cover is specific to physical loss or damage to tangible property Data is not generally defined as tangible property General Liability: Typically covers bodily injury & property damage to tangible property May specifically exclude electronic data Professional Indemnity (Errors & Omissions): Covers third party economic damages resulting from a failure of defined services only Typically tied to/requires an act of negligence to trigger cover Directors and Officers: Covers economic damages resulting from a wrongful act by the directors/officers Possible secondary coverage provided for consequences of a cyber event

12 Insurance Response Coverage Options Cyber insurance policy 1st party Cyber Expenses 3rd party Cyber Liability Crisis Consulting Forensics Notification Costs Credit Monitoring IT Vandalism Electronic Theft Business Interruption Network Extortion Privacy Disclosure/Liability Security Failure Internet Communication and Media Liability Intellectual Property Legal Counsel Internal Network Interruption Administrative Fines Access Failure

13 Global Cyber (Re)insurance Market Estimated Primary Insurance Cyber Market (2014 & 2020, in USD billion) 6 8 Rest of the World North America ~ 1 3 North America Cyber liability treaties mainly coming from specialist insurers or global clients Europe Few Cyber treaties, mainly from global clients or large local insurers ~ ~ 2 ~5 Asia Growing demand in all lines of business; high growth rates expected

14 State of the Market Australia (Current) AUD 150m market capacity 12 Carriers Limited claims activity Limited policy take-up Mandatory notification requirement may lead to increased awareness and higher insurance penetration

15 State of the Market - Australian (Future) In terms of the impact of these changes on the industry, if the 2014 Bill is introduced and mandatory breach notification become a feature of the Australian privacy regime, Australia may follow in the footsteps of the United States, where class actions emanating from mass breaches of privacy obligations are occurring with increasing frequency. Privacy law reforms the key changes in 2014 Norton Rose Fulbright (June 2014)

16 Actuarial Context and Concerns Data quality and limited dataset Dynamic regulatory environment Evolving exposures Varying claims costs drivers Spill-over claims against other classes of business Accumulation scenario modelling and pricing

17 Case Study Scenario Partnership with primary insurance client New product with no loss experience Third party liability arising from internet operations Homogenous class of insureds

18 Scenario-based Modelling Approach Average data breach loss quantum based on industry research Loss quantum reduced in accordance with the actual coverage provided Loss frequency derived from industry research Assign an average loss per average insured Loss cost modified by risk factors and dimension discounting

19 Pricing Control Cycle Reserving / monitoring performance Managing portfolio accumulations while working with imperfect data New / improving data sources

20 Concluding Remarks Quote from London Market underwriter Important and dangerous class of business Red Light District - attract unwary punters Standard actuarial techniques must be adapted Essential to work with underwriters and claims staff to understand complexities International risks - each country is different Demand is real: people need this cover Subject : Underwriting PI / D&O (2001)!!