Companies turning to cyber insurance
In the wake of the Ashley Madison hack and other high-profile data breaches, Canadian companies are turning to so-called cyber insurance to protect themselves from the fallout of data leaks.
In July, adultery website Ashley Madison made headlines after hackers broke in to the company’s network and leaked customers’ personal information, including their messages to other members and sensitive financial data.
The ensuing class-action lawsuit — and founder and CEO Noel Biderman’s decision to step down in late August — were the latest in a series of incidents that experts say represent a wakeup call for executives about the real-world consequences of digital vulnerabilities.
Duncan Stewart, director of technology research at Deloitte, said the past year has seen a surge in awareness about cyberattacks, and companies are turning to insurers to prepare for what seems an inevitability in an increasingly interconnected world.
“The number of attacks are rising, the severity is rising, and when they come, they’re more difficult to deal with,” he said.
There is no legal requirement for companies to report a hack in Canada, making the true number difficult to determine, but security company Websense said in August 2014 that 36 per cent of Canadian businesses had observed a breach in their IT security last 12 months.
In a KPMG survey of Canadian property insurance executives, data security even beat out unexpected catastrophic events as the third-biggest risk facing Canadian companies in 2015 after regulatory burdens and low interest rates.
Stewart compared significant breaches like the Ashley Madison hack to automobile collisions that result in a total writeoff, yet he said companies also require coverage for the small attacks and fender-benders of cybersecurity that happen far more often.
Insurance against cyberattacks is now just a part of the cost of doing business, he said.
Technology analyst Carmi Levy said in an email that insurance providers are stepping in to meet the needs of companies as they find themselves handling more and more data on behalf of their clients and suppliers.
“In the process, they are increasingly liable for what happens when hackers manage to break in and snag some of that data,” he said.
Insurance expert Paul Kovacs, president and CEO of the industry-funded oversight body PACICC, said insurance companies are expanding their offerings to provide more than just compensation and protection from liability in the event of a cyberattack.
“When this happens, you are going to need professional help with communications, with forensic investigation, with restoring your systems and putting the protections back in,” he said.