Indian insurers may bear cost of tech update after WannaCry
Indian companies hit by the WannaCry ransomware are less likely to claim for the 300 bitcoin ransom than the high cost of restoring services and backing them up, according to insurance experts cited by The Economic Times. Ransom attacks are covered in cybersecurity policies purchased by banks and payment wallets, as well as IT and IT-enabled services, and come with large deductibles of up to INR10.2m ($160,000). Cyberattack victims must first establish proof the ransom has been paid before they can enter a claim.
MUMBAI: Insurance companies are waiting for assessment from banks for any potential claims for losses arising out of the damages caused by the malware, Wanna-Cry. Experts say that insurers may end up paying for restoration and back-up of computers affected by the ransomware , rather than the ransom itself, thanks to high deductibles.Ransomeware is covered under cyber security cover. "Some companies have filed claims after the cyber attack," said an insurance company executive. "The value of the ransom is small, so companies are willing to pay this amount and claim cost of restoration and post-breach forensic."These policies have huge deductible of $1,00,000 to $5,00,000. Any expense of up to $1,00,000 would be paid by the insured.Insurers would pick up claim beyond this limit. Wanna-Cry started hitting computers on Saturday, demanding $300 in bitcoin to unlock an infected file or a computer."There are people who are choosing to paying the ransom and claim the cost of taking back-up, which, in one case, has gone up to Rs 1.2 crore," said an executive of an insurance broking company.Cyber security covers in India are generally bought by IT and IT enabled services due to their exposure to the US and Europe. Banking and financial services industry also buys cyber security cover. Now, new-age payments banks and wallets have started buying this policy to protect against claims arising out of postbreach investigations apart from financial loss due to the breach."The way policy is structured is that companies need to establish the proof of payment," said Sanjay Datta, head of underwriting, ICICI Lombard General Insurance. "Clients pay for themselves and bring in the insurer."Generally, companies buy assured sum of $10-100 million. "The reason why people are not buying higher limits is because there are no limit-busting events," said an executive of another broking company.In India, cyber security has not penetrated to a large extent. "Some people are installing patches, firewalls and following general set of rules," said Datta. "People are looking at reactive measures. Now, they may look at cyber security cover as a proactive approach."