A cyber attack on a water utility or manufacturing plant can quickly spin out into bodily injury allegations, pollution cleanup costs, and third-party liability. However, most cyber policies are written to exclude those losses.
The risks came into focus this year, after the FBI and the Environmental Protection Agency warned that malicious actors were attacking operational technology at water and wastewater utilities. Utilities in at least seven states had reported incidents since July 27.
Some utilities lost water pressure and others experienced flooding, and the FBI cautioned that low pressure could allow untreated groundwater to seep into pipes. The campaign has prompted questions about whether water utility attacks could revive the cyber war exclusion debate.
On October 1, NIST published guidance discussing the recent attacks and emphasizing that hackers had specifically targeted devices managing the physical processes of water treatment and storage.
Physical consequences create a different insurance problem from a data breach or ransomware payment, said Juliet White (pictured on the left), head of cyber at Howden US.
“The property damage and the bodily injury are becoming more of a forefront issue for the market to contend with because of these types of events,” said White. “There are other solutions in the market for that, but we need to make sure that they work together so that no one’s looking to their cyber policy for GL coverage or environmental coverage.”
Legacy equipment at these facilities adds an immense challenge. These facilities’ operational technology – systems that physically run pumps, valves and treatment processes – often can’t support modern network monitoring, White said. Utilities may also face regulatory constraints on monitoring tools.
“Water utilities are actually still quite segregated from their operational technology and their IT infrastructure, which in some respects is a positive thing to prevent and minimize actual harm and damage (during a cyber attack),” she said.
“But electric utilities, for instance, have merged more of their IT and OT networks. So, there’s now this bridge from internet-facing technology that could then impact the operational technology.”
Read more: What happens when cyber attacks break more than just networks?
The same exposure can also apply to some manufacturing plants, said Jared Dubrowsky (pictured on the right), environmental transaction leader at Howden US. At manufacturing facilities, remotely accessible systems can control processes and valves that, if manipulated, could cause a release.
He offered a hypothetical example of an attacker opening a valve at a plant handling anhydrous ammonia. Depending on the circumstances, he said, a release could lead to allegations of exposure, bodily injury claims and remediation on neighboring properties.
A refinery could face a different scenario if a remotely controlled valve were opened and oil or another product reached a waterway. At a drinking water facility, manipulation of chemical levels could also create a pollution incident.
According to White, brokers should ensure that utilities should map their critical third-party providers, set the controls and insurance those vendors must carry and model what a vendor breach would mean for operations. On cyber risk controls, she said fundamentals still matter most.
“We sometimes get ahead of ourselves in talking about new technology and all these evolving and developing arenas, when a lot of it comes down to: Do you have proper access management, both physical and network-related?” White said. “Do you have multifactor authentication in place for access to sensitive systems?”
The bigger task is a coordinated review of the whole insurance program. Insurance teams should conduct a broad review of property, GL, cyber, D&O and environmental policies “to make sure there’s clear understanding of the intention of coverage, any exclusions that are relevant, and how all these insurance products are going to work together to provide relief” in an event, White said.
“If the two lines of coverage aren’t talking and explaining that to the client, that’s the biggest problem,” Dubrowsky added.
Brokers should also examine how a cyber policy treats business interruption when an operator shuts down systems as a precaution or switches to manual operations. White said the distinction between an active attack and a preventive shutdown can matter, depending on the policy language. Cyber insurance is not standardized, she noted, and carriers use different forms and terms.
A shutdown intended to prevent an incident may benefit the organization, but the resulting interruption loss is not automatically covered. White said the wording needs close examination to establish what protection a particular client has purchased.
“We’re at an inflection point in the industry where a lot of these exposures are blending together, and there’s a technology component to every single one of them,” said White. “As brokers, we need to educate and give really good insights and data to help clients make educated decisions about their risk transfer and their risk tolerance.”
