Ransomware Attacks on the Rise: Will Cyber Insurance Protect You?

Kelley Drye & Warren LLP
Contact
In just one year, ransomware attacks reported to the New York State Department of Financial Services (“DFS”) have almost doubled.  In these incidents, a cyber-attacker installs malware that encrypts a victim’s computer systems or files and then demands a fee, or ransom, to unlock the encrypted data.  Fortunately, cyber insurance that expressly covers the risk of ransomware has been widely available in recent years.  These policies will pay for some or all of the ransom demand in the event of a ransomware attack, allowing the policyholder to regain control over its files and systems and resume operations.  While paying a ransom is unappealing to most, it is typically far less expensive than the cost of replacing or restoring permanently-locked files and equipment, along with associated downtime. 
 

Regulators have long scrutinized the perverse incentives of ransomware payments, however, and their tendency to encourage more ransomware attacks.  On February 4, 2021, the DFS issued guidance, the Cyber Insurance Risk Framework, outlining the best practices for New York-regulated casualty and property insurers that underwrite cyber insurance.  Notably, the DFS recommends that insurers not make ransomware payments.  The DFS cited Office of Foreign Assets Control of the U.S. Department of the Treasury guidance that insurers can be held liable for making ransom payments to sanctioned entities.

The Risk Framework is nonbinding, but its recommendation that insurers not make ransom payments could put pressure on insurers to stop issuing cyber insurance policies with ransomware coverage.  Although this may advance DFS’ policy goal of reducing incentives to commit ransomware attacks, there is no question that, in the short run, it would make ransomware attacks far more costly for policyholders, who would have to either pay the ransom out of pocket or shoulder the cost of restoring their encrypted computer systems.

[View source.]

Written by:

Kelley Drye & Warren LLP
Contact
more
less

Kelley Drye & Warren LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.