Cyber risk is largely perceived as something that only happens to the big guys. Think of the names you’ve heard in the news, Anthem, Home Depot, Target, JP Morgan Chase, Ashley Madison, all big companies. But for every cyber security breach that makes the headlines, dozens more go unreported, and hundreds more go undetected.
The Ponemon Institute’s 2015 report on the cost of data breaches based on actual loss incidents, found that for Canada, the number of breached records per incident ranged from 5,199 to 74,550, with an average 20,456. These are small and medium companies. Ponemon did not include organizations that had data breaches in excess of 100,000 because they are not representative of most breaches and to include them in the study would skew the results. In this respect, the data breach stories that do make the headlines -- Anthem, Home Depot, Target -- tend to be more than 1000x bigger.
But what is most concerning is that the average per capita cost of a data breach is US$250 and the average total organizational cost to the company concerned is US$5.32m. But the companies involved in these breaches didn’t even make the news.
According to the Insurance Institute of Canada (IIC), at present the majority of companies in Canada do not purchase cyber insurance, with global cyber insurance premiums estimated to be less than one-half of one percent of the estimated cost of cyber crime. In contrast, global auto insurance premiums exceed international estimates of vehicle collision damage.
“Unfortunately, insurance is still thought of as a commodity,” says Darlene Chin, assistant vice president, life sciences and information technology, Markel Canada, “and a lot of insureds don’t feel they have an exposure right now, and they are price conscious.”
To this end, Markel Canada has taken an innovative approach, jumping into the cyber liability market with a standalone cyber policy, offering first party and third party covers.
“If they don’t purchase our full cyber cover product, we feel that the endorsement is a good alternative. It’s simple, cost effective and supportive,” says Chin.