Cyber claims have continued their upward trend over the past year, driven in large part by a rise in data and privacy breach incidents, Allianz Commercial warns in its annual Cyber Risk Outlook. The frequency of large cyber claims
Data and privacy breach-related elements are present in two-thirds of these large losses. Overall, the total number of cyber claims in 2024 is expected to stabilise, following a 30% increase in frequency during 2023, which resulted in 700+ claims.
“The growing significance of data breach losses among cyber insurance claims is driven by several notable trends,” explains Michael Daum, Global Head of Cyber Claims, Allianz Commercial. “A rise in ransomware attacks, including data exfiltration, is a consequence of changing attacker tactics and the growing interdependencies between organisations sharing ever more volumes of personal records. At the same time, the evolving regulatory and legal environment has brought an uptick in so-called ‘non-attack’ data privacy-related class action litigation, resulting from incidents such as wrongful collection and processing of personal data – the share of these claims has tripled in value in two years alone.”
‘Non-attack’ claims and privacy litigation increase
The rise in ‘non-attack’ data privacy claims is the consequence of developments in technology, the growing commercial value of personal data, and a developing regulatory and legal landscape. For example, unlike the EU’s General Data Protection Regulation (GDPR), privacy regulations in the US are less prescriptive and open to interpretation, while plaintiff lawyers are hungry for potential sources of revenue. The report notes that this is creating a grey area ripe for class action litigation.
“We are seeing more data privacy breach claims in the US where there is a growing trend for class action litigation against large US and international corporations related to privacy violations, such as around consent and data usage,” says Daum. The cost of some of these claims can be even larger than a ransomware incident; in the hundreds of millions of dollars.”
Over the last year, data breaches have emerged as one of the fastest-growing areas of US class action litigation. According to law firm Duane Morris, over 1300 were filed across a wide range of data privacy regulations in 2023, more than double the number filed in 2022 and four times that filed in 2021.
South Africa among top 15 in data breach costs
South Africa ranks 14th globally in the average cost of a data breach, reaching $2,78 million in 2024. This highlights the significant financial impact of data breaches within the country. The US had the highest average cost at $9,36 million. Rounding out the top five regions and countries were the Middle East
Multiple class action lawsuits have been launched against organisations across a wide range of industries, including healthcare, social media, and gaming, for using tracking tools such as Meta Pixel to monitor consumer behaviour, while entertainment streaming platforms have also been targeted, alleging that they may have violated privacy protection rights. Large data breach events can also evolve into hyper litigation, with one event triggering a slew of class actions.
Over 240 lawsuits related to the 2023 MOVEit data breach were consolidated into a single Multidistrict Litigation in October 2023. With large numbers of claimants, there are incentives for parties on both sides to settle. Last year, the top 10 data breach class action settlements totalled $516million, a significant increase over the $350million recorded in 2022.
The risk of data breach litigation is also growing in Europe. Heightened awareness of data protection rights, a rise in the availability of third-party litigation funding, and a more consumer-friendly litigation environment could make mass data privacy claims a reality, albeit not on the same scale as the US, the report notes.
AI to power and prevent future data privacy breaches
The fact that almost every industry is now using AI will have a significant impact on the cyber and privacy risk landscape in the future. AI relies on the collection and processing of vast amounts of data, including personal, health and biometric information, for training AI models and making predictions or recommendations. However, AI tools such as chatbots can create potential privacy, misinformation, and security risks if not properly managed. With so much data being collected and processed, there is a risk that it could fall into the wrong hands, either through hacking or other security breaches. There are also concerns around potential breaches of privacy laws, such as whether organisations have proper consent to process data through AI.
From data exfiltration to data protection
Despite a general trend for increased investment in cybersecurity in recent years, many data breaches, including some of the largest mass data exfiltration cyberattacks over the past 18 months, result from weak cybersecurity within organisations and/or their supply chains. Such incidents can lead to a large claim involving regulatory fines, notification costs and third-party litigation, in addition to extortion demands, first-party costs and business interruption.
“The insurance industry must also step up its focus on the data privacy side of cyber risk and has a key role to play in offering loss prevention and mitigation advice to businesses about this increasingly important area of exposure,” says Vanessa Maxwell, Global Head of Cyber and Financial Lines, Allianz Commercial. “The value of cyber insurance goes well beyond the payment of claims. Insurance helps companies make the business case for cybersecurity investment and to direct their resources towards the most effective measures.”
Data breach risks are best mitigated through good cyber hygiene, including strong access controls, database segregation, backups, patching and training. Having better oversight of any cyber weaknesses in their supply chains is an area where many companies need to improve.
“Early detection and response capabilities are also key. Around two-thirds of breaches are typically reported by a third party or by the attackers themselves,” says Rishi Baviskar, Global Head of Cyber Risk Consulting, Allianz Commercial. “Cyber breaches that are not detected and contained early can end up being 1000 times more expensive than those that are, the difference between a
“AI is also becoming an essential tool in the fight against cyberattacks, as it can quickly identify a security breach and automatically isolate systems and databases, as well as having the potential to significantly reduce the cost and life cycle of a data breach claim by automating tasks, such as forensics and notifications, potentially saving companies millions of dollars.”
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version