printer friendly version

The murky waters of cyber warfare and insurance coverage

South Africa has seen a dramatic rise in cyberattacks and successful breaches during the past two years, as well as an accompanying surge in ransom demands.

In the most recent high-profile attack, credit reporting agency TransUnion South Africa revealed that at least three million South Africans have been impacted by a data hack, after the agency was compromised by hacker group N4aughtysecTU.

The proliferation of these types of attacks demonstrate how vulnerable organisations can be to cyberattacks and are forcing organisations to increasingly rely on their cyber insurance policies. At the same time, many insurers are looking to remain viable amid a changing cyber insurance landscape to try to manage their own exposure.

Ryan van de Coolwijk, product head at iTOO’s Cyber Insurance division, says that as cyber insurers are trying to manage their coverage of these incidents, companies must revisit their cyber insurance policies and rethink how they respond to incidents.

Unique cover

In South Africa, state-owned Sasria is the only non-life insurer that provides special risk cover to government entities as well as to all individuals and businesses that own assets in South Africa, as well as government entities. This is unique cover against risks such as civil commotion, public disorder, strikes, riots and terrorism.

However, says Van De Coolwijk, Sasria’s cover only extends to physical incidents of unrest, riots and terrorism, thus excluding any cyberattack that may be classified as cyber terrorism or cyber warfare. “Essentially, this means that any organisation that comes under attack from state-sponsored cybercriminals, in an incident that can be classified as cyber warfare, could find itself without any cover at the present moment.

“These exclusions mean that there is a gap in current cyber insurance coverage, meaning that organisations should bulk up their cybersecurity practices and systems to mitigate their exposure to threats posed by bad actors.”

Cyber warfare is commonly defined as a cyberattack or series of attacks that target a country and has the potential to wreak havoc on government and civilian infrastructure and disrupt critical systems, resulting in damage to the state and even loss of life.

Yet, Van De Coolwijk points out, this is a complex issue, as debate continues among cybersecurity experts as to what kind of activity constitutes cyber warfare. The US Department of Defence recognises the threat to national security posed by the malicious use of the internet but does not provide a clear definition of cyber warfare. Others consider cyber warfare to be a cyberattack that can result in death.

No quick fix

“So, the question of what constitutes cyber warfare revolves around a wide spectrum of philosophical, semantic and legal questions, most of which are not likely to be resolved in the near future. Yet, the implications are more practical and immediate. Whether or not an attack that affects the private sector can be classified as cyber war can have a substantial effect on whether the incident is covered by a cyber insurance policy.”

Van De Coolwijk notes that while there are several examples of alleged cyber warfare in recent history – involving a nation-state perpetrating cyberattacks on another – there is still no universal and formal definition for how a cyberattack may constitute an act of war. This is however changing quickly following the outbreak of war in the Ukraine, with standard definitions and exclusions being developed and rolled out.

In recent months though, insurers have tried to reject cyber insurance claims on the grounds that they constitute cyber warfare, but with mixed success. These attempts at exclusion show that cyber insurers are trying to limit their coverage of these incidents.

In light of this evolving landscape, Van De Coolwijk suggests that companies need to ensure that they are aware of changes in the marketplace of cyber insurance coverage by reviewing their existing policy to see what language is included in the war exceptions. Additionally, organisations must check to see whether their insurer has issued any guidance around these exclusions, and they need to also clearly understand any changes to policy terms during ongoing or upcoming negotiations.

“Until such time as there is some universal agreement on what constitutes cyber war, I suggest policyholders check with the brokers and their policy wording to have a clear view on their possible exposure,” says Van De Coolwijk.

Share this article:

Further reading: