WHAT happens if you don’t buy cyber risk insurance? Well, Jaguar Landrover certainly found out earlier this year. The luxury carmaker was hit by a devastating cyber attack in late August, causing it to shut down its production lines for more than four weeks and costing it £50m a week. It only got things back to normal in early October. It was initially forced to withhold payments from suppliers. That is no small matter, given that the automotive parts supply chain – which famously runs on the just-in-time model - supports 200,000 jobs in the UK. It even had to turn to its bankers to secure a £2bn funding facility, which won’t have come cheap. On top of all that, the government saw no choice but to step in with a £1.5bn credit guarantee, simply to avoid the potential economic fallout. That will have been welcome to JLR, of course. But the episode raises some important questions. Privately owned JLR has effectively benefited from state support when it could, of course, have insured itself commercially against the risk. The company made £2.5bn profit last year, so the premiums would easily have been within its means. Reportedly it even discussed that possibility of buying cyber cover with its insurance brokers but decided not to go ahead. Some commentators have framed this point in terms of moral hazard. By backstopping the company, the state was indirectly underwriting JLR’s lax cyber security standards, they contend. That sets a dangerous precedent and sends other big firms the message that they too can skimp on premiums. In the worst case, the decision will ultimately have emboldened the criminals. As well as JLR, other recent victims of cyber crime include Heathrow Airport and household name High Street retailers Marks & Spencer and the Co-op. Many big players in the maritime industries have also been on the receiving end, from boxship giants Maersk, MSC and CMA CGM to ports giant DP World and top broker Clarksons. A recent report from IBM, which examined data breaches experienced by about 600 organisations worldwide, put the average cost of an incident at $4.4m (or £3.3m). What is clear is that cyber risk is a growing threat, as hackers becoming increasingly more sophisticated. This special joint Insurance Day/Lloyd’s List podcast will look at how insurance can at least mitigate the worst impacts for companies in both the maritime and wider business sectors. Joining Insurance Day reporter Queenie Shaikh are: Robert Dorey, chief executive, Astaara William Altmann, director, CyberCube Stephen Wares, head of international underwriting, Coalition
