Selloff or Market Correction? Either Way, Here's What to Do NextSee Overvalued Stocks

After Colonial attack, energy companies rush to secure cyber insurance

Published 05/28/2021, 01:05 AM
Updated 05/28/2021, 08:02 AM
© Reuters. FILE PHOTO: A computer keyboard lit by a displayed cyber code is seen in this illustration picture taken on March 1,  2017. REUTERS/Kacper Pempel/Illustration
CL
-
MCO
-
USO
-

By Laura Sanicola

(Reuters) -U.S. energy companies are scrambling to buy more cyber insurance after this month's attack on Colonial Pipeline disrupted the U.S. fuel supply, but they can expect to pay more as cyber insurers plan to hike rates following a slew of ransomware attacks.

The Colonial ransomware attack on May 7 shut the largest fuel pipeline network in the United States for several days, crippling fuel delivery to most of the U.S. East Coast. Pipeline companies rely on electronic networks, putting them at risk of additional attacks that could hamper delivery of crude oil or other fuels.

Insurers are preparing to increase cyber insurance premiums by 25% to 40% across many industries because of the number of claims, insurance companies and brokers have said. But energy companies should expect rate increases at the higher end of the spectrum as the Colonial attack exposed their vulnerabilities and exposed insurers to losses.

Only about half of the nation's pipeline companies currently buy cyber insurance even though ransomware attacks have become more frequent, according to Nick Economidis, vice president of cyber liability at insurer Crum & Forster.

"Since the Colonial outage, submissions from energy companies are up across the board," said Economidis, adding that he started getting calls the day after the Colonial attack.

Anthony Dagostino, cyber insurance broker at Lockton Companies, said his Houston office has been fielding a large number of calls from energy companies in recent weeks.

"Before the attack, the energy sector had some of the lowest interest in purchasing cyber insurance of all industries, but in the past two weeks, now they're very interested," Dagostino said.

Regulators are working with pipeline companies to strengthen protection against attacks, the U.S. Department of Homeland Security said this week. The energy industry's "cyber risk management and mitigation practices are not as advanced" as other major sectors like banking or real estate, raising the risk of successful attacks, Moody's (NYSE:MCO) Investors Service said in a May 10 report.

Cyber attacks can be particularly damaging for the pipeline sector compared with other companies in the energy sector because fuel supply cannot be easily rerouted, Moody's said, and pipeline operators have increased their use of digital technologies to manage delivery.

To date, many companies have not bought cyber insurance because of high premiums and difficulties in quantifying the costs from incidents, according to a report from the Government Accountability Office https://www.gao.gov/assets/gao-21-477.pdf, a federal watchdog, on Monday.

"A lot of operators have not done the business impact assessments that banks and big retailers do to determine overall costs of being down for a certain period of time," said Dagostino.

Colonial had cyber insurance coverage of only about $15 million, according to one media report. Last year, the company had net income of $420 million on $1.3 billion of revenue, according to regulatory filings.

Cyber insurance typically covers ransom payments and insurers often provide staff to negotiate with the hackers, in addition to IT and public relations services.

The average ransom paid is $1.9 million, but in recent months cyber criminals have extracted ransoms as large as $40 million from a single company, according to a Bloomberg News report.

Companies that have cyber insurance often retain the initial loss that can range from $500,000 to $10 million, depending on the policy. Then the insurance kicks in to cover the ransom, which in Colonial's case was $4.4 million, its chief executive told the Wall Street Journal.

Insurance also covers business interruption costs, and costs from supply-chain partners after a waiting period of eight to 24 hours.

© Reuters. FILE PHOTO: Holding tanks are seen in an aerial photograph at Colonial Pipeline's Dorsey Junction Station in Woodbine, Maryland, U.S. May 10, 2021. REUTERS/Drone Base

Colonial, which carries about 2.5 million barrels of fuel a day, could have lost $9 million to $15 million in revenue from the six-day outage, depending on the waiting period, according to calculations by Reuters. Colonial has not commented on its losses.

Companies started to buy cyber insurance in recent years after state laws began requiring them to notify consumers of data breaches. Pipeline companies, however, have little consumer data, which may have prevented them from purchasing protection, Economidis said.

Latest comments

Risk Disclosure: Trading in financial instruments and/or cryptocurrencies involves high risks including the risk of losing some, or all, of your investment amount, and may not be suitable for all investors. Prices of cryptocurrencies are extremely volatile and may be affected by external factors such as financial, regulatory or political events. Trading on margin increases the financial risks.
Before deciding to trade in financial instrument or cryptocurrencies you should be fully informed of the risks and costs associated with trading the financial markets, carefully consider your investment objectives, level of experience, and risk appetite, and seek professional advice where needed.
Fusion Media would like to remind you that the data contained in this website is not necessarily real-time nor accurate. The data and prices on the website are not necessarily provided by any market or exchange, but may be provided by market makers, and so prices may not be accurate and may differ from the actual price at any given market, meaning prices are indicative and not appropriate for trading purposes. Fusion Media and any provider of the data contained in this website will not accept liability for any loss or damage as a result of your trading, or your reliance on the information contained within this website.
It is prohibited to use, store, reproduce, display, modify, transmit or distribute the data contained in this website without the explicit prior written permission of Fusion Media and/or the data provider. All intellectual property rights are reserved by the providers and/or the exchange providing the data contained in this website.
Fusion Media may be compensated by the advertisers that appear on the website, based on your interaction with the advertisements or advertisers.
© 2007-2024 - Fusion Media Limited. All Rights Reserved.