Significant cyber incidents (and insurance losses) you must know about
Actuarial careers
Industry topics
Claim your CPD points
In Part 2 of ‘One byte at a time: a series on cyber insurance’, Kitty Ho outlines the three types of cyber incidents you need to know about; malware attacks, DDoS attacks and data breaches.
In May 2017, the WannaCry ransomware worldwide attack affected more than 200,000 computers across 150 countries. WannaCry is a ransomware worm that encrypts files on compromised computers and demands a ransom payment for decryption (approximately US$300 – $600 in Bitcoin).
Computers with Microsoft Windows versions before Windows 10 are vulnerable to WannaCry if patch management was not applied. It propagated through EternalBlue, an exploit developed by the United States National Security Agency (NSA) for older Windows systems. EternalBlue was stolen and leaked by a group called “The Shadow Brokers” a few months prior to the attack.
According to Kaspersky Lab, the four most affected countries were Russia, Ukraine, India and Taiwan. In England and Scotland, the attack affected up to 70,000 devices in the National Health Service hospitals such as computers, MRI scanners, blood-storage fridges and theatre equipment, causing the services to turn away non-critical emergencies and diversion of ambulances.
Car manufacturers like Nissan in the UK and Renault had to halt production to stop the spread of the ransomware. Other infrastructure providers such as Spain’s Telefonica, FedEx and Deutsche Bahn were also affected.
A month later, the ‘NotPetya’ malware attack struck, affecting 12,500 machines through a hacked update of a major accounting software widely used in Ukraine. It spread to other countries through internal networks, locking disk contents and demanding a ransom payment. It was later discovered that even if users paid the ransom, their data could never be recovered because the malware could not revert its own changes, and there was no way for attackers to track individual Bitcoin payment ID’s.
Total reported economic costs are in excess of US$1 billion, with at least 2,000 companies affected including Maersk (Danish logistics company and world’s largest contain ship operated lost US$200 – $300 million in revenue), Merck & Co (US pharmaceutical), DLA Piper (multinational law firm), Reckitt Benckiser (British consumer goods), DHL (German logistics company), Mondelez (US food company) and Australia’s Cadbury’s Chocolate Factory Hobart.
US and UK intelligence agencies attributed the attack to the Russian government, implying a motive to cause damage to the Ukrainian economy, rather than financial gain. Interestingly, Mondelez’s insurer, Zurich, has denied the insurance claim , on the grounds that NotPeya is an “act of war” not covered by the policy. Mondelez is currently taking legal action against Zurich.
A denial-of-service attack (DoS attack) is when the cybercriminal seeks to make a computer or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. A distributed denial-of-service attack (DDoS attack) is where the incoming traffic flooding the victim from multiple sources such that it is difficult to block a single point of attack.
One such DDoS attacked happened in 2007 when hackers coordinated hundreds of thousands of computers in attacking government agencies and banks in Estonia . In 2017, a number of South Korean banks were threatened with a DDoS attack unless they pay a US $315,000 ransom in Bitcoin. In 2016, one of the largest domain name system infrastructure providers, Dyn, experienced a DDoS attack which in turn caused vast online disruption to popular sites such as Netflix, Twitter, Spotify, Reddit, PayPal and Pinterest.
DDoS attacks can have very significant financial costs associated with them. There are direct incident response costs such as costs to get the systems back online as well as damaged system repair or replacement costs. There will also be business interruption costs due to lost revenue and costs in attempting to rectify a company’s reputation post event. Just imagine the impact if a DDoS attack is to occur on a Black Friday or a Cyber Monday sale when the 2018 single day sales recorded at US$6.2 billion and US$7.9 billion respectively.
In a world where Internet of Things take prevalence and even your Dyson fan is always online, the opportunity for DDoS attacks can only grow.
Perhaps the type of cyber incident which triggers significant media attention is data breaches of high profile enterprises:
Data breach notification laws were first introduced in California in 2002 and progressively, similar laws were rolled out to the other 50 US states with Alabama enacting theirs in 2018. EU introduced the General Data Protection Regulation (GDPR) Legislation in May 2018 which has differences to the US laws including a broader application to “personal data” rather than just credit card and Social Security number information as well as timeliness of breach notification. At the beginning of 2020, Canada, California and Brazil are looking to introducing similar laws. Singapore and India are also considering adopting data breach reporting regimes.
