Cyber-attack ‘could cost as much as Katrina’
Lloyd’s of London has warned that a major global cyber-attack could cost the world economy more than $120bn (£92bn) – as much as natural disasters such as Hurricane Katrina and Superstorm Sandy.
Published two months after a ransomware cyber-attack hobbled NHS hospitals and hit nearly 100 countries, a report from the world’s oldest insurance market says the threat posed by such attacks has spiralled and poses a huge risk to businesses and governments over the next decade.
The most likely scenario is a malicious hack that takes down a cloud service provider, with estimated losses of $53bn, according to Lloyd’s. Because of the uncertainty around calculating cyber losses, the figure could be as high as $121bn or as low as $15bn. At the upper end, the cost would outstrip the damage wreaked by Katrina in 2005, estimated at $108bn. Sandy in 2012 is estimated to have caused economic losses of $50bn to 70bn.
Lloyd’s chief executive, Inga Beale, said: “This report gives a real sense of the scale of damage a cyber-attack could cause the global economy.
“Just like some of the worst natural catastrophes, cyber events can cause a severe impact on businesses and economies, trigger multiple claims and dramatically increase insurers’ claims costs. Underwriters need to consider cyber cover in this way and ensure that premium calculations keep pace with the cyber threat reality.” The second most likely threat stems from attacks on computer operating systems run by a large number of businesses around the world, which could cause losses of up to $28.7bn. (The “mass software vulnerability scenario”.) The majority of these losses are not insured, leaving governments and businesses vulnerable. The uninsured gap could be as high as $45bn for the cloud services scenario, and $26bn for the mass vulnerability scenario.
Trevor Maynard, Lloyd’s head of innovation and co-author of the 56-page report with a cybersecurity firm, Cyence, said the global cyber-attack in May “showed us that these sorts of attacks are absolutely possible”. Financial services is most at risk, followed by software and technology, hospitality and retail, and healthcare. Cyber cover is a relatively new type of insurance – Lloyd’s accounts for about a quarter of global premiums – and harder to model than natural catastrophe cover.
Where people were involved, risk changed quite rapidly, Maynard said, from cyber-attacks to terrorism and political risk. However, he said climate change remained the biggest challenge in the long run.
“From year to year, risk varies relatively little, but climate change in the end will be far larger as a risk,” he said.
“It affects the global economic structure, food, water. [It’s like] trying to turn a supertanker around – we can’t start in 30 years when things are going bad, we have to start now.”
Flooding in New Orleans after Hurricane Katrina devastated the area in 2005