Fintech

Ransomware fueled insurers’ profits. It’s coming back to haunt them.

Paying off cyber ransoms made business sense — until it didn't.

A gas station pump that has a yellow sign on it that says "sorry out of service"

The Colonial Pipeline ransomware attack hit fuel supplies up and down the East Coast.

Photo: Sean Rayford/Getty Images

Idealists don't last long in the insurance industry. The sector has learned time and again that misaligned incentives lead to bad behavior: If you sell fire insurance, someone will eventually commit arson. If you price life insurance based on a medical checkup, arthritic grandpas will cut weight like they're about to go 12 rounds against Floyd "Money" Mayweather.

But insurers don't bemoan the human condition: They adapt to it. To remain profitable while discouraging unwanted behavior, insurance companies can raise premiums, set higher deductibles or allocate more funding to fraud detection.

Ransomware is rewriting the insurance rulebook. The rampant growth in digital extortion is confounding insurers, with losses from claims widening. An organized attack hit 200 businesses on Friday alone, security researchers said. And the phenomenon has also raised questions about whether the industry has itself to blame.

Cyber policies often explicitly cover ransom payments, or offer optional coverage. And some observers believe that by making it easier to just pay ransoms, insurers helped birth a highly-organized, multinational crime industry that generates billions of dollars annually. The same factors that once made the sector attractive to insure — its rapid growth, ambiguous risk profile and speedy claim resolution — have helped create a monster that insurers don't seem equipped to contain on their own.

Instead, government policy will likely be needed to save insurers, and their clients, from themselves. The trouble is that there's no easy way to put the cat back in the bag. Every policy prescription, from limiting ransom payments to hunting down crypto wallets, comes with its own set of challenges and unintended consequences. Without a silver bullet, many experts believe the proliferation of attacks should be addressed by governments in close collaboration with insurers and the corporations they seek to protect.

A good thing winding down

Prior to 2020, ransomware coverage stood out as one of the most attractive insurance sectors. Traditional coverage areas such as home and automotive insurance tend to grow at the same rate as the overall economy. Cyber insurance has grown at a far more rapid pace: Direct written premiums for property/casualty cyber insurance, which often include ransomware coverage, more than doubled from just over $1 billion in 2015 to $2.3 billion in 2019, according to Fitch Ratings.

"Cyber insurance is actually one of the few growth markets," Gerry Glombicki, a director at Fitch, told Protocol. Glombicki said that emerging lines of business tend to be more profitable before competitors rush in and push margins down.

Accordingly, cyber insurers enjoyed a long streak of handsome profits as their sector grew. Fitch data shows that insurers' direct loss ratio — a measure of the proportion of premiums that get paid back out to clients — never surpassed 50% between 2015 and 2019.

This room for profitability came in part because nobody knew how to price ransomware risk. With home and auto coverage, insurers have access to reams of data for pricing. Predicting the likelihood, frequency and cost of ransomware attacks proved to be much more difficult. To account for this uncertainty, insurers built a buffer into their premiums.

That proved to be a smart strategy, as the direct loss ratio nearly doubled in 2020 to reach 73%, up from 47% the year prior. Several prominent cyber insurers even reported standalone cyber insurance direct loss ratios for the U.S. market above 100%. Sompo Group reported a 114% direct loss ratio in 2020, and AIG reported 101%.

Janet Ruiz, a director of strategic communication at the Insurance Information Institute, noted a marked change in ransom payouts during this time period. "In 2018, losses were more in the hundreds of dollars," Ruiz told Protocol. "Now we're seeing up to tens of millions of dollars on some of the largest ransomware attacks."

One reason for the increased payouts is hackers have developed more-sophisticated methods of attack that can halt a company's operations entirely, versus just seizing data and threatening to disclose it. Operational downtime is often easier to price than a data breach, so it became easier for executives to justify paying a ransom.

This dynamic played out in late May's ransomware attack on JBS, the world's largest meat-processing company. The ransomware gang REvil was able to breach JBL's IT systems and halt operations at 13 of its plants. The company eventually paid an $11 million bitcoin ransom. Even though it said that the "vast majority" of its facilities were operational at the time of the payment, JBS explained that it paid up to prevent the risk of data being stolen.

Publicly-traded companies must disclose cyber breaches. But there aren't consistent requirements across private and public companies for reporting ransomware attacks and payments, so it can be difficult to gauge how often they occur. Still, many industry experts believe the frequency of attacks has also increased in recent years.

Ransomware-as-a-service is another driver of this trend. It allows hackers to develop code for a ransomware attack and then sell it to another criminal organization. The buyers were often criminal groups that wouldn't otherwise possess the technical know-how to perform an attack. It's significantly lowered the barriers to entry, while spreading the risks — ironically, financial concepts insurers could appreciate.

Some industry experts believe that the ease of payment helped drive ransomware revenue up in recent years.

Professor Josephine Wolff is a prominent proponent of this theory. As a professor of cybersecurity policy at The Fletcher School at Tufts University, Wolff researches ways to make cyber crime less profitable.

"There's a more controversial claim that's been made — that by covering these payments, the insurers are actually driving more ransomware to be directed at their clients," Wolff said. "I haven't seen a lot of strong evidence behind it."

Rather than ask whether hackers target those with insurance, Wolff thinks we should be asking whether having ransomware coverage makes it easier to pay. "There I worry the answer really is yes — that knowing that you purchased this insurance … turns the payment of the ransom into a standard cost of doing business," Wolff said. "It's the same way that if I got into a fender bender, I would just go to my insurance and say, 'OK, this is what I have insurance for.' Now there's an equivalent idea with ransomware."

The importance of securing a payment helps explain why some ransoms can seem small relative to the size of the business at stake. Colonial Pipeline, for instance, "only" ended up paying a $4.4 million ransom to fend off the attack that took down a 2.5-million-barrel-per-day piece of infrastructure.

Wolff cited Colonial Pipeline's decision to consult with its insurer in ransom negotiation proceedings: "That was not a decision made independent of the insurance context." She added, "I do worry about that — that insurers, in some cases perhaps even more than their clients, have an incentive to say, 'Let's sort of resolve this as quickly and as cheaply as possible.'"

Glombicki of Fitch noted that ransomware hackers want to get paid, but not to such an extent that they elicit undue attention. He said hackers are searching for a "sweet spot where you can maximize your profits but not really bring legislative and regulatory authority on you — and not kill the company, either."

A unified front

If hackers were once flying under the radar, they are now big, bright, obnoxious green dots hovering on the legislative agendas of policymakers worldwide. The question has now become what to do about it.

The French are leaning toward a guillotine-sharp solution: Cut off the money flow. Politicians at their Senate roundtable earlier this summer signaled their intention to ban ransomware payments altogether.

In response, Axa, one of the largest global insurance groups, announced that it would no longer write new ransomware policies for customers in France. In a statement to Protocol, Axa said it had "deemed it appropriate to suspend marketing until the consequences of these analyses are drawn and the framework for insurance intervention is clarified."

There are significant concerns surrounding an outright ban on ransom payments. Hackers often target hospitals and critical infrastructure, so not making a payment could result in significant human suffering, even deaths. Bearing that cost for the sake of preventing future attacks is a politically dangerous argument to make.

One workaround would be to ban corporations from paying ransoms, while still allowing hospitals and critical infrastructure administrators to comply with hackers' demands in high-stakes scenarios. However, that could just lead to making hospitals and critical infrastructure prime targets.

Even for companies, banning ransom payments could take a serious human toll. A ransomware attack could run a corporation into bankruptcy, leaving hundreds or thousands of employees without jobs. It could also expose clients' sensitive data.

"If you're a company, we want be careful not to ask you to commit suicide," said James Andrew Lewis, a senior vice president and director of the Strategic Technologies Program at the Center for Strategic and International Studies, a nonprofit policy research center. "If the only thing you have to offer a victim is 'Don't pay,' that's not attractive. But if you can make it part of a larger package of ransomware measures, I think it makes sense."

Recovery of cryptocurrency wallets is one of the newest tools in that package of ransomware measures. Last month, the Justice Department announced that the FBI recovered over half of the Colonial Pipeline ransom. On the surface it looked like a potential breakthrough — the ransomware industry can only exist if it has access to untraceable cryptocurrency payment systems.

"Cryptocurrencies themselves are not a silver bullet for avoiding this kind of disruption," Lewis said. He added that many of the lessons learned in dealing with general money laundering can be applied to ransomware payment tracing. "The basic lesson is follow the money … and identify where you can interfere with the flow."

What else can companies do? As is often the case, one of the most effective measures also happens to be the least exciting: cyber hygiene.

"A lot of this stuff is just the basics," Glombicki of Fitch said. "It's turning on multifactor authentication, it's making sure your employees don't fall for phishing scams, it's updating your patches."

It's tempting to believe companies will independently choose to upgrade their defenses in response to the growing threat of ransomware attacks. Lewis doesn't see it that way: "Companies figure out 'How much am I likely to lose?' [and] 'How much would it cost me to upgrade my defenses?'" he said. "If it costs more to upgrade than to just pay, they just pay."

That brings us back to Wolff's assertion that insurers stimulate the ransomware sector by making payments "a standard cost of doing business." Customers might not love it, but insurers could ultimately lower the attractiveness of ransomware by hiking cyber insurance premiums.

Already insurers are grading their clients' cyber hygiene practices, raising deductibles for companies with riskier profiles and in some cases asking them to partially self-insure. As ransomware costs continue to rise, insurers will continue to shift the cost of attacks back to the corporations. This might be painful for clients in the short term, but overall it could help diminish the prevalence of attacks.

The government could even accelerate this trend by limiting payouts or adding friction to the insurance settlement process.

"You don't want to tell your customer, 'I won't pay you,'" Lewis said, "but if you can say, 'Uncle Sam won't let me pay,' that's always better."

One thing that's certain is that demand for ransomware coverage is not going away. Sam Hodges, CEO of Vouch Insurance, noticed that more companies have been asking for cyber insurance and doing so earlier in their lifecycle. "You see all these events happening," Hodges said, "and it's only rational to think, 'What if this were to happen to me?'"

There's no quick fix to ransomware attacks, but a multifaceted approach — along with increased general awareness — could diminish the scale of the industry.

"The ransomware guys have put themselves in a bad position," Lewis said. "I was talking to a senior European intelligence official about a month ago and he said, 'Look, ransomware has become a national security threat in Western nations.' And so once you get into that arena, the ransomware folks are facing a much tougher set of competitors. And countries will be more willing to cooperate with each other to tamp down ransomware."

Wolff struck a more cautious note: "I go back and forth between feeling like we are only making very, very, very small, slow incremental steps towards cracking down on this. And then sometimes feeling like, 'Oh, we're so close to doing something big.'" She said whether the government steps up to take more impactful measures depends on the nature of the next wave of high-profile attacks.

And to any idealists still reading: There will be a next wave. Insurers can be sure of that.

Fintech

Plaid is striking back after Stripe entered its core business

Onboarding customers through identity verification and ACH transfers is a hot sector in fintech, and the two fast-growing fintechs are set to battle it out.

Plaid is looking to help banks and fintech companies with anything related to the onboarding of a customer onto a financial product, said Plaid CTO Jean-Denis Greze.

Photo: Plaid

Plaid is moving into identity verification in a crucial expansion beyond its roots connecting banks and fintechs — a move that could put it in more direct competition with Stripe, another company known for its financial software tools.

In conjunction with its Plaid Forum customer conference this week, the company is also announcing two products focused on ACH transfers as it moves into payments.

Keep Reading Show less
Tomio Geron

Tomio Geron ( @tomiogeron) is a San Francisco-based reporter covering fintech. He was previously a reporter and editor at The Wall Street Journal, covering venture capital and startups. Before that, he worked as a staff writer at Forbes, covering social media and venture capital, and also edited the Midas List of top tech investors. He has also worked at newspapers covering crime, courts, health and other topics. He can be reached at tgeron@protocol.com or tgeron@protonmail.com.

Sponsored Content

Foursquare data story: leveraging location data for site selection

We take a closer look at points of interest and foot traffic patterns to demonstrate how location data can be leveraged to inform better site selecti­on strategies.

Imagine: You’re the leader of a real estate team at a restaurant brand looking to open a new location in Manhattan. You have two options you’re evaluating: one site in SoHo, and another site in the Flatiron neighborhood. Which do you choose?

Keep Reading Show less
Workplace

Getting reproductive benefits at work could be a privacy nightmare

A growing number of tech companies are extending abortion-related travel benefits. Given privacy and legal fears, will employees be too scared to use them?

How employers can implement and discuss reproductive benefits in a way that puts employees at ease.

Photo: Sigrid Gombert via Getty Images

It’s about to be a lot harder to get an abortion in the United States. For many, it’s already hard. The result is that employers, including large companies, are being called upon to fill the abortion care gap. The likelihood of a Roe v. Wade reversal was the push some needed to extend benefits, with Microsoft and Tesla announcing abortion-related travel reimbursements in recent weeks. But the privacy and legal risks facing people in need of abortions loom large. If people have reason to fear texting friends for abortion resources, will they really want to confide in their company?

An employee doesn’t have “much to worry about” when it comes to health privacy, said employee benefits consultant Jessica Du Bois. “The HR director or whoever's in charge of the benefits program is not going to be sharing that information.” Employers have a duty to protect employee health data under HIPAA and a variety of state laws. Companies with self-funded health plans — in other words, most large companies — can see every prescription and service an employee receives. But the data is deidentified.

Keep Reading Show less
Lizzy Lawrence

Lizzy Lawrence ( @LizzyLaw_) is a reporter at Protocol, covering tools and productivity in the workplace. She's a recent graduate of the University of Michigan, where she studied sociology and international studies. She served as editor in chief of The Michigan Daily, her school's independent newspaper. She's based in D.C., and can be reached at llawrence@protocol.com.

Enterprise

VMware CEO Raghu Raghuram: Edge is growing faster than cloud

The now-standalone company is staking its immediate future on the multicloud era of IT and hybrid work, while anticipating increased demand for edge-computing software.

VMware CEO Raghu Raghuram spoke with Protocol about the company's future.

Photo: VMware

Nearly a year into his tenure as CEO, Raghu Raghuram believes VMware is well-positioned for the third phase of its evolution, but acknowledges its product transformation still needs some work.

The company, which pioneered the hypervisor and expanded to virtualized networking and storage with its vSphere operating environment, now is helping customers navigate a distributed, multicloud world and hybrid work with newfound freedom as an independent company after being spun off from Dell Technologies last November.

Keep Reading Show less
Donna Goodison

Donna Goodison (@dgoodison) is Protocol's senior reporter focusing on enterprise infrastructure technology, from the 'Big 3' cloud computing providers to data centers. She previously covered the public cloud at CRN after 15 years as a business reporter for the Boston Herald. Based in Massachusetts, she also has worked as a Boston Globe freelancer, business reporter at the Boston Business Journal and real estate reporter at Banker & Tradesman after toiling at weekly newspapers.

Workplace

Black colleges are still an underutilized market for recruiting tech talent

Big Tech is still trying to crack the code on hiring more Black workers despite years of partnerships with HBCUs.

Pictured is the first cohort in Accenture's Level Up program.

Photo: Accenture

As a business major at Prairie View A&M University in Prairie View, Texas, Sean Johnson had been on track to work in finance after graduating. But then his adviser mentioned a program that the historically Black university had with Accenture and Microsoft that was meant to function as a direct pipeline from Prairie View into roles in tech. It changed his entire career course.

Johnson had always had an interest in tech, and the prospect of being able to get a glimpse into the industry, as well as gain real, hands-on experience, appealed to him. By the end of the program, he had a full-time job offer at Accenture.

Keep Reading Show less
Amber Burton

Amber Burton (@amberbburton) is a reporter at Protocol. Previously, she covered personal finance and diversity in business at The Wall Street Journal. She earned an M.S. in Strategic Communications from Columbia University and B.A. in English and Journalism from Wake Forest University. She lives in North Carolina.

Latest Stories
Bulletins