Source Code: Your daily look at what matters in tech.

fintechfintechauthorHirsh ChitkaraNoneGet access to the Protocol | Fintech newsletter, research, news alerts and events.f6ea366a38
×

Get access to Protocol

Your information will be used in accordance with our Privacy Policy

I’m already a subscriber
Protocol | Fintech

Ransomware fueled insurers’ profits. It’s coming back to haunt them.

Paying off cyber ransoms made business sense — until it didn't.

A gas station pump that has a yellow sign on it that says "sorry out of service"

The Colonial Pipeline ransomware attack hit fuel supplies up and down the East Coast.

Photo: Sean Rayford/Getty Images

Idealists don't last long in the insurance industry. The sector has learned time and again that misaligned incentives lead to bad behavior: If you sell fire insurance, someone will eventually commit arson. If you price life insurance based on a medical checkup, arthritic grandpas will cut weight like they're about to go 12 rounds against Floyd "Money" Mayweather.

But insurers don't bemoan the human condition: They adapt to it. To remain profitable while discouraging unwanted behavior, insurance companies can raise premiums, set higher deductibles or allocate more funding to fraud detection.

Ransomware is rewriting the insurance rulebook. The rampant growth in digital extortion is confounding insurers, with losses from claims widening. An organized attack hit 200 businesses on Friday alone, security researchers said. And the phenomenon has also raised questions about whether the industry has itself to blame.

Cyber policies often explicitly cover ransom payments, or offer optional coverage. And some observers believe that by making it easier to just pay ransoms, insurers helped birth a highly-organized, multinational crime industry that generates billions of dollars annually. The same factors that once made the sector attractive to insure — its rapid growth, ambiguous risk profile and speedy claim resolution — have helped create a monster that insurers don't seem equipped to contain on their own.

Instead, government policy will likely be needed to save insurers, and their clients, from themselves. The trouble is that there's no easy way to put the cat back in the bag. Every policy prescription, from limiting ransom payments to hunting down crypto wallets, comes with its own set of challenges and unintended consequences. Without a silver bullet, many experts believe the proliferation of attacks should be addressed by governments in close collaboration with insurers and the corporations they seek to protect.

A good thing winding down

Prior to 2020, ransomware coverage stood out as one of the most attractive insurance sectors. Traditional coverage areas such as home and automotive insurance tend to grow at the same rate as the overall economy. Cyber insurance has grown at a far more rapid pace: Direct written premiums for property/casualty cyber insurance, which often include ransomware coverage, more than doubled from just over $1 billion in 2015 to $2.3 billion in 2019, according to Fitch Ratings.

"Cyber insurance is actually one of the few growth markets," Gerry Glombicki, a director at Fitch, told Protocol. Glombicki said that emerging lines of business tend to be more profitable before competitors rush in and push margins down.

Accordingly, cyber insurers enjoyed a long streak of handsome profits as their sector grew. Fitch data shows that insurers' direct loss ratio — a measure of the proportion of premiums that get paid back out to clients — never surpassed 50% between 2015 and 2019.

This room for profitability came in part because nobody knew how to price ransomware risk. With home and auto coverage, insurers have access to reams of data for pricing. Predicting the likelihood, frequency and cost of ransomware attacks proved to be much more difficult. To account for this uncertainty, insurers built a buffer into their premiums.

That proved to be a smart strategy, as the direct loss ratio nearly doubled in 2020 to reach 73%, up from 47% the year prior. Several prominent cyber insurers even reported standalone cyber insurance direct loss ratios for the U.S. market above 100%. Sompo Group reported a 114% direct loss ratio in 2020, and AIG reported 101%.

Janet Ruiz, a director of strategic communication at the Insurance Information Institute, noted a marked change in ransom payouts during this time period. "In 2018, losses were more in the hundreds of dollars," Ruiz told Protocol. "Now we're seeing up to tens of millions of dollars on some of the largest ransomware attacks."

One reason for the increased payouts is hackers have developed more-sophisticated methods of attack that can halt a company's operations entirely, versus just seizing data and threatening to disclose it. Operational downtime is often easier to price than a data breach, so it became easier for executives to justify paying a ransom.

This dynamic played out in late May's ransomware attack on JBS, the world's largest meat-processing company. The ransomware gang REvil was able to breach JBL's IT systems and halt operations at 13 of its plants. The company eventually paid an $11 million bitcoin ransom. Even though it said that the "vast majority" of its facilities were operational at the time of the payment, JBS explained that it paid up to prevent the risk of data being stolen.

Publicly-traded companies must disclose cyber breaches. But there aren't consistent requirements across private and public companies for reporting ransomware attacks and payments, so it can be difficult to gauge how often they occur. Still, many industry experts believe the frequency of attacks has also increased in recent years.

Ransomware-as-a-service is another driver of this trend. It allows hackers to develop code for a ransomware attack and then sell it to another criminal organization. The buyers were often criminal groups that wouldn't otherwise possess the technical know-how to perform an attack. It's significantly lowered the barriers to entry, while spreading the risks — ironically, financial concepts insurers could appreciate.

Some industry experts believe that the ease of payment helped drive ransomware revenue up in recent years.

Professor Josephine Wolff is a prominent proponent of this theory. As a professor of cybersecurity policy at The Fletcher School at Tufts University, Wolff researches ways to make cyber crime less profitable.

"There's a more controversial claim that's been made — that by covering these payments, the insurers are actually driving more ransomware to be directed at their clients," Wolff said. "I haven't seen a lot of strong evidence behind it."

Rather than ask whether hackers target those with insurance, Wolff thinks we should be asking whether having ransomware coverage makes it easier to pay. "There I worry the answer really is yes — that knowing that you purchased this insurance … turns the payment of the ransom into a standard cost of doing business," Wolff said. "It's the same way that if I got into a fender bender, I would just go to my insurance and say, 'OK, this is what I have insurance for.' Now there's an equivalent idea with ransomware."

The importance of securing a payment helps explain why some ransoms can seem small relative to the size of the business at stake. Colonial Pipeline, for instance, "only" ended up paying a $4.4 million ransom to fend off the attack that took down a 2.5-million-barrel-per-day piece of infrastructure.

Wolff cited Colonial Pipeline's decision to consult with its insurer in ransom negotiation proceedings: "That was not a decision made independent of the insurance context." She added, "I do worry about that — that insurers, in some cases perhaps even more than their clients, have an incentive to say, 'Let's sort of resolve this as quickly and as cheaply as possible.'"

Glombicki of Fitch noted that ransomware hackers want to get paid, but not to such an extent that they elicit undue attention. He said hackers are searching for a "sweet spot where you can maximize your profits but not really bring legislative and regulatory authority on you — and not kill the company, either."

A unified front

If hackers were once flying under the radar, they are now big, bright, obnoxious green dots hovering on the legislative agendas of policymakers worldwide. The question has now become what to do about it.

The French are leaning toward a guillotine-sharp solution: Cut off the money flow. Politicians at their Senate roundtable earlier this summer signaled their intention to ban ransomware payments altogether.

In response, Axa, one of the largest global insurance groups, announced that it would no longer write new ransomware policies for customers in France. In a statement to Protocol, Axa said it had "deemed it appropriate to suspend marketing until the consequences of these analyses are drawn and the framework for insurance intervention is clarified."

There are significant concerns surrounding an outright ban on ransom payments. Hackers often target hospitals and critical infrastructure, so not making a payment could result in significant human suffering, even deaths. Bearing that cost for the sake of preventing future attacks is a politically dangerous argument to make.

One workaround would be to ban corporations from paying ransoms, while still allowing hospitals and critical infrastructure administrators to comply with hackers' demands in high-stakes scenarios. However, that could just lead to making hospitals and critical infrastructure prime targets.

Even for companies, banning ransom payments could take a serious human toll. A ransomware attack could run a corporation into bankruptcy, leaving hundreds or thousands of employees without jobs. It could also expose clients' sensitive data.

"If you're a company, we want be careful not to ask you to commit suicide," said James Andrew Lewis, a senior vice president and director of the Strategic Technologies Program at the Center for Strategic and International Studies, a nonprofit policy research center. "If the only thing you have to offer a victim is 'Don't pay,' that's not attractive. But if you can make it part of a larger package of ransomware measures, I think it makes sense."

Recovery of cryptocurrency wallets is one of the newest tools in that package of ransomware measures. Last month, the Justice Department announced that the FBI recovered over half of the Colonial Pipeline ransom. On the surface it looked like a potential breakthrough — the ransomware industry can only exist if it has access to untraceable cryptocurrency payment systems.

"Cryptocurrencies themselves are not a silver bullet for avoiding this kind of disruption," Lewis said. He added that many of the lessons learned in dealing with general money laundering can be applied to ransomware payment tracing. "The basic lesson is follow the money … and identify where you can interfere with the flow."

What else can companies do? As is often the case, one of the most effective measures also happens to be the least exciting: cyber hygiene.

"A lot of this stuff is just the basics," Glombicki of Fitch said. "It's turning on multifactor authentication, it's making sure your employees don't fall for phishing scams, it's updating your patches."

It's tempting to believe companies will independently choose to upgrade their defenses in response to the growing threat of ransomware attacks. Lewis doesn't see it that way: "Companies figure out 'How much am I likely to lose?' [and] 'How much would it cost me to upgrade my defenses?'" he said. "If it costs more to upgrade than to just pay, they just pay."

That brings us back to Wolff's assertion that insurers stimulate the ransomware sector by making payments "a standard cost of doing business." Customers might not love it, but insurers could ultimately lower the attractiveness of ransomware by hiking cyber insurance premiums.

Already insurers are grading their clients' cyber hygiene practices, raising deductibles for companies with riskier profiles and in some cases asking them to partially self-insure. As ransomware costs continue to rise, insurers will continue to shift the cost of attacks back to the corporations. This might be painful for clients in the short term, but overall it could help diminish the prevalence of attacks.

The government could even accelerate this trend by limiting payouts or adding friction to the insurance settlement process.

"You don't want to tell your customer, 'I won't pay you,'" Lewis said, "but if you can say, 'Uncle Sam won't let me pay,' that's always better."

One thing that's certain is that demand for ransomware coverage is not going away. Sam Hodges, CEO of Vouch Insurance, noticed that more companies have been asking for cyber insurance and doing so earlier in their lifecycle. "You see all these events happening," Hodges said, "and it's only rational to think, 'What if this were to happen to me?'"

There's no quick fix to ransomware attacks, but a multifaceted approach — along with increased general awareness — could diminish the scale of the industry.

"The ransomware guys have put themselves in a bad position," Lewis said. "I was talking to a senior European intelligence official about a month ago and he said, 'Look, ransomware has become a national security threat in Western nations.' And so once you get into that arena, the ransomware folks are facing a much tougher set of competitors. And countries will be more willing to cooperate with each other to tamp down ransomware."

Wolff struck a more cautious note: "I go back and forth between feeling like we are only making very, very, very small, slow incremental steps towards cracking down on this. And then sometimes feeling like, 'Oh, we're so close to doing something big.'" She said whether the government steps up to take more impactful measures depends on the nature of the next wave of high-profile attacks.

And to any idealists still reading: There will be a next wave. Insurers can be sure of that.

Protocol | Workplace

The Activision Blizzard lawsuit has opened the floodgates

An employee walkout, a tumbling stock price and damning new reports of misconduct.

Activision Blizzard is being sued for widespread sexism, harassment and discrimination.

Photo: Bloomberg/Getty Images

Activision Blizzard is in crisis mode. The World of Warcraft publisher was the subject of a shocking lawsuit filed by California's Department of Fair Employment and Housing last week over claims of widespread sexism, harassment and discrimination against female employees. The resulting fallout has only intensified by the day, culminating in a 500-person walkout at the headquarters of Blizzard Entertainment in Irvine on Wednesday.

The company's stock price has tumbled nearly 10% this week, and CEO Bobby Kotick acknowledged in a message to employees Tuesday that Activision Blizzard's initial response was "tone deaf." Meanwhile, there has been a continuous stream of new reports unearthing horrendous misconduct as more and more former and current employees speak out about the working conditions and alleged rampant misogyny at one of the video game industry's largest and most powerful employers.

Keep Reading Show less
Nick Statt
Nick Statt is Protocol's video game reporter. Prior to joining Protocol, he was news editor at The Verge covering the gaming industry, mobile apps and antitrust out of San Francisco, in addition to managing coverage of Silicon Valley tech giants and startups. He now resides in Rochester, New York, home of the garbage plate and, completely coincidentally, the World Video Game Hall of Fame. He can be reached at nstatt@protocol.com.

Over the last year, financial institutions have experienced unprecedented demand from their customers for exposure to cryptocurrency, and we've seen an inflow of institutional dollars driving bitcoin and other cryptocurrencies to record prices. Some banks have already launched cryptocurrency programs, but many more are evaluating the market.

That's why we've created the Crypto Maturity Model: an iterative roadmap for cryptocurrency product rollout, enabling financial institutions to evaluate market opportunities while addressing compliance requirements.

Keep Reading Show less
Caitlin Barnett, Chainanalysis
Caitlin’s legal and compliance experience encompasses both cryptocurrency and traditional finance. As Director of Regulation and Compliance at Chainalysis, she helps leading financial institutions strategize and build compliance programs in order to adopt cryptocurrencies and offer new products to their customers. In addition, Caitlin helps facilitate dialogue with regulators and the industry on key policy issues within the cryptocurrency industry.
Protocol | Workplace

Founder sues the company that acquired her startup

Knoq founder Kendall Hope Tucker is suing the company that acquired her startup for discrimination, retaliation and fraud.

Kendall Hope Tucker, founder of Knoq, is suing Ad Practitioners, which acquired her company last year.

Photo: Kendall Hope Tucker

Kendall Hope Tucker felt excited when she sold her startup last December. Tucker, the founder of Knoq, was sad to "give up control of a company [she] had poured five years of [her] heart, soul and energy into building," she told Protocol, but ultimately felt hopeful that selling it to digital media company Ad Practitioners was the best financial outcome for her, her team and her investors. Now, seven months later, Tucker is suing Ad Practitioners alleging discrimination, retaliation and fraud.

Knoq found success selling its door-to-door sales and analytics services to companies such as Google Fiber, Inspire Energy, Fluent Home and others. Knoq representatives would walk around neighborhoods, knocking on doors to market its customers' products and services. The pandemic, however, threw a wrench in its business. Prior to the acquisition, Knoq says it raised $6.5 million from Initialized Capital, Haystack.vc, Techstars and others.

Keep Reading Show less
Megan Rose Dickey
Megan Rose Dickey is a senior reporter at Protocol covering labor and diversity in tech. Prior to joining Protocol, she was a senior reporter at TechCrunch and a reporter at Business Insider.
dei
Protocol | Workplace

What’s the purpose of a chief purpose officer?

Cisco's EVP and chief people, policy & purpose officer shares how the company is creating a more conscious and hybrid work culture.

Like many large organizations, the leaders at Cisco spent much of the past year working to ensure their employees had an inclusive and flexible workplace while everyone worked from home during the pandemic. In doing so, they brought a new role into the mix. In March 2021 Francine Katsoudas transitioned from EVP and chief people officer to chief people, policy & purpose Officer.

For many, the role of a purpose officer is new. Purpose officers hold their companies accountable to their mission and the people who work for them. In a conversation with Protocol, Katsoudas shared how she is thinking about the expanded role and the future of hybrid work at Cisco.

Keep Reading Show less
Amber Burton

Amber Burton (@amberbburton) is a reporter at Protocol. Previously, she covered personal finance and diversity in business at The Wall Street Journal. She earned an M.S. in Strategic Communications from Columbia University and B.A. in English and Journalism from Wake Forest University. She lives in North Carolina.

Protocol | Fintech

The digital dollar is coming. The payments industry is worried.

Jodie Kelley heads the Electronic Transactions Association. The trade group's members, who process $7 trillion a year in payments, want a say in the digital currency.

Jodie Kelley is CEO of the Electronic Transactions Association.

Photo: Electronic Transactions Association

The Electronic Transactions Association launched in 1990 just as new technologies, led by the World Wide Web, began upending the world of commerce and finance.

The disruption hasn't stopped.

Keep Reading Show less
Benjamin Pimentel

Benjamin Pimentel ( @benpimentel) covers fintech from San Francisco. He has reported on many of the biggest tech stories over the past 20 years for the San Francisco Chronicle, Dow Jones MarketWatch and Business Insider, from the dot-com crash, the rise of cloud computing, social networking and AI to the impact of the Great Recession and the COVID crisis on Silicon Valley and beyond. He can be reached at bpimentel@protocol.com or via Signal at (510)731-8429.

Latest Stories