Client Alert
Billee Elliott McAuliffe, Matthew J. Haas, Melissa G. Powers, Jack M. Terschluse
share this page:
Earlier this month, the New York State Department of Financial Services (NYDFS) published Insurance Circular Letter No. 2, which analyzes the risks of cyber insurance from an insurer’s perspective, discourages making ransomware payments, and announces a new Cyber Insurance Risk Framework. NYDFS has been a trailblazer in the cybersecurity space: in 2017, it issued the nation’s first cybersecurity regulation for financial services, and in 2019, it created its first Cybersecurity Division. Both insurers and insureds should heed NYDFS’s advice to mitigate the risks associated with increased cyberattacks occurring across the globe.
NYDFS published its new framework amidst, and in response to, a stark increase in ransomware insurance claims. Ransomware is a type of malware that threatens to publish the victim’s data or perpetually block access to that data unless the victim pays a ransom. The Cybersecurity & Infrastructure Security Agency reports that such a ransom can exceed $1,000,000. According to NYDFS, from 2018 to 2019, ransomware claims increased by 180% and the average cost rose by 150%, with the number of ransomware attacks reported to NYDFS almost doubling in 2020 from 2019.
NYDFS explains that ransom payments “fuel the vicious cycle of ransomware” and emphasizes the growing risk to cyber insurers and insureds alike, who, by making ransom payments risk (1) liability for violating regulations issued by the Office of Foreign Assets Control by making ransom payments to sanctioned entities, (2) failing to guarantee that their data access will be restored (or even if restored, that the data will not be published publicly), and (3) enabling future ransomware attacks against the organization or other organizations. NYDFS notes that data of many victims were leaked even after they paid the ransom.
As an overarching goal, NYDFS emphasizes the urgent need for cyber insurers to have a comprehensive risk strategy that's endorsed by the insurer’s senior management. Although NYDFS’s new framework is directed at cyber insurers to help create effective risk strategies, insureds are also advised to consider NYDFS’s guidance, summarized below, to minimize their own cybersecurity risks.
As cybersecurity incidents continue to increase, we expect the law and insurance guidance to continue evolving to help both insurers and insureds navigate future incidents. If you need assistance with your cyber insurance policies or any potential insurance claims associated with cybersecurity or ransomware, or if you have more general questions regarding data privacy and/or cybersecurity laws, please contact one of the authors.