Extreme cyberattack could cost $53 billion: Lloydâ€™s
A major global cyberattack has the potential to trigger considerable economic losses, according to a scenario described in new research by specialist insurance market Lloyd’s and Cyence, a leading cyberrisk analytics modelling firm.
The research reveals the potential economic impact of two scenarios: a malicious hack that takes down a cloud service provider with estimated losses of up to $53 billion, and attacks on computer operating systems run by a large number of businesses around the world which could cause losses of $28.7 billion.
The findings also reveal that, while demand for cyberinsurance is increasing, the majority of these losses are not currently insured, leaving an insurance gap of tens of billions of dollars.
“This report gives a real sense of the scale of damage a cyber-attack could cause the global economy. Just like some of the worst natural catastrophes, cyberevents can cause a severe impact on businesses and economies, trigger multiple claims and dramatically increase insurers’ claims costs. Underwriters need to consider cybercover in this way and ensure that premium calculations keep pace with the cyberthreat reality,” said Inga Beale, CEO of Lloyd’s. “We have provided these scenarios to help insurers gain a better understanding of their cyberrisk exposures so they can improve their portfolio exposure management and risk pricing, set appropriate limits and expand into this fast-growing, innovative insurance class with confidence.”
For the cloud service disruption scenario in the report, average economic losses range from $4.6 billion from a large event to $53 billion for an extreme event. This is the average in the scenario, because of the uncertainty around aggregating cyberlosses this figure could be as high as $121 billion or as low as $15 billion. Meanwhile, average insured losses range from $620 million for a large loss to $8.1 billion for an extreme loss.
In the mass software vulnerability scenario, the average losses range from $9.7 billion for a large event to $28.7 billion for an extreme event. And the average insured losses range from $762 million to $2.1 billion.
The uninsured gap could be as much as $45 billion for the cloud services scenario–meaning that less than a fifth (17 per cent) of the economic losses is actually covered by insurance. The underinsurance gap could be as high as $26 billion for the mass vulnerability scenario–meaning that just seven per cent of economic losses are covered.
“This report’s findings suggest economic losses from cyberevents have the potential to be as large as those caused by major hurricanes. Insurers could benefit from thinking about cybercover in these terms and make explicit allowance for aggregating cyber-related catastrophes. To achieve this, data collection and quality is important, especially as cyberrisks are constantly changing,” said Trevor Maynard, Head of Innovation, Lloyd’s.
Lloyd’s worked with Cyence to collect data at internet scale to model cyberrisk and evaluate the financial, economic and insurance impact of these scenarios.
Arvind Parthasarathi, CEO of Cyence, added that Cyence is excited to be working with Lloyds on empowering the insurance industry to understand and model cyber risk. “Leveraging Cyence’s unique cyberrisk platform, we’re excited to see insurers providing more capacity, bringing innovative products to market with greater confidence and creating a more robust and sustainable insurance market.”