STREAMING NOW: Watch Now

Hacks can cost businesses millions. Insurers may refuse to pay up

Cyberattacks are a nightmare for chief executives. To make matters worse, their insurers may refuse to pay u...

Posted: Jan 11, 2019 7:37 PM
Updated: Jan 11, 2019 7:37 PM

Cyberattacks are a nightmare for chief executives. To make matters worse, their insurers may refuse to pay up for damage the hackers do to their business.

A dispute between food and beverage giant Mondelez and Zurich Insurance (ZURVY) shows just how much is at stake. Mondelez has filed a lawsuit in Illinois that accuses the insurance company of refusing to cover losses it suffered as a result of the NotPetya cyberattack.

Digital security

Technology

Crime, law enforcement and corrections

Criminal offenses

Digital crime

Business and industry sectors

Business, economy and trade

Cyber attacks

Insurance

Unrest, conflicts and war

Continents and regions

Europe

Switzerland

Western Europe

Zurich

Cyberterrorism

International relations and national security

National security

Terrorism

Terrorism and counter-terrorism

Digital privacy

Companies

Mondelez International

Law and legal system

Lawsuits and claims

Trial and procedure

The attack swept across the world in June 2017, infecting networked computers at companies including advertising group WPP (WPPGF), drugmaker Merck (MKGAF) and global shipping company FedEx (FDX).

Mondelez (MDLZ) said in October 2018 that the attack cost it at least $114 million. But according to the lawsuit, Zurich Insurance has cited a "war exclusion" and refused to cover the losses.

The 'war exclusion'

The United States and the United Kingdom have blamed the NotPetya attack on Russia, suggesting that it was part of an effort to destabilize Ukraine.

In its lawsuit, Mondelez claims that Zurich Insurance subsequently refused to compensate it for losses suffered in the attack, citing a contract exemption for a "hostile or war like act" by any "government or sovereign power."

Zurich Insurance declined to comment on the dispute, saying it does not give details about individual policies. Mondelez also declined to comment.

The case could prove to be an important test for both companies and insurers, and help to establish when policyholders should be compensated for a cyberattack.

Rising threat

Executives in Europe, East Asia and North America say cyberattacks are the number one risk facing their companies, according to a survey published in November by the World Economic Forum.

Yet many companies do not have insurance that specifically covers cybercrimes, relying instead on general "all-risk" policies.

"Many of these all-risk policies may not even mention cyber, they were not designed to cover cyber," said Christine Marciano, CEO of insurance broker Cyber Data Risk Managers.

"They were written at a time when nobody could have predicted that these attacks would happen," she said.

Marciano said the insurance industry is closely watching legal actions such as the one filed by Mondelez to see whether more general policies should cover cyberattacks.

Contagious attacks

The nature of cyberattacks present real risks for insurers, as well as their clients.

Domenico del Re, an insurance expert and director at PwC, said insurers are most worried about systemic cyberattacks on the scale of NotPetya because they can simultaneously affect multiple clients across the world.

"This is what is different about cyber," he said. Other risks, like theft or kidnapping, are unlikely to affect multiple clients at the same time, he added.

The damage can also be extensive.

"There is a myriad of ways in which a cyberattack can cause financial loss — actual physical loss to the IT equipment, claims from third parties whose data was lost, fines, fraudulent transactions," del Re said.

That means that an insurance company could be on the hook for physical and financial losses, as well as damage to users and clients caused by data theft.

Data issues have become even more pressing after the General Data Protection Regulation (GDPR) came into effect last year in Europe. The law can mean huge fines for companies.

This could happen to you

"Companies that used to have the mindset of 'this can't happen to me' .... are now starting to realize this is something they can't be without," said Marciano.

Limited data on the damage caused by major cyberattacks makes it difficult for insurance companies to model and price policies.

Mondelez said its $114 million in losses were caused by property damage and disruptions to its business. It said in October that NotPetya had destroyed 1,700 of its servers and 24,000 of its laptops.

Equifax (EFX), which was also hit by a huge hack in 2017, said its damages exceeded $350 million. Insurance has so far covered $95 million, it said in its most recent quarterly financial report.

Minnesota Coronavirus Cases

Data is updated nightly.

Confirmed Cases: 38569

Reported Deaths: 1511
CountyConfirmedDeaths
Hennepin12456787
Ramsey4911228
Dakota238291
Stearns237119
Anoka2241109
Nobles16696
Olmsted112915
Washington111440
Mower9522
Rice8447
Scott7344
Clay58738
Kandiyohi5731
Blue Earth4792
Wright4755
Todd4012
Carver3811
Sherburne3175
Lyon3162
Freeborn2920
Watonwan2340
Steele2311
Benton2173
St. Louis18015
Martin1695
Nicollet16912
Cottonwood1360
Goodhue1318
Winona12515
Crow Wing10612
Pine1050
Le Sueur1031
Chisago1001
Otter Tail951
McLeod920
Carlton870
Dodge870
Polk822
Chippewa791
Unassigned7837
Isanti730
Waseca680
Douglas650
Itasca6412
Murray640
Meeker611
Morrison591
Becker560
Faribault560
Jackson550
Sibley542
Pipestone522
Pennington510
Renville352
Mille Lacs342
Wabasha330
Brown312
Rock310
Beltrami300
Fillmore300
Yellow Medicine300
Houston260
Swift221
Wilkin213
Norman200
Redwood180
Cass162
Roseau160
Aitkin150
Big Stone150
Koochiching151
Wadena150
Kanabec141
Grant120
Marshall120
Lincoln100
Pope100
Mahnomen91
Clearwater80
Hubbard70
Lake60
Traverse60
Lac qui Parle40
Stevens40
Red Lake30
Kittson20
Cook10
Lake of the Woods00

Iowa Coronavirus Cases

Data is updated nightly.

Confirmed Cases: 31670

Reported Deaths: 722
CountyConfirmedDeaths
Polk6638179
Woodbury325244
Black Hawk230158
Buena Vista171411
Johnson13148
Linn129482
Dallas128029
Marshall104919
Scott81510
Story7793
Pottawattamie73612
Wapello70830
Dubuque70222
Crawford6772
Muscatine64344
Sioux4770
Tama46529
Wright3861
Louisa36213
Jasper32517
Plymouth3225
Warren2901
Dickinson2663
Washington2439
Webster2292
Hamilton1891
Cerro Gordo1821
Boone1481
Clay1340
Clarke1322
Allamakee1314
Mahaska11617
Shelby1140
Clinton1121
Poweshiek1068
Carroll991
Pocahontas971
Bremer946
Des Moines922
Franklin900
Emmet880
Henry863
Cedar841
Taylor790
Hardin770
Monona770
Cherokee751
Floyd732
Marion700
Benton691
Guthrie664
Jefferson640
Sac640
Osceola620
Jones610
Butler572
Buchanan551
Humboldt551
Hancock540
Harrison540
Lee542
Calhoun532
Iowa530
Delaware511
Fayette510
Monroe516
Madison482
Clayton443
Lyon440
Davis411
Palo Alto410
Mitchell390
Winneshiek390
Grundy380
Mills370
Kossuth350
Howard340
Jackson320
Lucas314
Greene300
Chickasaw290
Union290
Winnebago290
Ida240
Cass230
Van Buren220
Appanoose213
Keokuk211
Page210
Worth200
Unassigned170
Adair160
Audubon161
Ringgold160
Decatur120
Montgomery102
Wayne100
Adams80
Fremont70
Rochester
Clear
86° wxIcon
Hi: 83° Lo: 70°
Feels Like: 88°
Mason City
Few Clouds
87° wxIcon
Hi: 88° Lo: 71°
Feels Like: 91°
Albert Lea
Clear
86° wxIcon
Hi: 89° Lo: 72°
Feels Like: 89°
Austin
Scattered Clouds
88° wxIcon
Hi: 86° Lo: 71°
Feels Like: 94°
Charles City
Clear
86° wxIcon
Hi: 88° Lo: 71°
Feels Like: 90°
Some relief in sight, after more storms
KIMT Radar
KIMT Eye in the sky

Latest Video

Image

Staying safe in the heat

Image

Restaurant decides to go back to take-out amid surge in cases

Image

Shop Local Safely

Image

Expanded Team of Community Outreach

Image

Protecting Residents and Staff

Image

Dave's Noon Forecast 7/7

Image

Rochester businesses close out of precaution

Image

How did businesses do on the 4th of July with tourism

Image

Stewartville's Will Tschetter commits to Michigan

Image

Covid-19 concerns, Rochester Boys and Girls Club temporarily closes

Community Events