Fintech

Ransomware fueled insurers’ profits. It’s coming back to haunt them.

Paying off cyber ransoms made business sense — until it didn't.

A gas station pump that has a yellow sign on it that says "sorry out of service"

The Colonial Pipeline ransomware attack hit fuel supplies up and down the East Coast.

Photo: Sean Rayford/Getty Images

Idealists don't last long in the insurance industry. The sector has learned time and again that misaligned incentives lead to bad behavior: If you sell fire insurance, someone will eventually commit arson. If you price life insurance based on a medical checkup, arthritic grandpas will cut weight like they're about to go 12 rounds against Floyd "Money" Mayweather.

But insurers don't bemoan the human condition: They adapt to it. To remain profitable while discouraging unwanted behavior, insurance companies can raise premiums, set higher deductibles or allocate more funding to fraud detection.

Ransomware is rewriting the insurance rulebook. The rampant growth in digital extortion is confounding insurers, with losses from claims widening. An organized attack hit 200 businesses on Friday alone, security researchers said. And the phenomenon has also raised questions about whether the industry has itself to blame.

Cyber policies often explicitly cover ransom payments, or offer optional coverage. And some observers believe that by making it easier to just pay ransoms, insurers helped birth a highly-organized, multinational crime industry that generates billions of dollars annually. The same factors that once made the sector attractive to insure — its rapid growth, ambiguous risk profile and speedy claim resolution — have helped create a monster that insurers don't seem equipped to contain on their own.

Instead, government policy will likely be needed to save insurers, and their clients, from themselves. The trouble is that there's no easy way to put the cat back in the bag. Every policy prescription, from limiting ransom payments to hunting down crypto wallets, comes with its own set of challenges and unintended consequences. Without a silver bullet, many experts believe the proliferation of attacks should be addressed by governments in close collaboration with insurers and the corporations they seek to protect.

A good thing winding down

Prior to 2020, ransomware coverage stood out as one of the most attractive insurance sectors. Traditional coverage areas such as home and automotive insurance tend to grow at the same rate as the overall economy. Cyber insurance has grown at a far more rapid pace: Direct written premiums for property/casualty cyber insurance, which often include ransomware coverage, more than doubled from just over $1 billion in 2015 to $2.3 billion in 2019, according to Fitch Ratings.

"Cyber insurance is actually one of the few growth markets," Gerry Glombicki, a director at Fitch, told Protocol. Glombicki said that emerging lines of business tend to be more profitable before competitors rush in and push margins down.

Accordingly, cyber insurers enjoyed a long streak of handsome profits as their sector grew. Fitch data shows that insurers' direct loss ratio — a measure of the proportion of premiums that get paid back out to clients — never surpassed 50% between 2015 and 2019.

This room for profitability came in part because nobody knew how to price ransomware risk. With home and auto coverage, insurers have access to reams of data for pricing. Predicting the likelihood, frequency and cost of ransomware attacks proved to be much more difficult. To account for this uncertainty, insurers built a buffer into their premiums.

That proved to be a smart strategy, as the direct loss ratio nearly doubled in 2020 to reach 73%, up from 47% the year prior. Several prominent cyber insurers even reported standalone cyber insurance direct loss ratios for the U.S. market above 100%. Sompo Group reported a 114% direct loss ratio in 2020, and AIG reported 101%.

Janet Ruiz, a director of strategic communication at the Insurance Information Institute, noted a marked change in ransom payouts during this time period. "In 2018, losses were more in the hundreds of dollars," Ruiz told Protocol. "Now we're seeing up to tens of millions of dollars on some of the largest ransomware attacks."

One reason for the increased payouts is hackers have developed more-sophisticated methods of attack that can halt a company's operations entirely, versus just seizing data and threatening to disclose it. Operational downtime is often easier to price than a data breach, so it became easier for executives to justify paying a ransom.

This dynamic played out in late May's ransomware attack on JBS, the world's largest meat-processing company. The ransomware gang REvil was able to breach JBL's IT systems and halt operations at 13 of its plants. The company eventually paid an $11 million bitcoin ransom. Even though it said that the "vast majority" of its facilities were operational at the time of the payment, JBS explained that it paid up to prevent the risk of data being stolen.

Publicly-traded companies must disclose cyber breaches. But there aren't consistent requirements across private and public companies for reporting ransomware attacks and payments, so it can be difficult to gauge how often they occur. Still, many industry experts believe the frequency of attacks has also increased in recent years.

Ransomware-as-a-service is another driver of this trend. It allows hackers to develop code for a ransomware attack and then sell it to another criminal organization. The buyers were often criminal groups that wouldn't otherwise possess the technical know-how to perform an attack. It's significantly lowered the barriers to entry, while spreading the risks — ironically, financial concepts insurers could appreciate.

Some industry experts believe that the ease of payment helped drive ransomware revenue up in recent years.

Professor Josephine Wolff is a prominent proponent of this theory. As a professor of cybersecurity policy at The Fletcher School at Tufts University, Wolff researches ways to make cyber crime less profitable.

"There's a more controversial claim that's been made — that by covering these payments, the insurers are actually driving more ransomware to be directed at their clients," Wolff said. "I haven't seen a lot of strong evidence behind it."

Rather than ask whether hackers target those with insurance, Wolff thinks we should be asking whether having ransomware coverage makes it easier to pay. "There I worry the answer really is yes — that knowing that you purchased this insurance … turns the payment of the ransom into a standard cost of doing business," Wolff said. "It's the same way that if I got into a fender bender, I would just go to my insurance and say, 'OK, this is what I have insurance for.' Now there's an equivalent idea with ransomware."

The importance of securing a payment helps explain why some ransoms can seem small relative to the size of the business at stake. Colonial Pipeline, for instance, "only" ended up paying a $4.4 million ransom to fend off the attack that took down a 2.5-million-barrel-per-day piece of infrastructure.

Wolff cited Colonial Pipeline's decision to consult with its insurer in ransom negotiation proceedings: "That was not a decision made independent of the insurance context." She added, "I do worry about that — that insurers, in some cases perhaps even more than their clients, have an incentive to say, 'Let's sort of resolve this as quickly and as cheaply as possible.'"

Glombicki of Fitch noted that ransomware hackers want to get paid, but not to such an extent that they elicit undue attention. He said hackers are searching for a "sweet spot where you can maximize your profits but not really bring legislative and regulatory authority on you — and not kill the company, either."

A unified front

If hackers were once flying under the radar, they are now big, bright, obnoxious green dots hovering on the legislative agendas of policymakers worldwide. The question has now become what to do about it.

The French are leaning toward a guillotine-sharp solution: Cut off the money flow. Politicians at their Senate roundtable earlier this summer signaled their intention to ban ransomware payments altogether.

In response, Axa, one of the largest global insurance groups, announced that it would no longer write new ransomware policies for customers in France. In a statement to Protocol, Axa said it had "deemed it appropriate to suspend marketing until the consequences of these analyses are drawn and the framework for insurance intervention is clarified."

There are significant concerns surrounding an outright ban on ransom payments. Hackers often target hospitals and critical infrastructure, so not making a payment could result in significant human suffering, even deaths. Bearing that cost for the sake of preventing future attacks is a politically dangerous argument to make.

One workaround would be to ban corporations from paying ransoms, while still allowing hospitals and critical infrastructure administrators to comply with hackers' demands in high-stakes scenarios. However, that could just lead to making hospitals and critical infrastructure prime targets.

Even for companies, banning ransom payments could take a serious human toll. A ransomware attack could run a corporation into bankruptcy, leaving hundreds or thousands of employees without jobs. It could also expose clients' sensitive data.

"If you're a company, we want be careful not to ask you to commit suicide," said James Andrew Lewis, a senior vice president and director of the Strategic Technologies Program at the Center for Strategic and International Studies, a nonprofit policy research center. "If the only thing you have to offer a victim is 'Don't pay,' that's not attractive. But if you can make it part of a larger package of ransomware measures, I think it makes sense."

Recovery of cryptocurrency wallets is one of the newest tools in that package of ransomware measures. Last month, the Justice Department announced that the FBI recovered over half of the Colonial Pipeline ransom. On the surface it looked like a potential breakthrough — the ransomware industry can only exist if it has access to untraceable cryptocurrency payment systems.

"Cryptocurrencies themselves are not a silver bullet for avoiding this kind of disruption," Lewis said. He added that many of the lessons learned in dealing with general money laundering can be applied to ransomware payment tracing. "The basic lesson is follow the money … and identify where you can interfere with the flow."

What else can companies do? As is often the case, one of the most effective measures also happens to be the least exciting: cyber hygiene.

"A lot of this stuff is just the basics," Glombicki of Fitch said. "It's turning on multifactor authentication, it's making sure your employees don't fall for phishing scams, it's updating your patches."

It's tempting to believe companies will independently choose to upgrade their defenses in response to the growing threat of ransomware attacks. Lewis doesn't see it that way: "Companies figure out 'How much am I likely to lose?' [and] 'How much would it cost me to upgrade my defenses?'" he said. "If it costs more to upgrade than to just pay, they just pay."

That brings us back to Wolff's assertion that insurers stimulate the ransomware sector by making payments "a standard cost of doing business." Customers might not love it, but insurers could ultimately lower the attractiveness of ransomware by hiking cyber insurance premiums.

Already insurers are grading their clients' cyber hygiene practices, raising deductibles for companies with riskier profiles and in some cases asking them to partially self-insure. As ransomware costs continue to rise, insurers will continue to shift the cost of attacks back to the corporations. This might be painful for clients in the short term, but overall it could help diminish the prevalence of attacks.

The government could even accelerate this trend by limiting payouts or adding friction to the insurance settlement process.

"You don't want to tell your customer, 'I won't pay you,'" Lewis said, "but if you can say, 'Uncle Sam won't let me pay,' that's always better."

One thing that's certain is that demand for ransomware coverage is not going away. Sam Hodges, CEO of Vouch Insurance, noticed that more companies have been asking for cyber insurance and doing so earlier in their lifecycle. "You see all these events happening," Hodges said, "and it's only rational to think, 'What if this were to happen to me?'"

There's no quick fix to ransomware attacks, but a multifaceted approach — along with increased general awareness — could diminish the scale of the industry.

"The ransomware guys have put themselves in a bad position," Lewis said. "I was talking to a senior European intelligence official about a month ago and he said, 'Look, ransomware has become a national security threat in Western nations.' And so once you get into that arena, the ransomware folks are facing a much tougher set of competitors. And countries will be more willing to cooperate with each other to tamp down ransomware."

Wolff struck a more cautious note: "I go back and forth between feeling like we are only making very, very, very small, slow incremental steps towards cracking down on this. And then sometimes feeling like, 'Oh, we're so close to doing something big.'" She said whether the government steps up to take more impactful measures depends on the nature of the next wave of high-profile attacks.

And to any idealists still reading: There will be a next wave. Insurers can be sure of that.

Fintech

Gavin Newsom shows crypto some California love

“A more flexible approach is needed,” Gov. Newsom said in rejecting a bill that would require crypto companies to get a state license.

Strong bipartisan support wasn’t enough to convince Newsom that requiring crypto companies to register with the state’s Department of Financial Protection and Innovation is the smart path for California.

Photo: Jerod Harris/Getty Images for Vox Media

The Digital Financial Assets Law seemed like a legislative slam dunk in California for critics of the crypto industry.

But strong bipartisan support — it passed 71-0 in the state assembly and 31-6 in the Senate — wasn’t enough to convince Gov. Gavin Newsom that requiring crypto companies to register with the state’s Department of Financial Protection and Innovation is the smart path for California.

Keep Reading Show less
Benjamin Pimentel

Benjamin Pimentel ( @benpimentel) covers crypto and fintech from San Francisco. He has reported on many of the biggest tech stories over the past 20 years for the San Francisco Chronicle, Dow Jones MarketWatch and Business Insider, from the dot-com crash, the rise of cloud computing, social networking and AI to the impact of the Great Recession and the COVID crisis on Silicon Valley and beyond. He can be reached at bpimentel@protocol.com or via Google Voice at (925) 307-9342.

Sponsored Content

Great products are built on strong patents

Experts say robust intellectual property protection is essential to ensure the long-term R&D required to innovate and maintain America's technology leadership.

Every great tech product that you rely on each day, from the smartphone in your pocket to your music streaming service and navigational system in the car, shares one important thing: part of its innovative design is protected by intellectual property (IP) laws.

From 5G to artificial intelligence, IP protection offers a powerful incentive for researchers to create ground-breaking products, and governmental leaders say its protection is an essential part of maintaining US technology leadership. To quote Secretary of Commerce Gina Raimondo: "intellectual property protection is vital for American innovation and entrepreneurship.”

Keep Reading Show less
James Daly
James Daly has a deep knowledge of creating brand voice identity, including understanding various audiences and targeting messaging accordingly. He enjoys commissioning, editing, writing, and business development, particularly in launching new ventures and building passionate audiences. Daly has led teams large and small to multiple awards and quantifiable success through a strategy built on teamwork, passion, fact-checking, intelligence, analytics, and audience growth while meeting budget goals and production deadlines in fast-paced environments. Daly is the Editorial Director of 2030 Media and a contributor at Wired.
Workplace

Slack’s rallying cry at Dreamforce: No more meetings

It’s not all cartoon bears and therapy pigs — work conferences are a good place to talk about the future of work.

“We want people to be able to work in whatever way works for them with flexible schedules, in meetings and out of meetings,” Slack chief product officer Tamar Yehoshua told Protocol at Dreamforce 2022.

Photo: Marlena Sloss/Bloomberg via Getty Images

Dreamforce is primarily Salesforce’s show. But Slack wasn’t to be left out, especially as the primary connector between Salesforce and the mainstream working world.

The average knowledge worker spends more time using a communication tool like Slack than a CRM like Salesforce, positioning it as the best Salesforce product to concern itself with the future of work. In between meeting a therapy pig and meditating by the Dreamforce waterfall, Protocol sat down with several Slack execs and conference-goers to chat about the shifting future.

Keep Reading Show less
Lizzy Lawrence

Lizzy Lawrence ( @LizzyLaw_) is a reporter at Protocol, covering tools and productivity in the workplace. She's a recent graduate of the University of Michigan, where she studied sociology and international studies. She served as editor in chief of The Michigan Daily, her school's independent newspaper. She's based in D.C., and can be reached at llawrence@protocol.com.

LA is a growing tech hub. But not everyone may fit.

LA has a housing crisis similar to Silicon Valley’s. And single-family-zoning laws are mostly to blame.

As the number of tech companies in the region grows, so does the number of tech workers, whose high salaries put them at an advantage in both LA's renting and buying markets.

Photo: Nat Rubio-Licht/Protocol

LA’s tech scene is on the rise. The number of unicorn companies in Los Angeles is growing, and the city has become the third-largest startup ecosystem nationally behind the Bay Area and New York with more than 4,000 VC-backed startups in industries ranging from aerospace to creators. As the number of tech companies in the region grows, so does the number of tech workers. The city is quickly becoming more and more like Silicon Valley — a new startup and a dozen tech workers on every corner and companies like Google, Netflix, and Twitter setting up offices there.

But with growth comes growing pains. Los Angeles, especially the burgeoning Silicon Beach area — which includes Santa Monica, Venice, and Marina del Rey — shares something in common with its namesake Silicon Valley: a severe lack of housing.

Keep Reading Show less
Nat Rubio-Licht

Nat Rubio-Licht is a Los Angeles-based news writer at Protocol. They graduated from Syracuse University with a degree in newspaper and online journalism in May 2020. Prior to joining the team, they worked at the Los Angeles Business Journal as a technology and aerospace reporter.

Policy

SFPD can now surveil a private camera network funded by Ripple chair

The San Francisco Board of Supervisors approved a policy that the ACLU and EFF argue will further criminalize marginalized groups.

SFPD will be able to temporarily tap into private surveillance networks in certain circumstances.

Photo: Justin Sullivan/Getty Images

Ripple chairman and co-founder Chris Larsen has been funding a network of security cameras throughout San Francisco for a decade. Now, the city has given its police department the green light to monitor the feeds from those cameras — and any other private surveillance devices in the city — in real time, whether or not a crime has been committed.

This week, San Francisco’s Board of Supervisors approved a controversial plan to allow SFPD to temporarily tap into private surveillance networks during life-threatening emergencies, large events, and in the course of criminal investigations, including investigations of misdemeanors. The decision came despite fervent opposition from groups, including the ACLU of Northern California and the Electronic Frontier Foundation, which say the police department’s new authority will be misused against protesters and marginalized groups in a city that has been a bastion for both.

Keep Reading Show less
Issie Lapowsky

Issie Lapowsky ( @issielapowsky) is Protocol's chief correspondent, covering the intersection of technology, politics, and national affairs. She also oversees Protocol's fellowship program. Previously, she was a senior writer at Wired, where she covered the 2016 election and the Facebook beat in its aftermath. Prior to that, Issie worked as a staff writer for Inc. magazine, writing about small business and entrepreneurship. She has also worked as an on-air contributor for CBS News and taught a graduate-level course at New York University's Center for Publishing on how tech giants have affected publishing.

Latest Stories
Bulletins