Worried about hackers, states turn to cyber insurance

This article originally appeared on Stateline, an initiative of the Pew Charitable Trusts.

As the threat from hackers and cybercriminals intensifies, a growing number of states are buying cyber insurance to protect themselves -- and taxpayers.

“It’s expensive. It’s a big budget item for us. But it’s absolutely worth it,” said Michael Hussey, Utah’s chief information officer. “You’re seeing breaches now that cost companies and states millions and millions of dollars.”

More than a dozen states now have cyber insurance policies, which cover losses and expenses if a computer network is hacked. Insurers typically pick up the cost of investigating and restoring data, notifying those whose information may have been compromised, and providing legal and public relations services and credit monitoring.

Hussey said Utah first bought a policy in 2015, three years after a data breach of a Department of Health server exposed 780,000 residents’ personal information to hackers. The state wound up spending millions of dollars to deal with the aftermath, including paying for credit monitoring and legal fees and conducting a security assessment of all state servers.

Utah now pays $230,000 a year for $10 million in cyber coverage and has a $1 million deductible. The policy covers every agency in the executive branch.

So far, the state hasn’t had any big data breaches that would require filing a claim, but that doesn’t mean it won’t happen in the future, Hussey said.

“We check what we’re supposed to be checking,” he said. “But with cyber, if one little thing is overlooked or you have bad luck and leave something undone, you’d hate to be left holding the bag to cover that.”

A growing market

In the wake of massive data breaches like those involving Yahoo last year and Anthem the year before, many businesses have scrambled to buy cyber insurance. Last year, insurers wrote $1.35 billion in premiums, a 35 percent jump from 2015, according to Fitch Ratings.

States have been following in their footsteps. In a survey of state CIOs this year, 38 percent reported having some type of cyber insurance, compared to 20 percent in 2015.

Even some small cities, such as Cody, Wyo., have purchased cyber coverage this year.

Hackers and cybercriminals in recent years have taken aim at state and local government networks, which contain information such as Social Security, bank account and credit card numbers on millions of people and businesses. And online activists have hijacked government computer systems, defaced websites and hacked into data or email and released it online.

In 2016, state information technology officers ranked cybersecurity as their top priority for the third year in a row.

James Lynch, chief actuary for the Insurance Information Institute, an industry trade group, said selling cyber insurance to states is especially challenging.

“What states do is so diffuse and sprawling, and they deal with so many types of people and circumstances, that it’s difficult for an insurance company to fully get a grasp on what those risks are and underwrite them all,” he said.

It can be equally challenging for those purchasing cyber insurance, he added.

“When you buy an auto policy, you have a pretty good idea what’s in it. The terminology is highly standardized. It’s been vetted through the courts,” Lynch said. “You don’t have that in cyber because the product is so new. The actual things being covered also vary greatly from policy to policy.”

And government agencies sometimes don’t understand the risks or what kind of coverage they’ll need, cyber experts say.

“Some states and local governments don’t even know where their data is or what they’ve got,” said Dan Lohrmann, chief security officer for Security Mentor, a national security training firm that works with states. “So when you start having to give the insurer a list of how many servers you have and what systems are included, it gets pretty complicated.”

Lohrmann said many state IT security officials initially were wary of cyber insurance, figuring they’d rather spend their limited resources on prevention. But many now take a different view, he said, because they realize that having the insurance will ensure that they are keeping their security programs up to snuff. Insurers won’t sell states policies unless they meet certain standards, including regularly training staff, encrypting sensitive data and updating servers.

In Georgia, Chief Technology Officer Steve Nichols said he was skeptical about cyber insurance at first, but when he saw how many giant companies had breaches and the financial impact, he changed his mind.

In July, Georgia bought comprehensive cyber insurance, which covers about a hundred state agencies, he said.

Nichols said he thinks Georgia has the largest amount of cyber coverage of any state -- $100 million. It pays a $1.8 million-a-year premium and has a $250,000 deductible per incident.

The state relied on a broker to guide it through the “very confusing and complicated” process and put together a deal with a consortium of insurers, he said.

Using cyber insurance

Montana was the first state to get cyber insurance, in 2011, said Lynne Pizzini, chief IT security officer. And it’s glad it did.

Three years later, hackers gained access to a server that contained Department of Public Health and Human Services data, including clients’ names and Social Security numbers and some health information. The state mailed letters about the incident to more than a million people who could have been affected.

Pizzini said the insurance company helped with the mailings, set up a call center and provided forensic investigation, legal and communications assistance and credit monitoring.

“We used all of the services in our insurance policy,” she said. “It would have cost us a ton more than the premium we pay.”

The state has a $2 million policy, which covers all agencies, including the university system, she said. It pays an $88,200 annual premium and has a $100,000 deductible per incident and a 10 percent copayment for credit monitoring.

But Pizzini and IT officials in other states caution that having cyber insurance shouldn’t make states complacent and view it as a substitute for a comprehensive security program. While the coverage can be a big help after the fact, they say, states need to invest in security, keep their technology updated, and be prepared for hackers and cybercriminals.

“It’s like brushing your teeth,” Georgia’s Nichols said. “You need to do it every day.”