Ransomware Insurance: Why Your Business Needs It

The ransomware problem keeps getting worse.

Ransomware accounted for 25% of all breaches in 2022, and the average ransomware attack costs $4.54 million. 

As ransomware attacks grow more expensive, widespread, and seemingly inevitable, having insurance coverage against this rising cyber threat has become essential for all modern businesses, both big and small.

What is Ransomware Insurance?

Ransomware insurance is a specific type of cyber insurance that helps policyholders recover from ransomware attacks and minimize the damage. This coverage compensates victims of ransomware attacks for financial loss caused by business interruption, data destruction, and ransom payments. Businesses without ransomware insurance must bear the high cost of a ransomware attack on their own.

Importance of Ransomware Insurance as Part of Your Cybersecurity Plan

Ransomware insurance is not a standalone insurance offering. Instead, ransomware coverage is often included as part of a cyber liability policy.

While it’s crucial to maintain a strong security posture to defend yourself against the threat of ransomware, a comprehensive cybersecurity strategy should also include cyber insurance with ransomware coverage. Time has shown that even when an organization has a sizable security team and extensive digital defenses in place, ransomware attacks can still impact them and inflict significant damage. This is even more of a concern for small businesses that typically don’t have a large security team or security tools budget.

The Increasing Frequency and Severity of Ransomware Attacks

There were 493 million ransomware attacks detected in 2022 alone — up significantly from ∼190 million in 2019. 

As the volume of ransomware attacks has been increasing, we’ve seen them grow in sophistication and tenacity, resulting in record losses that appear likely to keep surging this year. Cybersecurity Ventures predicts that by 2031, ransomware attacks will happen every two seconds and cause upwards of $265 billion in annual damages.

The lucrative nature of successful ransomware attacks makes it the cash cow of cyber crime. Attackers are putting significant resources into developing more aggressive and sophisticated data extortion attacks that can bypass existing security measures. 

Ransomware groups are also creating simpler “off-the-shelf” ransomware products, aka Ransomware-as-a-Service (RaaS), that less experienced hackers can purchase. This lowers the barrier to entry for launching a ransomware attack.

Managing Ransomware Risk

Since most businesses lack a reliable solution to prevent ransomware attacks, they must seek out other ways to manage this risk — especially as it grows in scale and damages. Ransomware coverage helps companies recover from the attacks they couldn’t prevent. 

In addition to helping policyholders recoup financial losses, ransomware insurance expedites the incident response by recommending proven remediation strategies and trusted service providers. 

Examples of Ransomware Attacks

Unfortunately, there are thousands of successful attacks to share as examples. Here are two that illustrate the sky-high risk of ransomware:

Attack on CNA Financial Exposes Personal Information of 75,000 People

One of America’s biggest insurance companies paid a $40 million dollar ransom — currently the largest ever — to resolve a ransomware attack after attackers stole troves of data and blocked access to company networks.

Despite calling in both law enforcement and security experts, CNA Financial saw no alternative and began negotiating with the attackers about a week after the attack. This and so many other examples highlight the deep financial damage of ransomware and the intense pressure on businesses to pay the ransom.  

City of Atlanta Spent $2.6M to Recover From Ransomware Attack

When hackers demanded a $51,000 ransom payment (in Bitcoin) from the city of Atlanta in 2018, government officials refused to pay. They decided it was better to spend money on recovering the city’s computer systems from an attack than to pay ransom. In order to restore the stolen data and get critical systems back online, the city spent over $2.6 million on consultants and emergency services. 

That still wasn’t enough to fix things — decades of digital records were lost forever. Ransom payments are expensive and keep growing, but as Atlanta shows, they are not the only or even the largest expense associated with a ransomware attack. 

Download the Report: Overcoming Ransomware: A Blueprint for Thriving in a Digital World

What Does Ransomware Insurance Cover?

Cyber insurance for ransomware covers the most expensive and most common consequences of a ransomware attack. Exact details vary depending on the policy and provider, but most ransomware coverage addresses these types of losses:

• Ransom payments: The cost of paying a ransom.
• Business interruption: Expenses related to restoring a company’s IT and data back to normal.
• Consultant services: The cost of hiring experts to provide specialized technical support.
• Reputational harm: The cost of hiring a PR firm to manage negative news coverage and reputational damage.
• Compliance violations: Fines for violating regulations like the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA).

Are There Exclusions or Limitations to Ransomware Insurance Coverage?

Like all types of insurance, ransomware insurance policies have maximum coverage limits. These are important to be aware of as the size of ransom demands and the overall cost of ransomware attacks continue to grow. 

Policies will also exclude certain types of attacks and damage — and how they define those exclusions matters. Questions you should ask include:

• What counts as a data extortion attack?
• Which computer systems are covered?
• How far does data restoration go? 
• What are the exclusions not covered by the policy?

One ransomware insurance policy may offer much greater coverage than another depending on the exclusions and limitations written into the terms.

Ransomware Insurance From At-Bay

Most ransomware insurance helps policyholders recover from an attack, but it doesn’t stop the attack from ever happening. Many businesses consider cyber insurance as the last line of defense when nothing else works. 

At-Bay takes a different approach. We combine insurance and security into an end-to-end InsurSec solution to help prevent ransomware attacks before they even happen, and also provide coverage for when they do. It’s a highly effective approach, as our claims data proves: At-Bay policyholders are 5X less likely to experience a ransomware attack compared to the industry average.¹

All of our policies include Active Risk Monitoring, which scans customers’ IT assets throughout the life of the policy to help them find weak spots most vulnerable to ransomware, and fix them, before hackers can exploit them.

At-Bay Stance™ provides another layer of protection for surplus Cyber and Tech E&O policyholders.² This market-leading security solution combines mission-critical security products and services that reduce cyber risk — all as part of your insurance policy.

Protect Yourself from Ransomware

The risk of ransomware may seem to be spiraling out of control, but cyber insurance from At-Bay can help you keep things in check. Contact your insurance broker to explore ransomware coverage options, so you can focus on what you do best: growing your business.

This document is intended for information purposes only and does not modify or invalidate any of the provisions, exclusions, terms, or conditions of the policy and endorsements. For specific terms and conditions, please refer to the coverage form. This information may not be used to modify any policy that might be issued, modify an existing policy, or imply that any claim is covered.

Footnotes

1. Frequency based on Primary and Excess Cyber and Tech Errors & Omissions losses reported and exposure earned through 9/30/2022, evaluated as of 10/1/2022. Coveware 2020 Ransomware Payments Report, Aon’s 2020 U.S. Cyber Market Update, At-Bay analysis.

2. Access to At-Bay Stance Exposure Manager and Managed Security is available to policyholders via the “Embedded Security” fee and the corresponding endorsement.