Hacks can cost businesses millions. Insurers may refuse to pay up

Cyberattacks are a nightmare for chief executives. To make matters worse, their insurers may refuse to pay u...

Posted: Jan 11, 2019 8:37 PM
Updated: Jan 11, 2019 8:37 PM

Cyberattacks are a nightmare for chief executives. To make matters worse, their insurers may refuse to pay up for damage the hackers do to their business.

A dispute between food and beverage giant Mondelez and Zurich Insurance (ZURVY) shows just how much is at stake. Mondelez has filed a lawsuit in Illinois that accuses the insurance company of refusing to cover losses it suffered as a result of the NotPetya cyberattack.

Digital security

Technology

Crime, law enforcement and corrections

Criminal offenses

Digital crime

Business and industry sectors

Business, economy and trade

Cyber attacks

Insurance

Unrest, conflicts and war

Continents and regions

Europe

Switzerland

Western Europe

Zurich

Cyberterrorism

International relations and national security

National security

Terrorism

Terrorism and counter-terrorism

Digital privacy

Companies

Mondelez International

Law and legal system

Lawsuits and claims

Trial and procedure

The attack swept across the world in June 2017, infecting networked computers at companies including advertising group WPP (WPPGF), drugmaker Merck (MKGAF) and global shipping company FedEx (FDX).

Mondelez (MDLZ) said in October 2018 that the attack cost it at least $114 million. But according to the lawsuit, Zurich Insurance has cited a "war exclusion" and refused to cover the losses.

The 'war exclusion'

The United States and the United Kingdom have blamed the NotPetya attack on Russia, suggesting that it was part of an effort to destabilize Ukraine.

In its lawsuit, Mondelez claims that Zurich Insurance subsequently refused to compensate it for losses suffered in the attack, citing a contract exemption for a "hostile or war like act" by any "government or sovereign power."

Zurich Insurance declined to comment on the dispute, saying it does not give details about individual policies. Mondelez also declined to comment.

The case could prove to be an important test for both companies and insurers, and help to establish when policyholders should be compensated for a cyberattack.

Rising threat

Executives in Europe, East Asia and North America say cyberattacks are the number one risk facing their companies, according to a survey published in November by the World Economic Forum.

Yet many companies do not have insurance that specifically covers cybercrimes, relying instead on general "all-risk" policies.

"Many of these all-risk policies may not even mention cyber, they were not designed to cover cyber," said Christine Marciano, CEO of insurance broker Cyber Data Risk Managers.

"They were written at a time when nobody could have predicted that these attacks would happen," she said.

Marciano said the insurance industry is closely watching legal actions such as the one filed by Mondelez to see whether more general policies should cover cyberattacks.

Contagious attacks

The nature of cyberattacks present real risks for insurers, as well as their clients.

Domenico del Re, an insurance expert and director at PwC, said insurers are most worried about systemic cyberattacks on the scale of NotPetya because they can simultaneously affect multiple clients across the world.

"This is what is different about cyber," he said. Other risks, like theft or kidnapping, are unlikely to affect multiple clients at the same time, he added.

The damage can also be extensive.

"There is a myriad of ways in which a cyberattack can cause financial loss — actual physical loss to the IT equipment, claims from third parties whose data was lost, fines, fraudulent transactions," del Re said.

That means that an insurance company could be on the hook for physical and financial losses, as well as damage to users and clients caused by data theft.

Data issues have become even more pressing after the General Data Protection Regulation (GDPR) came into effect last year in Europe. The law can mean huge fines for companies.

This could happen to you

"Companies that used to have the mindset of 'this can't happen to me' .... are now starting to realize this is something they can't be without," said Marciano.

Limited data on the damage caused by major cyberattacks makes it difficult for insurance companies to model and price policies.

Mondelez said its $114 million in losses were caused by property damage and disruptions to its business. It said in October that NotPetya had destroyed 1,700 of its servers and 24,000 of its laptops.

Equifax (EFX), which was also hit by a huge hack in 2017, said its damages exceeded $350 million. Insurance has so far covered $95 million, it said in its most recent quarterly financial report.

Indiana Coronavirus Cases

(Widget updates once daily at 8 p.m. ET)

Confirmed Cases: 34211

Reported Deaths: 2125
CountyConfirmedDeaths
Marion9761576
Lake3573186
Allen160069
Cass15877
St. Joseph126634
Elkhart126228
Hendricks116671
Hamilton115493
Johnson1097108
Madison58659
Porter53428
Bartholomew50834
Clark49741
LaPorte43023
Howard40428
Tippecanoe3933
Delaware38536
Jackson3821
Shelby37122
Hancock33127
Floyd31839
Boone31635
Morgan27824
Vanderburgh2662
Montgomery23817
White2338
Noble22821
Clinton2271
Decatur22431
Grant21022
Dubois1993
Harrison19422
Henry17211
Greene16924
Vigo1688
Dearborn16821
Monroe16712
Warrick16628
Lawrence15924
Miami1401
Putnam1367
Jennings1304
Kosciusko1271
Orange12622
Scott1193
Franklin1108
Ripley1086
Marshall1021
Carroll932
Daviess8516
Steuben832
Wayne785
Fayette777
Newton7710
Wabash772
LaGrange762
Jasper661
Washington521
Clay511
Jay500
Fulton491
Randolph473
Rush462
Pulaski460
Jefferson451
Whitley413
Starke393
DeKalb371
Sullivan351
Owen341
Brown331
Perry320
Wells310
Benton300
Knox280
Huntington272
Tipton251
Blackford252
Crawford240
Fountain212
Switzerland200
Spencer201
Parke170
Adams171
Posey160
Gibson152
Ohio130
Warren121
Martin110
Vermillion100
Union90
Pike60
Unassigned0167

Illinois Coronavirus Cases

(Widget updates once daily at 7 p.m. CT)

Confirmed Cases: 118917

Reported Deaths: 5330
CountyConfirmedDeaths
Cook771193603
Lake8238288
DuPage7620368
Kane6259176
Will5510273
Winnebago220955
McHenry153972
St. Clair112180
Kankakee90045
Kendall77819
Rock Island65124
Champaign6277
Madison57259
Boone44117
DeKalb3994
Sangamon34829
Jackson28210
Randolph2694
Peoria2218
McLean21813
Ogle2033
Stephenson2012
Macon19419
Clinton18617
Union15510
LaSalle15013
Whiteside13912
Iroquois1314
Coles12615
Out of IL1181
Warren1150
Jefferson10116
Grundy982
Knox980
Monroe9511
McDonough8711
Lee811
Unassigned800
Cass730
Tazewell725
Henry690
Williamson661
Pulaski560
Marion500
Jasper457
Macoupin452
Adams441
Perry420
Montgomery391
Vermilion391
Morgan361
Christian354
Livingston342
Jo Daviess320
Douglas270
Fayette203
Ford201
Jersey201
Menard200
Woodford192
Mason180
Washington180
Hancock170
Mercer170
Carroll162
Shelby161
Bureau151
Schuyler130
Bond121
Franklin120
Clark110
Crawford110
Fulton110
Moultrie110
Piatt110
Brown100
Cumberland100
Logan100
Wayne91
Alexander80
Henderson80
Johnson80
Effingham71
Massac70
Saline70
Greene50
Marshall50
De Witt40
Lawrence40
Richland30
Stark30
Clay20
Edwards20
Gallatin20
Hamilton20
Wabash20
White20
Calhoun10
Edgar10
Hardin10
Pike10
Pope10
Putnam10
Terre Haute
Clear
57° wxIcon
Hi: 74° Lo: 49°
Feels Like: 57°
Robinson
Scattered Clouds
57° wxIcon
Hi: 74° Lo: 53°
Feels Like: 57°
Indianapolis
Broken Clouds
60° wxIcon
Hi: 72° Lo: 51°
Feels Like: 60°
Rockville
Broken Clouds
54° wxIcon
Hi: 72° Lo: 49°
Feels Like: 54°
Casey
Clear
59° wxIcon
Hi: 73° Lo: 54°
Feels Like: 59°
Brazil
Clear
57° wxIcon
Hi: 72° Lo: 49°
Feels Like: 57°
Marshall
Clear
57° wxIcon
Hi: 74° Lo: 53°
Feels Like: 57°
A calm evening is expected
WTHI Planner
WTHI Temps
WTHI Radar

WTHI Events