Computer Attack | Insurance premiums are skyrocketing

Cybercriminals cost companies dearly, and not just in ransom. For two years, cyber risk insurance premiums have literally exploded, while scalded insurers are more discerning than ever.

“Financially, it was a horror film”

Perceived a few years ago as the product of the future, cyber insurance has instead become an unprofitable burden for insurance companies. Caught between cybercriminals who are more active and greedy than ever and the scarcity of insurance available, companies must juggle significant increases in premiums and tougher enrollment criteria. The market is “in a serious period of correction”, experts note.

All professionals interviewed by The press observed that cyber risk insurance premiums had increased significantly for at least two years, a phenomenon that remains poorly documented and for which there are no overall statistics.

“In some cases, we’re talking about increases of more than 100%,” notes Imran Ahmad, head of technologies and cyber security at Norton Rose Fulbright Canada.

The Canadian Federation of Independent Business (CFIB) and the Regroupement des cabinets de courtage d’assurance du Québec (RCCAQ) are currently preparing studies on this topic. The former president of the latter organization, Jean-Pierre Tardif, knows a lot about it: in one year, the cyber risk insurance premium for his company, Assurancia Groupe Tardif of Thetford Mines, went from $14,000 to $32,000. $, an increase of 129%. “Financially, it was more than a horror film,” he sums up.

Same observation at the Société de transport de Montréal (STM), where we suffered “a significant increase in [la] premium with a reduction in coverage,” spokesman Philippe Déry said via email.

Ten pages of questions

Added to these rising premiums is a new phenomenon: insurance companies are now more difficult and will sometimes reject companies deemed too risky.

At CFC, which is based in London and has 10,000 clients in Canada, for example, we push the investigation further by combing the underground web (dark web) to see if the company has ever suffered a data breach. “We have 135 people dedicated specifically to cyber security,” Lindsey Nelson, cyber development manager, said by phone.

The press was able to consult the form now required by two major cyber risk insurers, Beazley and Zurich, which are 5 and 10 pages respectively. Penetration tests, employee criminal background checks, data destruction policy, two-factor authentication, everything is reviewed by a hundred questions.

The grounds

It is only since 2015 that the Office of the Danish Financial Supervisory Authority prepares cyber risk insurance separately. In seven years, the number of policies in force in Canada has increased from 620 to 131,361. Insurance companies considered Canadian represent 96% of the market.

At the same time, the number of injuries has followed an upward curve and has increased from 2,601 in 2015 to 28,083 in the second quarter of 2022.

Finally, we better understand the reluctance of insurance companies when we plot what is called the “loss ratio” since 2015. This is the gross ratio of claims paid to premiums collected. All administrative costs are added to this ratio. “In order for insurance to be profitable, it has to be below 60%,” explains Walid Khayate, practice director of integrated risk and cyber risk management at BFL Canada, one of the top three brokers in the country.

“Serious Fix”

At the Insurance Bureau of Canada, it is estimated that the net ratio, which adds claims and operating costs, has been more precisely 230% over the past three years.

“For every dollar of premium requested, insurance companies paid out $2.30,” summarizes Anne Morin, spokesperson. In particular, insurers must cover loss of productivity, replacement of computer equipment, collective actions and even ransom reimbursement, a solution chosen by 58% of affected companies at an average cost of $458,200, according to a study commissioned in 2021 by Palo Alto Networks.

In summary, it is no longer profitable to offer cyber risk insurance, and has only been three times since 2015. Hence the steep increase in premiums required over the past two years. “The market in Canada is in a serious period of correction,” notes Lindsey Nelson of CFC. The attacks are now costing hundreds of millions of dollars worldwide. »

disappointing eldorado

Cyber ​​risk insurance was presented a few years ago, notably by the company Standard & Poor’s, as the product that will be the most important in 2030, and has provoked an avalanche of offers from insurance companies mediated by brokers. “We’ve moved from Esso and Walmart to more intangible, digital-based assets,” explains Walid Khayate of BFL Canada.

The pandemic, which has accelerated the digitization of companies and generalized remote work, the increase in cyber attacks, as well as government regulations that make companies more vulnerable to lawsuits, has turned this industry upside down.

Insurers were “a little too motivated and not particularly equipped” for this new market, for which there was no history, he notes. “They had a revival, they couldn’t sustain the losses any longer. It’s complex for everyone, the data is partial, and in cybersecurity, what happens in the past doesn’t determine the future. Attack vectors are changing, a system that had 50,000 vulnerabilities won’t be there in three years. »

Cooled insurance companies

Worryingly, many public and para-public organizations find it difficult to find cyber risk insurance at a reasonable price.

“Chubb, one of the largest insurance companies in Canada, no longer touches certain sectors, such as schools, CEGEPs, hospitals,” reveals Walid Khayate, of BFL Canada. “They don’t like it: These organizations have a lot of data, and it’s often poorly managed. »

CEGEPs, for example, must keep their student files, sometimes containing highly confidential data, for 35 years. “A CEGEP official told me recently that cyber attacks often come from their own students who try to break into the system…”

The Union of Quebec Municipalities (UMQ) found an interesting way out that temporarily protected it from premium inflation and lack of interest from insurers: a group for cyber risk insurance, the conditions of which were established after a tender, from 2019 to 2024. a total of 102 municipalities are “of all sizes, but especially between 20,000 and 60,000 inhabitants”, came along, says Patrick Lemieux, spokesman for UMQ.

Harsh but helpful

Higher premiums are often combined with reduced coverage and amounts, and customers are encouraged to choose higher deductibles to bear in the event of an incident.

Small and medium-sized businesses are particularly affected, reports Michel Leonard, chief economist at the New York-based Insurance Information Institute. “These companies are suddenly more aware of risks, they are looking for coverage, but demand is growing faster than capacity. This is also the reason why the premiums have more than doubled. »

The fact that insurance companies are made more discerning does not only have disadvantages, believes Lindsey Nelson from CFC. It is that they now offer upstream services to strengthen their customers’ cyber security. “As a cyber insurance company, we are of course interested in having fewer claims, as much as our customers want to suffer fewer attacks,” she explains. We have prevented 12,000 attacks in the last two years. »

For Walid Khayate, this is “the right approach” where insurance companies and customers find their account.

The insurance companies also have the technical capacity to intervene in the event of a cyber attack, which is often lacking in smaller companies. “Customers who do not have cyber insurance often ask me the question: Who do I call in the event of an incident? A TI friend, my law firm? reports Imran Ahmad of Norton Rose Fulbright Canada. With an insurance company, we have all service providers, a package which can be used immediately. »

To read on Sunday: “Digital identity: a solution, a thousand questions”, a file by Nicolas Bérubé in the context section.