Idealists don't last long in the insurance industry. The sector has learned time and again that misaligned incentives lead to bad behavior: If you sell fire insurance, someone will eventually commit arson. If you price life insurance based on a medical checkup, arthritic grandpas will cut weight like they're about to go 12 rounds against Floyd "Money" Mayweather.
But insurers don't bemoan the human condition: They adapt to it. To remain profitable while discouraging unwanted behavior, insurance companies can raise premiums, set higher deductibles or allocate more funding to fraud detection.
Ransomware is rewriting the insurance rulebook. The rampant growth in digital extortion is confounding insurers, with losses from claims widening. An organized attack hit 200 businesses on Friday alone, security researchers said. And the phenomenon has also raised questions about whether the industry has itself to blame.
Cyber policies often explicitly cover ransom payments, or offer optional coverage. And some observers believe that by making it easier to just pay ransoms, insurers helped birth a highly-organized, multinational crime industry that generates billions of dollars annually. The same factors that once made the sector attractive to insure — its rapid growth, ambiguous risk profile and speedy claim resolution — have helped create a monster that insurers don't seem equipped to contain on their own.
Instead, government policy will likely be needed to save insurers, and their clients, from themselves. The trouble is that there's no easy way to put the cat back in the bag. Every policy prescription, from limiting ransom payments to hunting down crypto wallets, comes with its own set of challenges and unintended consequences. Without a silver bullet, many experts believe the proliferation of attacks should be addressed by governments in close collaboration with insurers and the corporations they seek to protect.
A good thing winding down
Prior to 2020, ransomware coverage stood out as one of the most attractive insurance sectors. Traditional coverage areas such as home and automotive insurance tend to grow at the same rate as the overall economy. Cyber insurance has grown at a far more rapid pace: Direct written premiums for property/casualty cyber insurance, which often include ransomware coverage, more than doubled from just over $1 billion in 2015 to $2.3 billion in 2019, according to Fitch Ratings.
"Cyber insurance is actually one of the few growth markets," Gerry Glombicki, a director at Fitch, told Protocol. Glombicki said that emerging lines of business tend to be more profitable before competitors rush in and push margins down.
Accordingly, cyber insurers enjoyed a long streak of handsome profits as their sector grew. Fitch data shows that insurers' direct loss ratio — a measure of the proportion of premiums that get paid back out to clients — never surpassed 50% between 2015 and 2019.
This room for profitability came in part because nobody knew how to price ransomware risk. With home and auto coverage, insurers have access to reams of data for pricing. Predicting the likelihood, frequency and cost of ransomware attacks proved to be much more difficult. To account for this uncertainty, insurers built a buffer into their premiums.
That proved to be a smart strategy, as the direct loss ratio nearly doubled in 2020 to reach 73%, up from 47% the year prior. Several prominent cyber insurers even reported standalone cyber insurance direct loss ratios for the U.S. market above 100%. Sompo Group reported a 114% direct loss ratio in 2020, and AIG reported 101%.
Janet Ruiz, a director of strategic communication at the Insurance Information Institute, noted a marked change in ransom payouts during this time period. "In 2018, losses were more in the hundreds of dollars," Ruiz told Protocol. "Now we're seeing up to tens of millions of dollars on some of the largest ransomware attacks."
One reason for the increased payouts is hackers have developed more-sophisticated methods of attack that can halt a company's operations entirely, versus just seizing data and threatening to disclose it. Operational downtime is often easier to price than a data breach, so it became easier for executives to justify paying a ransom.
This dynamic played out in late May's ransomware attack on JBS, the world's largest meat-processing company. The ransomware gang REvil was able to breach JBL's IT systems and halt operations at 13 of its plants. The company eventually paid an $11 million bitcoin ransom. Even though it said that the "vast majority" of its facilities were operational at the time of the payment, JBS explained that it paid up to prevent the risk of data being stolen.
Publicly-traded companies must disclose cyber breaches. But there aren't consistent requirements across private and public companies for reporting ransomware attacks and payments, so it can be difficult to gauge how often they occur. Still, many industry experts believe the frequency of attacks has also increased in recent years.
Ransomware-as-a-service is another driver of this trend. It allows hackers to develop code for a ransomware attack and then sell it to another criminal organization. The buyers were often criminal groups that wouldn't otherwise possess the technical know-how to perform an attack. It's significantly lowered the barriers to entry, while spreading the risks — ironically, financial concepts insurers could appreciate.
Some industry experts believe that the ease of payment helped drive ransomware revenue up in recent years.
Professor Josephine Wolff is a prominent proponent of this theory. As a professor of cybersecurity policy at The Fletcher School at Tufts University, Wolff researches ways to make cyber crime less profitable.
"There's a more controversial claim that's been made — that by covering these payments, the insurers are actually driving more ransomware to be directed at their clients," Wolff said. "I haven't seen a lot of strong evidence behind it."
Rather than ask whether hackers target those with insurance, Wolff thinks we should be asking whether having ransomware coverage makes it easier to pay. "There I worry the answer really is yes — that knowing that you purchased this insurance … turns the payment of the ransom into a standard cost of doing business," Wolff said. "It's the same way that if I got into a fender bender, I would just go to my insurance and say, 'OK, this is what I have insurance for.' Now there's an equivalent idea with ransomware."
The importance of securing a payment helps explain why some ransoms can seem small relative to the size of the business at stake. Colonial Pipeline, for instance, "only" ended up paying a $4.4 million ransom to fend off the attack that took down a 2.5-million-barrel-per-day piece of infrastructure.
Wolff cited Colonial Pipeline's decision to consult with its insurer in ransom negotiation proceedings: "That was not a decision made independent of the insurance context." She added, "I do worry about that — that insurers, in some cases perhaps even more than their clients, have an incentive to say, 'Let's sort of resolve this as quickly and as cheaply as possible.'"
Glombicki of Fitch noted that ransomware hackers want to get paid, but not to such an extent that they elicit undue attention. He said hackers are searching for a "sweet spot where you can maximize your profits but not really bring legislative and regulatory authority on you — and not kill the company, either."
A unified front
If hackers were once flying under the radar, they are now big, bright, obnoxious green dots hovering on the legislative agendas of policymakers worldwide. The question has now become what to do about it.
The French are leaning toward a guillotine-sharp solution: Cut off the money flow. Politicians at their Senate roundtable earlier this summer signaled their intention to ban ransomware payments altogether.
In response, Axa, one of the largest global insurance groups, announced that it would no longer write new ransomware policies for customers in France. In a statement to Protocol, Axa said it had "deemed it appropriate to suspend marketing until the consequences of these analyses are drawn and the framework for insurance intervention is clarified."
There are significant concerns surrounding an outright ban on ransom payments. Hackers often target hospitals and critical infrastructure, so not making a payment could result in significant human suffering, even deaths. Bearing that cost for the sake of preventing future attacks is a politically dangerous argument to make.
One workaround would be to ban corporations from paying ransoms, while still allowing hospitals and critical infrastructure administrators to comply with hackers' demands in high-stakes scenarios. However, that could just lead to making hospitals and critical infrastructure prime targets.
Even for companies, banning ransom payments could take a serious human toll. A ransomware attack could run a corporation into bankruptcy, leaving hundreds or thousands of employees without jobs. It could also expose clients' sensitive data.
"If you're a company, we want be careful not to ask you to commit suicide," said James Andrew Lewis, a senior vice president and director of the Strategic Technologies Program at the Center for Strategic and International Studies, a nonprofit policy research center. "If the only thing you have to offer a victim is 'Don't pay,' that's not attractive. But if you can make it part of a larger package of ransomware measures, I think it makes sense."
Recovery of cryptocurrency wallets is one of the newest tools in that package of ransomware measures. Last month, the Justice Department announced that the FBI recovered over half of the Colonial Pipeline ransom. On the surface it looked like a potential breakthrough — the ransomware industry can only exist if it has access to untraceable cryptocurrency payment systems.
"Cryptocurrencies themselves are not a silver bullet for avoiding this kind of disruption," Lewis said. He added that many of the lessons learned in dealing with general money laundering can be applied to ransomware payment tracing. "The basic lesson is follow the money … and identify where you can interfere with the flow."
What else can companies do? As is often the case, one of the most effective measures also happens to be the least exciting: cyber hygiene.
"A lot of this stuff is just the basics," Glombicki of Fitch said. "It's turning on multifactor authentication, it's making sure your employees don't fall for phishing scams, it's updating your patches."
It's tempting to believe companies will independently choose to upgrade their defenses in response to the growing threat of ransomware attacks. Lewis doesn't see it that way: "Companies figure out 'How much am I likely to lose?' [and] 'How much would it cost me to upgrade my defenses?'" he said. "If it costs more to upgrade than to just pay, they just pay."
That brings us back to Wolff's assertion that insurers stimulate the ransomware sector by making payments "a standard cost of doing business." Customers might not love it, but insurers could ultimately lower the attractiveness of ransomware by hiking cyber insurance premiums.
Already insurers are grading their clients' cyber hygiene practices, raising deductibles for companies with riskier profiles and in some cases asking them to partially self-insure. As ransomware costs continue to rise, insurers will continue to shift the cost of attacks back to the corporations. This might be painful for clients in the short term, but overall it could help diminish the prevalence of attacks.
The government could even accelerate this trend by limiting payouts or adding friction to the insurance settlement process.
"You don't want to tell your customer, 'I won't pay you,'" Lewis said, "but if you can say, 'Uncle Sam won't let me pay,' that's always better."
One thing that's certain is that demand for ransomware coverage is not going away. Sam Hodges, CEO of Vouch Insurance, noticed that more companies have been asking for cyber insurance and doing so earlier in their lifecycle. "You see all these events happening," Hodges said, "and it's only rational to think, 'What if this were to happen to me?'"
There's no quick fix to ransomware attacks, but a multifaceted approach — along with increased general awareness — could diminish the scale of the industry.
"The ransomware guys have put themselves in a bad position," Lewis said. "I was talking to a senior European intelligence official about a month ago and he said, 'Look, ransomware has become a national security threat in Western nations.' And so once you get into that arena, the ransomware folks are facing a much tougher set of competitors. And countries will be more willing to cooperate with each other to tamp down ransomware."
Wolff struck a more cautious note: "I go back and forth between feeling like we are only making very, very, very small, slow incremental steps towards cracking down on this. And then sometimes feeling like, 'Oh, we're so close to doing something big.'" She said whether the government steps up to take more impactful measures depends on the nature of the next wave of high-profile attacks.
And to any idealists still reading: There will be a next wave. Insurers can be sure of that.
