Lloyd's is the undisputed leader in the global cyber insurance field. In 1999, Lloyd's underwrote the world's first cyber liability insurance policy. In 2015, the Lloyd's market contributed nearly one quarter of the premium income of the global cyber insurance market.
Lloyd's is the undisputed leader in the global cyber insurance field. In 1999, Lloyd's underwrote the world's first cyber liability insurance policy. In 2015, the Lloyd's market contributed nearly one quarter of the premium income of the global cyber insurance market.
Inga Beale said: 'Against the backdrop of a deteriorating global internet environment and intensifying cyber security threats, insurance is bound to become a necessity that escorts every industry.' Lloyd's cyber insurance premium income in 2015 was three times that of 2013. The number of syndicates underwriting cyber insurance in the Lloyd's London market rose from 22 in 2013 to 65 in 2016, and was expected to reach 77 in 2017. In 2015, cyber insurance premium income in the Lloyd's market was about US$2.5 billion, accounting for 20% to 25% of total global cyber insurance premiums; that figure is expected to grow to US$18 billion by 2025.
The Lloyd's City Risk Index report, jointly released by Lloyd's and the Cambridge Centre for Risk Studies at the University of Cambridge, shows that over the decade from 2015 to 2025, potential global economic losses triggered by cyberattacks could reach as much as US$294 billion. Cyberattack risk has already become a routine risk facing enterprises.
Lloyd's Cyberattack Risk Response Strategy
Cyberattack risk has become a prominent emerging risk for society, urgently requiring appropriate risk transfer mechanisms. Lloyd's focuses on the study of emerging risks and changing risks, so as to promptly innovate insurance solutions suited to new risks.
At the end of June 2016, Lloyd's released its 'Lloyd's Cyberattack Risk Response Strategy', part of which provides that by December 31, 2017, Lloyd's will:
- With the support of appropriate underwriting and capital, encourage continuous innovation in cyberattack insurance and reinsurance products;
- Deepen a comprehensive understanding of cyberattack risk accumulation, including measuring the potential losses from anonymous cyberattacks;
- Reduce the potential risk accumulation of anonymous cyberattacks through a number of concrete measures;
- Encourage appropriate revision of exclusion sub-clauses; for example, consideration may be given to extending the existing exclusions in war and terrorism insurance;
- Build Lloyd's professional reputation in cyber insurance among existing policyholders, potential customers, governments, and regulators.
Under the guidance of this strategy, Lloyd's, together with syndicates, industry experts, and professional consulting firms, has carried out a number of studies on cyber shock risk. Lloyd's believes that mandatory legislation on data breaches will be the main driver of growth in cyber insurance. The General Data Protection Regulation (GDPR), issued by the European Union in April 2016, will officially take effect after a two-year transition period to strengthen the supervision of enterprises' management of users' personal data. The General Data Protection Regulation (GDPR) provides for severe fines. For example, where user authorization has not been obtained, the general principles of data processing have been violated, the legitimate rights of data subjects have been infringed, or an enforcement order of a regulator has been defied, a penalty of up to 20 million euros or 4% of the company's global operating revenue will be imposed. The Regulation is a very tough protective instrument and can objectively promote an increase in the number of cyber insurance policies written at Lloyd's.
Lloyd's Cyber Insurance Products
But cyber insurance in the traditional sense has now changed considerably: today's insurance is not merely a risk transfer mechanism, but a concept of comprehensive risk control that includes how to handle emergencies, how to respond to reputational risk, and how to guard against operational risk.
Generally speaking, cyber risks are divided into first-party and third-party risks. The coverage provided by insurance products may cover risks involving one party or both.
First-party insurance covers the enterprise's own assets, which may include:
- Digital assets, such as damage to or interruption of data or software projects;
- Business interruption caused by network paralysis;
- Cyber extortion, such as hackers threatening to destroy or leak important corporate data;
- Customer notification costs, especially where, under legal or regulatory requirements, the company is obliged to notify customers of the security or breach of their information;
- Reputational damage: the reputational risk arising from default risk caused by data breaches or from customer churn;
- Cyber theft: the risk of theft of corporate digital assets or funds caused by stolen equipment or intrusion into systems and networks.
Third-party insurance covers the assets of others and usually includes:
- Security and privacy breaches, including the risks arising from related investigations, litigation costs, and civil compensation;
- Multimedia liability, covering litigation costs and civil compensation risks arising from privacy breaches, negligence, or defamatory statements in print or electronic media reports;
- Third-party data loss, including the risk of customer claims arising from denial of access or interruptions of systems or software.
In response to the above risks, Lloyd's mainly offers cyber risk solutions in the following seven areas:
Data Breach Response Insurance
A data breach incident can have a serious impact on an enterprise's performance and reputation. A data breach response policy goes beyond the scope of traditional liability insurance: it provides post-breach response services and public relations services, and covers the costs arising from customer notification, forensic investigation, customer credit management, and litigation, helping the enterprise deal with reputational risk.
Liability Insurance
A data breach can subject an enterprise to costly claims for breach of liability. This insurance covers third-party claims arising from a data breach and the related defense costs.
Legal Regulatory and Penalty Insurance
A data breach may also lead to significant regulatory penalties and fines, a risk that is greatly increased in an increasingly stringent regulatory environment. To the extent that coverage is legally permitted, this insurance provides enterprises with defense costs related to regulatory investigations.
Cyber Extortion Insurance
Malicious threats and extortion risks are on the rise. This insurance provides enterprises with the defense costs associated with restoring their affected systems.
Business Interruption Insurance
A cyber incident can cause significant losses of corporate revenue and bring business to a halt. This insurance covers loss of income caused by business interruption and information system downtime, and also includes services to help the enterprise restore its data, networks, and information systems.
Reputational Damage Insurance
A cyber incident may negatively affect an enterprise's reputation and thereby cause loss of income. This insurance covers the risk of loss of cooperation contracts and related financial losses caused by cyber incidents.
Third-Party Payment Data Security Standard Assessment and Penalty Insurance
An enterprise may, as a result of a payment card information breach, face the risk of penalties and assessments under third-party payment data security standards. This insurance covers losses arising from theft of payment card information, card reissuance, misuse of information, and the like.
The impact of cyber incidents on enterprises changes as cyber threats evolve and regulations continue to improve. Enterprises have to confront unprecedented risks such as business interruption, financial penalties, regulatory scrutiny, and reputational damage—all of which can pose serious threats to corporate profits, share prices, and even survival. Cyberattack risk is unavoidable; cyber insurance can help enterprises safeguard their financial stability. At present, China's cyber insurance market is still at a preliminary stage of development, and its market potential is enormous.
Source: Lloyd's