Top findings from our 2018 cyber claims data

Over the course of 2018, we saw a number of pieces of data breach legislation come into play, from the GDPR in Europe to the Digital Privacy Act in Canada. In some territories, like Australia where they introduced the Notifiable Data Breaches scheme, this led to a spike in privacy breach claims as overly-cautious businesses notified more breaches than was probably necessary. While these pieces of legislation are important, we should avoid seeing cyber insurance exclusively through this lens. It’s important to stress that while notification laws might prompt consideration of cyber amongst businesses and seem to be driving claims, cyber insurance is not just about covering the losses associated with a data breach. It’s much broader than that and our data shows it provides cover for a whole host of cyber-related risks, ranging from theft of funds and cyber extortion to system damage and business interruption.

Whether a business suffers a data breach, a ransomware attack, or accidentally sends money to a fraudulent bank account, human error plays a part in the vast majority of the claims we see. For example, non-malicious data breaches refer entirely to those caused by lost laptops and other devices or doing things like inadvertently sharing sensitive data. In addition, many funds transfer fraud requests are due to employees failing to follow-up urgent wire transfer requests with a phone call. Even malicious data breaches, ransomware and extortion claims often begin with hackers gaining system access through phishing links, which employees unwittingly click on. This highlights the importance of employee training on cyber risks, particularly phishing emails which can lead to a whole range of issues.

There are several things which are levelling the playing field when it comes to cyber claims. The first is the aforementioned breach notification laws. Previously, claims in the US slanted heavily towards data breaches because notification laws have long been in effect. As cybercrime grows in the US and breach notification laws drive privacy claims in other territories, this should even out. The second is also something briefly touched upon already – real-time payment facilities. The UK’s funds transfer fraud rates are noticeably higher, and the main driver of this difference is the UK’s implementation of the Faster Payments Service (FPS), which allows businesses and consumers to transfer funds instantaneously instead of it taking the day or two it might take in other territories. While convenient, this also means that in the time it takes to spot a fraud, the funds are often irretrievable. As real-time payment facilities are taken up in other places, we expect this to lead to higher levels of funds transfer fraud in those territories in the coming years.