For companies and organizations, an attack by hackers can meanfinancial losses, corporate embarrassment and legal action. Forinsurers jumping into the brave new world of cybercrime insurance,it's free marketing for what could be a $10 billionopportunity.

High-profile computer breaches like the hack of theDemocratic National Committee and the Twitter swastika hack arereinforcing the need for protection against cyberthreats, andcompanies such as Allianz and Beazley are eager to step in.Insurers see coverage against hackers as one of their mostpromising market and estimate that premiums will triple over thenext four years.

“We are optimistic that it can develop into Allianz's and theindustry's next blockbuster,” Hartmut Mai, chief underwritingofficer for corporate lines at Allianz's commercial insurance arm,said in an interview. “Cyber insurance is our key growth area atthe moment.”

A new breed of coverage couldn't come at a better time forinsurers, which are struggling to expand in most of theirestablished markets amid slow economic growth and low catastropheclaims that weigh on prices. Insurance premium income stagnated inEurope last year and is expected to grow 1.3% next year, accordingto reinsurer Munich Re. The company estimates that cyber insurancepremiums could rise to between $8.5 billion and $10 billion by 2020from about $3.4 billion currently.

A further boost to demand may come from rules to be introducednext year by the European Union that will require companies toreport cyberbreaches to regulators and affected individuals.

Allianz currently writes a double-digit million-euro amount ofcyber insurance premiums and recorded 28% growth last year,according to Mai. He said the product may evolve into an industrybestseller comparable to directors and officers liabilityinsurance, which became a top offering during the last decade andnow accounts for about 10 billion euros ($11 billion) in globalpremiums.

Boardroom Issue

“Cyberrisk has become a boardroom issue over the past years,following some high-profile hacker attacks,” Paul Bantick,head of cyber insurance at Beazley, said in an interview. “Wehaven't seen the big breaches at the retailers such as in 2015 orthe large health care breaches that occurred in 2016. Yet there'sstill a high frequency of smaller losses.”

Cyberattacks involving ransomware — in which criminals usemalicious software to encrypt a user's data and then extort moneyto unencrypt it — increased 50% in 2016, according to a report fromVerizon. Criminals increasingly shifted from going after individualconsumers to attacking vulnerable organizations and businesses, thereport said.

Government organizations were the most frequent target of theseransomware attacks, followed by health care businesses andfinancial services, according to data from security company McAfee,which partnered with Verizon on the report.

While companies have had decades, and in some cases centuries,to work out the risks of fire, natural catastrophes and physicaltheft, cybercrime is relatively recent, with new and moresophisticated schemes being developed every year. With damages onthe rise, the biggest challenge for insurers is to set the rightprice and limits for their coverage. One in four midsizedbusinesses in Germany have suffered a loss from a hackerattack, according to a survey published in March by Germany'sGDV insurance lobby group.

“For insurers to stay relevant in an ever more technology-drivenbusiness environment, they need to embrace the opportunity whileproperly managing the risks,” Thomas Seidl, an analyst atSanford C. Bernstein in London, said in a note to clients on April24.

Like Munich Re and Allianz, Beazley also sees rapid growth incyber insurance. The Lloyd's of London insurer partners with MunichRe to provide the product and it's running the book at a profit. Tomake sure that continues, insurers are careful not to take overlylarge risks in the nascent market.

“We limit our coverage to $100 million per client, of which bothMunich Re and Beazley take $50 million,” Beazley's Bantick said.“In bigger programs, the $100 million is just a first part, withothers providing additional coverage.”

The scope of cyber insurance varies from one provider to theother. Typically, it protects against data and network securitybreaches and associated losses, and insurers limit their capacityto between $5 million and $100 million per client.

A customer fact sheet prepared by insurer Chubb, which countsthe U.S. as its largest market, described a claim where hackersgained access to a school district's network to steal names,addresses and account information from 20,000 past and presentfaculty and students. Compensation included settlements fromcompromised individuals, costs of responding to a regulatoryinvestigation and public relations fees. Other cases included adata center for an online retailer that was forced to shut downtemporarily and a car components maker whose system was encryptedto extort ransom.

A recent study by risk modeler Risk ManagementSolutions found that “if all U.S. businesses had cyberinsurance, over $5 billion a year would be lost to the insuranceindustry from cyber data exfiltration alone. Data breaches are theleading cause of cyber insurance loss.”

Global Event

One concern is that a global cyberevent such as a devastatingvirus that spread from Asia to Europe and the U.S. or a globalcloud computing provider breaking down could affect a large numberof companies covered by one insurer.

“A hurricane with a probability of happening once in 25 yearscould cost us as much as $150 million, and the whole industry about$30 billion,” Hiscox CEO Bronek Masojada said in an interview.“Due to the lack of history, the question with cyber is whether a$30 billion loss happens once in 25 years or once in 100 years. Themost important question is whether we will be alive after it.”

In terms of growth, “cyber is by far the most important part” ofthe business at Hiscox right now, he said. The London-based insurerwill write more than $100 million in cyber premiums this year at agrowth rate of 20% to 30%, Masojada estimated.

Cyber insurance premiums at Beazley already exceed $400 million,excluding broker commissions, Bantick said. Munich Re's premiumincome from the product rose to $263 million last year from $191million in 2015. The Munich-based reinsurer aims to keep a marketshare of 8% to 10% going forward, reinsurance head Torsten Jeworreksaid.

Beazley's Bantick says his company is “starting to see shoots ofdemand in Europe, Latin America and Asia.” Allianz's Mai agrees,adding that he sees last year's strong growth rates as “theproduct's final breakthrough in Europe.”

Prices are on the rise as well. In the U.S., cyber-liabilityrates climbed for the 10th consecutive quarter at the end of lastyear while rates continued to decline in most other globalinsurance lines, according to a report by broker Marsh &McLennan Cos.

“While there are a lot of companies buying cyber coverage, mostof them are data-breach driven,” Beazley's Bantick said. “Butclients are looking for large, holistic cyber programs that coverwhatever happens from data breach to property damage and businessinterruption.”

Leoni's experience is a lesson in the complexity of cyber risks.The German cable manufacturer lost 40 million euros last yearwhen fraudsters used fake electronic communication to trick anexecutive into transferring the cash to foreign accounts. Inthe end, the company got about 5 million euros from fidelityinsurance it had. Even though Leoni had sufficient cyber insurancein place, it didn't apply because the fraudsters didn't hack thecompany's systems.

Bloomberg News

Copyright 2018 Bloomberg. All rightsreserved. This material may not be published, broadcast, rewritten,or redistributed.