The growing threat of hackers and cybercriminals targeting government agencies has led a number of states to purchase cyber insurance to protect themselves - and their constituents.
As massive data breaches like Yahoo and Equifax dominate news headlines, a growing number of businesses have rushed to purchase cyber insurance policies. Last year, insurers wrote $1.35 billion in premiums, a 35% jump from 2015, according to Fitch Ratings.
Now, US states have begun following suit. In a survey of state CIOs, 38% reported having some type of cyber insurance this year, compared to 20% in 2015.
More than a dozen states now have cyber insurance policies. These policies cover losses and expenses if a government computer network is hacked. Insurers typically pick up the cost of investigating and restoring data, notifying those affected, and providing legal and public relations services and credit monitoring.
“It’s expensive. It’s a big budget item for us. But it’s absolutely worth it,” said Michael Hussey, Utah’s chief information officer. “You’re seeing breaches now that cost companies and states millions and millions of dollars.”
Montana was the first state to purchase cyber insurance, in 2011, said Lynne Pizzini, chief IT security officer. The timing couldn’t have been better.
Three years later, cybercriminals hacked into a server containing Department of Public Health and Human Services data, including clients’ names and Social Security numbers and some health information. More than a million people who could have been affected received letters from the state about the incident.
Pizzini said the insurance company helped with the mailings, set up a call center, and provided forensic investigation, legal and communications assistance, and credit monitoring.
“We used all of the services in our insurance policy,” she said. “It would have cost us a ton more than the premium we pay.”
In recent years, hackers have set their sights on state and local government networks due to the sensitive information they store, such as Social Security, bank account and credit card numbers on millions of people and businesses. Additionally, online activists - known as hacktivists - have hijacked government computer systems, defaced websites, and released data and emails to the public.
James Lynch, chief actuary for the Insurance Information Institute, an industry trade group, said selling cyber insurance to states is especially challenging.
“What states do is so diffuse and sprawling, and they deal with so many types of people and circumstances that it’s difficult for an insurance company to fully get a grasp on what those risks are and underwrite them all,” Mr. Lynch said.
It can be equally challenging for those purchasing cyber insurance, he added.
“When you buy an auto policy, you have a pretty good idea what’s in it. The terminology is highly standardized. It’s been vetted through the courts,” Lynch said. “You don’t have that in cyber because the product is so new. The actual things being covered also vary greatly from policy to policy.”
Also, government agencies sometimes don’t understand the risks or what kind of coverage they’ll need, cyber experts say.
“Some states and local governments don’t even know where their data is or what they’ve got,” said Dan Lohrmann, chief security officer for Security Mentor, a national security training firm that works with states. “So when you start having to give the insurer a list of how many servers you have and what systems are included, it gets pretty complicated.”
Hussey said Utah first bought a policy in 2015, three years after a data breach of a Department of Health server exposed 780,000 residents’ personal information to hackers. The state spent millions of dollars to deal with the aftermath, including paying for credit monitoring and legal fees and conducting a security assessment of all state servers.
“We check what we’re supposed to be checking,” he said. “But with cyber, if one little thing is overlooked or you have bad luck and leave something undone, you’d hate to be left holding the bag to cover that.”
Utah now pays $230,000 a year for $10 million in cyber coverage and has a $1 million deductible. The policy covers every agency in the executive branch.
So far, the state hasn’t had any big data breaches that would require filing a claim, but that doesn’t mean it won’t happen in the future, Hussey said.
While having a cyber insurance policy can go a long way in the event of a breach, Hussey and IT officials in other states caution that it should not be viewed as a substitute for a comprehensive security program. States need to continue to invest in security, keep their technology updated, and be prepared to defend their networks against cybercriminals.
Unsure if a cyber liability policy is right for you? Uncertain about your organizations cyber exposures? Are you confident that if breached, your cyber policy will cover the loss? Let Breadcrumb help you navigate all these questions and more. Contact us today for a no-obligation consultation.