P&C

What About Cyberterrorism?

Acts of cyberterrorism are covered under the Terrorism Risk Insurance Program (TRIP) should the economic losses trigger the threshold required for federal assistance.
By Rob Boyce Posted on May 2, 2019

The possibility of this outcome raises the question: how have insurers treated alleged state-sponsored cyberattacks that could arguably fall under the umbrella of cyberterrorism and thus, be included in the Terrorism Risk Insurance Program (TRIP)?

Acts of cyberterrorism are covered under the Terrorism Risk Insurance Program (TRIP) should the economic losses trigger the threshold required for federal assistance. In a guidance issued by the Treasury Department at the end of December 2016, the Treasury made clear that cyber coverage “written in TRIP-eligible lines of insurance” is covered by TRIP.

Generally speaking, insurers seem inclined to modify the war exclusion in cyber policies to omit cyberterrorism. There have been a number of state-sponsored cyberattacks recently—including WannaCry, often attributed to the North Korean government—and there has been no high-profile denial of coverage by insurers under the war exclusion like this most recent one from Zurich. Likely, insurers will see that pursuing coverage denials too aggressively would result in lost customers. Thus, insurers have been willing to cover damages from fallout like the one seen in NotPetya, WannaCry, etc. without much pushback.

Acts of cyberterrorism are covered under the Terrorism Risk Insurance Program (TRIP) should the economic losses trigger the threshold required for federal assistance. In a guidance issued by the Treasury Department at the end of December 2016, the Treasury made clear that cyber coverage “written in TRIP-eligible lines of insurance” is covered by TRIP. Additionally, cyber liability policies defined as “stand-alone comprehensive coverage for liability arising out of claims related to unauthorized access to or use of personally identifiable or sensitive information due to events including but not limited to viruses, malicious attacks or system errors or omissions” that may “also include expense coverage for business interruption, breach management and/or mitigation services” are definitively included in the definition of “property and casualty” insurance covered by TRIP. It is expected that should TRIP be authorized in December 2020, much will stay the same.

Though the court battle between Mondelēz and Zurich is being fought in the context of a property policy, it carries major implications for cyber insurance in the future, as many cyber insurance policies do have war risks exclusions. A broad ruling in favor of Zurich could make it that much more difficult to mitigate cyber risk with insurance policies, considering the recent increase in state-sponsored cybercrime. Whatever the outcome may be, the case illustrates that brokers and risk managers, as well as their clients, must be vigilant, seek clarity and assurances to minimize the possible risk of coverage denial in the event a state actor is involved in a triggering event, and become intimately familiar with cyber policy terms, conditions and exclusions.

However, in regards to TRIP, where an event has never triggered the thresholds required for federal assistance, there is much more ambiguity, especially when it comes to covering a cyber-event defined as terrorism.

Rob Boyce Director, Market Intelligence & Insights Read More

More in P&C

Cyber Risk, Changes in Legislation, and Climate Change: Trouble Ahead in 2020
P&C Cyber Risk, Changes in Legislation, and Climate Change: Trouble Ahead in 2020
Experts identify top business risks for 2020 in new report from Allianz.
Brokerage Ops 20 for 2020
These 20 steps can help you achieve a reasonable state of cyber-security maturit...
Keeping Pace
P&C Keeping Pace
Technology can help close the protection gap. But regulation must keep up with i...
Ocean Risk and Resilience
P&C Ocean Risk and Resilience
Global collaboration is needed to build coastal resilience.
Looking Back: 2019 Emerging Trends to Watch
P&C Looking Back: 2019 Emerging Trends to Watch
As the decade comes to a close, we’re reflecting on the to...
Yuletide Risk
P&C Yuletide Risk
There’s nothing like a fresh cut Christmas tree, but there...