Government figures released in April 2023 showed that 32% of businesses and 24% of charities were victims of cybercrime in the previous 12 months*. Cybercrime is defined as any criminal activity that uses technology to target computers and networks and is most commonly carried out to generate a profit or to damage and disable devices.
We continue to see the term ‘cyber’ in business and the media but it’s a term that’s often misunderstood. Here, we explain some of the threats cybercrime poses, why you should consider purchasing a Cyber Insurance policy for your business, and which elements of cover to look at – in simple terms.
The increased adoption of computers and information technology into organisations has amplified the importance of cyber insurance yet the risk associated with these threats is still often overlooked. Nowadays, it is much easier for criminals to spend their time online rather than offline—some of our most valuable assets are there. These assets have the potential to be accessed by anyone, anywhere in the world meaning your systems, finances and client data is at risk, too. Clearly, a Cyber Insurance policy that can help you protect against such risks is going to be valuable.
How could cyber crime affect your business?
First-party losses can be categorised into three broad areas:
| Theft of Funds | Theft of Data | Damage to Digital |
| Theft of money from a bank account. Criminals no longer target physical banks but online accounts, and if you have been negligent in allowing this to happen, your bank will not reimburse you. | Data is extremely valuable; it’s what makes identity theft possible. Service-user information like names, addresses and dates of birth, as well as other sensitive data, can be worth a lot to criminals. | Organisations are very dependent on technology and their systems. By damaging (or threatening to damage) digital assets, criminals extort money from their victims. Even after paying a ransom, systems can be left unusable, having a severe impact on your organisation’s operations. |
With these losses in mind, we offer 5 reasons why you should have a Cyber Insurance policy for your business.
- Cybercrime is the fastest growing crime in the world and standard property or crime insurance policies don’t always offer comprehensive coverage for such events.
Cyber Insurance protects you against the ever-increasing and developing world of cybercrime; with criminals developing new tactics all the time, it is important your business is protected against the very latest forms of cyberattacks. Read more about protecting your business against cyberattacks in our article: Are you prepared for a Cyber Attack? - With many businesses reliant on technology to operate, business interruption is important to consider in the event of a cyberattack.
Standard business interruption insurance is unlikely to cover you under such circumstances. As such, consider what the impact would be on your business if your systems were brought down by an attack? Cyber insurance can provide cover for any loss of income and the potential extra expense associated, should your operations be brought to a halt by a cyber event. - Data is not covered by standard property policies, which can leave you open to third-party claims and you could also potentially lose what is a very valuable asset to your company.
Data is vital to most businesses today but many business owners do not realise that their standard property policy wouldn’t react if data was damaged or destroyed. However, a cyber policy can react here – responding to help restore and even re-create the information damaged or lost. - Complying with breach notification laws costs time and money.
Breach notification laws are now commonplace across many territories and, among other things, require businesses that lose sensitive personal data to provide written notification to individuals that were potentially affected, in order to avoid hefty fines and/or penalties. Cyber policies can provide cover for the costs associated with providing a breach notice (even if it’s not legally required), and can also cover the associated regulatory fines and penalties. - Access to a wide range of specialist incident response services.
Responding to a cyber incident requires a range of specialists, such as IT forensics and PR agencies. SMEs are particularly at risk as they are not only increasingly targeted by criminals but are unlikely to have the range of required incident response specialists available in-house. However, a good cyber insurance policy will not only pay for these specialists but also give you access to them, which can be invaluable to ensure the incident is contained, damage is minimised and the business is back up and running quickly.
So, what are the various covers available to businesses to help protect against cybercrime?
Pre-incident Support
Threat intelligence services can help identify the cyber threats that your business may be exposed to by using a proactive measure called ‘vulnerability scanning’, which detects weaknesses in your business’s system or network that a hacker may be able to take advantage of. They will also search for potential threats and provide employee awareness training.
Incident Response
Cyber insurance solutions can cover the costs involved with responding to a cyberattack, including things such as costs associated with IT Security & Forensic specialist support, legal advice, regulatory bodies, and notifying third parties that have been affected by the attack. Some cover includes access to 24/7 incident response, which can provide initial advice and threat intelligence to help you begin managing the cyberattack immediately.
Cybercrime Cover
Where insurable by law, insurers will look to reimburse your business for the costs associated with dealing with the cybercrime incident and financial loss caused by it, repair the breach, and advise on improving your business’s security measures going forward.
Extortion Cover
Policies can also include cyber extortion cover which protects your business in the event of a ransomware attack or other malicious attack whereby the cyberattacker holds or threatens to reveal your business’s data until a ransom is paid. This protection can be in the form of reimbursement of the ransom amount demanded by the attacker, as well as any specialist’s fees for the negotiation and transfer of funds to solve the ransom request.
Security & Privacy Breach Costs
This cover is particularly relevant for businesses that handle or store any personal information about customers or service users. Insurers can provide incident support with 24/7 access to a team of experts to manage a breach; this can include IT forensic experts, legal advice, notifying affected individuals and offering credit or identity fraud monitoring services.
Cover can sometimes extend to provide payments to third party claimants and to the business for legal and regulatory defence costs arising from a privacy breach (where insurable by law).
Data Recovery and Damage to Digital Assets
Following a cyber event such as a virus, hacking or a denial-of-service attack, this cover protects your business against the costs to replace, restore and repair data and software that has been lost or damaged. Cover can also be included for the costs to replace or repair hardware that has been damaged and that protects your digital assets, such as your website or photos.
System Damage and Business Interruption
Following a cyber or data breach, cyber insurance can cover your loss of income and increased costs of working for the specified period of indemnity.
This provides cover for more than the financial losses incurred, it includes the costs of IT specialists, consultants and forensic experts that can help diagnose and fix the source of the computer system downtime to mitigate interruption to business operations. This is an important aspect of cyber insurance and forms a critical safety net as you look to resume your normal working pattern.
Liability Costs
Cyber policies can also provide cover for damages and defence costs should a third-party claim an incident of unauthorised access and disclosure of data on their computer system. It also extends to cover interruption or degradation of services of a third-party computer system, should this also be claimed for.
In addition, cyber policies can extend to cover your business in the event that your online presence leads to someone bringing a claim for libel, slander, defamation or the infringement of intellectual property rights.
An example of how one McClarrons client was impacted by Cybercrime…
One of our clients, a manufacturer, who opted out of cyber cover, recently experienced a cyberattack through ransomware in which the hacker encrypted all their servers and data; this halted production as all of their machinery relied upon CAD designs held on the servers.
At face value, this organisation doesn’t rely on personal data or computer systems to operate but in reality, if they hadn’t been able to recover the data through their engineering computers policy, they would have lost their ability to produce their bespoke products, as they rely on the designs that were being held for ransom.
Following the initial notification to us, the insurer organised for forensic specialists to attend the next day to identify how the hacker had gained access and how to get the systems back up and running. Thankfully, they were able to ‘clean’ one computer, allowing the client to contact customers and respond to emails but there was still work to be done. Not only had the primary server been encrypted but the backup server, which was dealt with by a third-party IT consultant, had also been breached.
The forensic specialists worked together with the IT consultants to decrypt the data and start rebuilding the systems, whilst a specialist negotiator in America contacted the hacker to work out the process of paying the ransom, if it had become necessary – this particular consultant was extremely expensive, costing near £30,000 for their work.
Whilst the client was very lucky to be able to decrypt data and rebuild systems without having to pay the ransom (this would not have been covered due to their lack of cyber insurance), they did have to inform their customers that personal data had been exposed. The client was also not covered for data and GDPR expenses nor Business Interruption, which would have covered the turnover decrease due to halted operations; without the engineering computers policy, they would not have had anyone attend the following day or any cover to help them and, as we know, the sooner an attack is managed, the less detrimental it often is.
So far, the costs incurred have reached an astounding £84,000 with the claim ongoing.
How McClarrons can help your business with Cyber Insurance Cover
We can support you in your cyber insurance journey, from helping you assess your risks and consider appropriate cover, to getting your business back on its feet post-incident.
Should the worst happen and you need to make a claim, our in-house Claims Team will support you, making the process as smooth and efficient as possible.
For more information or if you would like a complimentary insurance review, please do not hesitate to contact our Commercial Team on 01653 609151 or by emailing commercial@mcclarroninsurance.com.
Blog updated February 2024
