Cyber insurance limits and ransomware reporting under scrutiny

0:00 It's the wrong statistic for determining an insurance limit.
0:04 Just because an act is reckless does not necessarily mean it is an excluded intentional act under a policy. [music]
0:11 Hello and welcome to Insurance Business TV for our quarterly cyber insurance power panel for Australia. We're going to look at ransomware, cyber limits and other issues relevant to brokers. Our experts are here. Jack Pets is managing principal in the cyber media and technology practice at Marsh, and Mark Luckan is national manager cyber and technology sector for Lockton. Very happy to welcome both of you gentlemen.
0:38 Good to see you again.
0:40 Good to see you again, Daniel. Good to be here. Yeah, great. Great. Yeah, welcome back.
0:44 Let's kick off with you, Jack. Since the start of this year, the government's taken a more active approach to ransomware payment reporting. If a client turning over more than 3 million pays a ransom and they have 72 hours now to report, and that duty stays with them even if someone else makes the payment on their behalf. I'm just looking at the chain here. Who in this response chain is actually making sure that that payment happens, and does the policy pay for that kind of thing too?

Chapter 2: Ransomware Payment Reporting and Who Is Responsible

1:14 Yeah, thanks, Daniel. So ultimately, it's important to establish that businesses are legally responsible for making that notification. So regardless of whether insurers make a ransom payment directly or any other third party, the business is responsible for making that notification. Typically, given that it is a legal requirement, it is coordinated by general counsel or a business's legal function. However, depending on the governance structure of any business, that obviously may be different, but typically it is a legal responsibility. In any case, we would definitely recommend that that process is incorporated into a business's incident response plan, which is very important and can help expedite that process in the context of a live event. In terms of the insurance piece, I'd also point out that notification expenses are a typical insurance clause that can usually be captured in the incident response expenses coverage. So important to realize that those notification procedures can also be picked up from the insurance policy as well.
2:18 Thank you, Jack. Mark, what's the view from Lockton on this one?
2:23 As usual, Dan, echoing a lot of Jack's sentiment there. I think this additional reporting regime just reinforces the need and the importance around not only having a strong incident response plan but understanding it, testing it, ensuring that everyone knows their roles. Because to Jack's point, foundationally, fundamentally, the obligation remains with the affected reporting entity. So whilst other parties might be engaged to provide advice and guide the process, the obligation will sit with that entity, which is again why it's so critical to ensure that the plan is understood, how it works, people's roles, etc. From a coverage and policy response perspective, again, a lot of the same sentiment there. An additional piece I'd throw in there is just ensuring organizations, when they're looking at their notification clause, that it's broad enough to capture this kind of obligation. Sometimes, there have certainly been instances in the past where such incident response coverage clauses might be narrowly drafted to only respond to a specific or a formal regulatory investigation. There is a potential here that this kind of falls outside the remit of a traditional regulatory investigation. So just making sure that language is broad enough to respond there as well.

Chapter 3: Privacy Claims and Intentional Acts Exclusions

3:55 Well, thank you, Mark. Okay, let's stick with you for our next question.
3:58 With cyber attacks, there's now a right to sue over a serious invasion of privacy, and it covers reckless conduct, not just deliberate stuff here. Most cyber policies exclude intentional acts. When a client asks whether their liability section responds to a claim like that, what do you tell them?
4:19 I think this is a really good example of the potential or actual misconceptions that people can have around insurance in general, or cyber insurance specifically in this case, because of some of the language used. So the fact that this new right requires or uses language around intentional or reckless doesn't necessarily mean that the same worded exclusion is just automatically applicable here. Again, I think the industry kind of gets itself a little bit caught up in the use of this language, and people make assumptions and conclusions around that. The statutory test and policies are asking two different questions here.
5:08 So the tort doesn't require fraud, dishonesty or criminal acts, even though it's kind of worded that way. And the commercial function of a conduct exclusion, it's really there more so to prevent insurers from transferring the consequences of established deliberate wrongdoings or acts. So when we're looking at this potential exposure and the applicability of policy language, this obligation has not made this area of risk uninsurable just because it shares language around that. There is the potential around policy response here, and the language needs to be considered on a more relevant basis when you're considering coverage applicability.
6:04 Well, thank you, Mark. We're getting quite legalistic and complicated here, Jack. What's your take on this one?
6:10 Yeah, I agree with Mark that it's a very nuanced question, Daniel, and I think the development with that tort definitely potentially brings some added privacy exposure to businesses. However, as Mark was sort of insinuating, just because an act is reckless does not necessarily mean it is an excluded intentional act under a policy. And there are lots of different framings of this language: misconduct, intentional, reckless. In any case, we'd certainly urge clients to look at their wording, run through those scenarios both with their insurance broker and also seek professional legal advice. But it's important to look at those conduct exclusions. The nature of the claim definitely matters as well, and how that is determined by the courts. For example, if we were encountering a worst-case scenario where there may be an excluded intentional act or reckless act under a policy, it's also important to realize that defense costs and regulatory defense expenses can also be covered under an insurance policy. So where the liability may still be excluded due to a court ruling, all of the costs that go into defending that case on behalf of the insured could still potentially be picked up under the policy.
7:22 Jack, staying with you, there's a cyber incident review board now for the industry that was appointed in May, and it publishes its reviews. Just wondering what bearing that has on a claim. It doesn't actually apportion blame when it does these reports, but the report is public. So if a client gets reviewed after they've had a major incident, does that do anything? Is that something you expect to affect claims?
7:56 Yeah, so I think the establishment of the Cyber Incident Review Board, Daniel, was definitely a good step. It really was born out of the Cyber Security Act 2024 and falls within, or is a part of, the Australian government's wider cyber security strategy. Obviously, the purpose of the board is to bring more transparency around incidents. It's certainly not a board to assign blame or civil liability. It's a no-fault, lessons-learned sort of body.
8:23 So just because you're being reviewed off the back of an incident does not necessarily equal any damage to a potential claim. What I would say, however, is that the findings from any review through the board could potentially be relevant to policy coverage, and more specifically, prior known matters, circumstances or misrepresentation, either through an insurance submission or other aspects relating to your policy coverage. So it's important to make sure that those findings are consistent with what insurers are made aware of, but it's definitely a good step in terms of the board itself overall.
9:02 How about you, Mark? How do you see the presence of this Cyber Incident Review Board?
9:07 It's a really interesting question. I agree with Jack's point there around the fact that obviously the board doesn't have the power to apportion liability, etc. But in terms of potential impact, my mind goes to a couple of areas. The first is that whilst the board's review won't necessarily determine a claim in the first instance, depending on the contents of the report, perhaps it could open up pathways or encourage litigants, plaintiffs or other regulators to pursue potential liability claims arising out of an event, depending on the insights or findings of the report. So that's a potential consideration there. You look at the litigation funding environment in the directors and officers liability landscape. Those plaintiff firms are looking and scouring for information for the next kind of class action. I see some similar principles there, perhaps in the contents of reports being used in that manner.
10:18 The other piece, or the second piece, rather, and Jack referenced it there as well, is the potential for disclosure issues or maybe even Section 54 Insurance Contracts Act issues around what's been disclosed in the submission, what has come out of the report in terms of perhaps a critical control that was disclosed as being in place but isn't, and how that might impact or how an insurer might interpret that as prejudice. Potentially, again, perhaps a little bit of a long bow to draw, but there could be some potential risk for organizations from that perspective.
10:58 Great, thank you for that one. Let's bring this back to a more concrete issue for your clients. The average self-reported cybercrime loss for a medium-sized Australian business is about $97,000.

Chapter 5: How to Choose the Right Cyber Limit

11:07 That was last financial year. But clients are buying limits way above that. Does that mean the limit is being oversold, or does the average hide what the claims are actually costing, and those limits are needed? Mark, I saw this stat, and it's a good question.
11:31 Because I think an average is good to know, but it's the wrong statistic for determining an insurance limit. This average is really good to be shared from the ACSC for frequency of events and average cost of events, obviously. And the other point there is, as the ACSC say themselves, this is self-reported. So cybercrime in Australia, and globally, is well known to be underreported. So what's the actual data saying, or what's the pool? It's not reflective of the broader loss landscape. We suspect the self-report is probably not capturing all of the associated costs that would traditionally be covered under a policy as well. People potentially report just the direct loss of funds associated with a cyber event, and that figure is used to work out the average.
12:27 They're all important considerations. I think when it comes to determining the right limit, it's not what's the average cybercrime loss according to the ACSC. It's what would a severe but credible event cost us? Let's work through some exercises. Let's work through some modeling around that which is specific to the organization, and use that as your starting point or leading point to determine an appropriate level of liability, as opposed to just taking an average or looking at peers. Test potential credible but severe losses against the balance sheet, against risk appetite, what's available in the market, and use that as a piece to determine your limit of liability.
13:08 Jack, how about you? How do you see this $97,000 figure when you consider it against the sort of limits that you're selling in policies?
13:24 Yeah, so I think Mark made an excellent point that it's very important to distinguish the fact that this is a self-reported cybercrime average, not a median or average insurance claim coming into the market. Cyber losses can often combine a combination of first- and third-party indemnities. There might also be multiple losses during one policy period. So just because that is an average self-reported cybercrime loss, cyber limits are aggregate limits, and multiple claims may erode that policy limit over the course of the 12-month period, or however long the policy is in place for.
14:06 So I think, as Mark also said, it's important to take a more data-driven approach around program purchase, including limits, retentions and other components of the policy. We're certainly seeing claims becoming more complex in nature, and a lot of losses dovetail across first-party impacts and third-party liability. So it's important to run through those scenarios and understand what a black swan event could look like for your business to make sure that you are tailoring your program accordingly.
14:39 Jack from Marsh, thank you very much.
14:41 And Mark from Lockton, thank you to you too. And that concludes our cyber panel.
14:45 Thanks for watching Insurance Business TV. Bye for now.
14:51 [music]