Cyberattacks Put Insurance Firewall to Test

A surge in cyberattacks on Indian organisations including State Bank of India, Central Bank of India, Bharat Electronics and hundreds of NBFCs has triggered a wave of cyber insurance claims, with insurers facing estimated losses of thousands of crores over the next few months.

While businesses rush to enhance their cyber insurance cover, the incidents have triggered a debate over whether existing policies adequately cover emerging cyber risks.

The biggest question insurers are policyholders seem to be confronting is: who pays when a vulnerability exposes thousands of organisations to the same threat?

Cyber insurance typically covers everything from costs of forensic audits, data breaches and business interruption to ransomware losses.

In some instances, insurers even directly negotiate with the hacker to determine whether and how much ransom needs to be paid.

There's also an uncertainty surrounding attacks involving rogue AI agents.

"Insurers get involved the minute an incident gets reported, to probe how it occurred and what kind of security controls were in place," chief technology officer at top bank told ET.

"Even though a

data breach has happened, damages do not occur for months. Insurers still track how this data moves on the dark web. Whether it's sold to phishing armies? Whether the leak has caused real monetary loss to the customers? They even help law enforcement authorities with this intelligence," the CTO said.

However, complex new-age threats, including vulnerabilities affecting widely used software and attacks involving artificial intelligence (AI) agents, are raising questions over the scope of insurance coverage. This debate follows recent disclosure of critical vulnerabilities in PHP, a programming language widely used to run websites, which put 70% of the internet at risk overnight.

Insurers said this scale is akin to "systemic risk," "act of God" or "natural disaster," which are not covered under policies.

Many existing policies only cover unauthorised access by humans and not those by AI agents, insurers said. Also, if state-linked actors are involved in a cyberattack, "war exclusions" may apply, they said. "A flaw that affects around 70% of the web is a shared vulnerability, not a shared loss," said Bhranti Shah, chief insurance officer at Mitigata, a cyber resilience and insurtech firm.

While each breach happens at an individual organisation, which makes it an insurable cyber event, organisations are expected to act once a vulnerability is flagged, she said. "The caveat is, when the vulnerability became known to the organisation, whether it was flagged in a VAPT report, and what steps were taken to mitigate it," Shah said.

In the case of PHP threat, the clearest claims will be breaches that happened before the patches to resolve the vulnerabilities were released on October 21, "or during the short window after their release but before organisations could reasonably apply them," she said.

"Exploitation attempts were traced as far back as October 17, four days before the patch," she said, stressing that that window matters. She also claimed that organisations have been slow to implement the patching. "Eight hours after release, only about one in 280 servers running supported versions showed the fix, and even two days later, the figure was only one in 10," Shah said.

State Bank of India, which recently reported a breach involving 375,000 records exposed on the dark web, has notified its insurer and is assessing the incident and potential losses before filing a claim, ET had reported earlier.

(This story has not been edited by economictimes.com and is auto-generated from a syndicated feed we subscribe to.)