The Rising Tide of Cyber Claims: An In-Depth Analysis

In an era where digital transformation is at the forefront of business strategy, the landscape of cyber risk is evolving rapidly. According to Allianz Commercial’s annual cyber risk outlook, the trend of increasing cyber claims shows no signs of abating. The report highlights a significant uptick in both the frequency and severity of large cyber claims, primarily driven by data and privacy breaches. This article delves into the key findings of the report, the implications for businesses, and the evolving strategies to mitigate these risks.

The Surge in Cyber Claims

The Allianz report reveals a startling 14% increase in the frequency of large cyber claims exceeding €1 million in the first half of 2024, alongside a 17% rise in severity. This marks a stark contrast to the previous year, where severity saw only a 1% increase. Notably, data and privacy breach-related incidents are implicated in two-thirds of these substantial losses. The overall number of cyber claims is expected to stabilize in 2024 after a staggering 30% increase in frequency during 2023, which resulted in over 700 claims.

Understanding the Drivers of Increased Claims

Michael Daum, Global Head of Cyber Claims at Allianz Commercial, attributes the growing significance of data breach losses to several notable trends. The rise of ransomware attacks, particularly those involving data exfiltration, is a direct consequence of changing attacker tactics and the increasing interdependencies among organizations that handle vast amounts of personal data. Furthermore, the evolving regulatory and legal landscape has led to a surge in ‘non-attack’ data privacy-related class action litigation, particularly in the United States.

The Rise of ‘Non-Attack’ Claims

The report identifies a concerning trend: the increase in ‘non-attack’ data privacy claims. These claims arise from technological advancements, the escalating commercial value of personal data, and a complex regulatory environment. Unlike the EU’s General Data Protection Regulation (GDPR), which provides clear guidelines, U.S. privacy regulations are often less prescriptive, creating a fertile ground for class action lawsuits. Daum notes that the costs associated with these claims can surpass those of ransomware incidents, sometimes reaching hundreds of millions of dollars.

The Class Action Litigation Landscape

In 2023, data breaches became one of the fastest-growing areas of class action litigation in the U.S., with over 1,300 lawsuits filed—more than double the number from 2022. Industries ranging from healthcare to social media and entertainment have faced multiple class action lawsuits for alleged privacy violations. The MOVEit data breach, for instance, resulted in over 240 lawsuits being consolidated into a single Multidistrict Litigation, highlighting the potential for hyper-litigation following significant data breaches.

The European Context

While the U.S. is currently experiencing a surge in data privacy litigation, Europe is not immune to these risks. Increased awareness of data protection rights, coupled with the availability of third-party litigation funding, may lead to mass data privacy claims in Europe, albeit on a smaller scale than in the U.S. As Tresa Stephens, Head of Cyber, North America at Allianz Commercial, emphasizes, understanding clients’ data governance standards and transparency regarding consumer data usage is crucial for insurers.

The Role of Artificial Intelligence

Artificial intelligence (AI) is becoming a double-edged sword in the realm of cyber risk. While AI technologies are increasingly utilized across industries, they also introduce new privacy, misinformation, and security risks. The reliance on vast amounts of data for training AI models raises concerns about potential breaches of privacy laws and the security of sensitive information. Organizations must navigate these challenges carefully to avoid falling victim to data breaches.

From Data Exfiltration to Data Protection

Despite increased investments in cybersecurity, many data breaches stem from weak security practices within organizations and their supply chains. Such incidents can lead to significant claims involving regulatory fines, notification costs, and third-party litigation. Vanessa Maxwell, Global Head of Cyber and Financial Lines at Allianz Commercial, stresses the importance of the insurance industry’s role in offering loss prevention and mitigation advice to businesses.

Best Practices for Mitigating Data Breach Risks

To effectively mitigate data breach risks, organizations must adopt robust cyber hygiene practices. This includes implementing strong access controls, database segregation, regular backups, timely patching, and comprehensive employee training. Furthermore, companies need to enhance their oversight of cyber vulnerabilities within their supply chains.

The Importance of Early Detection

Early detection and response capabilities are critical in minimizing the impact of cyber breaches. Rishi Baviskar, Global Head of Cyber Risk Consulting at Allianz Commercial, notes that approximately two-thirds of breaches are reported by third parties or the attackers themselves. Breaches that are not detected and contained swiftly can escalate dramatically in cost, with the potential for a €20,000 loss to balloon into a €20 million catastrophe.

Conclusion: The Future of Cyber Insurance

As the cyber risk landscape continues to evolve, the role of cyber insurance is becoming increasingly vital. Insurers must adapt their strategies to address the growing complexities of data privacy and cybersecurity. By fostering a culture of transparency and proactive risk management, businesses can not only protect themselves from the financial repercussions of cyber incidents but also make a compelling case for investing in robust cybersecurity measures.

In this rapidly changing environment, the collaboration between insurers and businesses will be essential in navigating the challenges posed by cyber threats and ensuring a safer digital future.