It’s been truly astounding to watch cyber risk develop over the past few years. What started as risk surrounding the loss of private, mostly financial, data, has evolved into a risk encompassing everything from extortion to potential bodily injury and property damage.
News came from England last week Tuesday that a large-scale attack hit three NHS hospitals. A "malicious” cyberattack…forced the cancellation of all appointments, procedures and operations for two days…The hospitals’ computer systems control all aspects of operations, so the virus has affected “everything from ventilation, gasses, even down to the car park barriers.”
While cyberattacks are beginning to be somewhat less noteworthy (read: common, a distressing thought by itself), what sets this attack apart is the breadth and depth of the attack. Back in February, the Hollywood Presbyterian Medical Center in Los Angeles fell victim to a ransomware attack that locked down its electronic communications systems for nearly two weeks. That attack did not compromise any patient data, and no patients were hurt as a result. The attack on the NHS hospitals appears to be more pervasive in that many more of the hospital’s operations were impacted by the shutdown.
To add to the concern, it’s been proven that hackers can, once inside a hospital’s network, gain access to medical infusion pumps (the Symbiq Infusion System by Hospira; think IV drips) and alter the amount of medication given to patients. Luckily, this security flaw was discovered by a white hat hacker before any patient was hurt and the item in question has been recalled by the FDA. Still, it raises questions about what other vulnerabilities may be present in existing technology.
Now, how does all of this relate to cyber insurance? Great question. The fact is that the vast majority of cyber liability policies have specific exclusions for bodily injury and property damage resulting from a cyber security incident. In addition, property & general liability policies generally exclude coverage for cyber-related events. So where does that leave us?
Don’t ever assume that your cyber policy covers this type of loss. Of the 70 or so true cyber liability carriers, there is only a small handful that offer this coverage. Unless you’ve had very specific conversations on this very topic with your insurance advisor, don’t assume the coverage is there!
Your Property & Casualty Consultant is always here to help assess your cyber risk.
COMMENTS