Spurred by reports of criminals hijacking computer networks and demanding payment, many governments and companies are buying insurance against these high-tech crimes. But security experts warn that insuring against attacks — and, in particular, paying ransoms — is likely only to embolden criminals.
To town councillors in Essex, Ont., it sounded like an expensive, if necessary, proposal.
At a public meeting last August, the town’s insurance provider pitched a new type of policy that he said a growing number of municipalities are buying: coverage against cyberattacks.
“By purchasing this layer of protection, you can have a little peace of mind,” Wally McNeilly, of Aon Risk Solutions, told the councillors.
Spurred by reports of criminals hijacking computer networks and demanding payment, more and more local governments and companies are purchasing specialized insurance coverage against these high-tech crimes. However, some security experts warn that insuring against attacks — and, in particular, paying ransoms — is likely to embolden hackers by increasing their confidence they can get paid.
In Essex, near southwestern Ontario’s border with Michigan, the insurer offered a $15,000 plan for the remainder of the year, covering a variety of expenses that could be incurred in the event the town’s computer network were infected with malicious code: legal costs, regulatory fees, IT assistance and a ransom payment of up to $1 million.
Some officials questioned the price of the coverage. Considering the additional $5,000 deductible, Coun. Chris Vander Doelen pointed out that, in Essex, a town of 20,000 people, “that’s about a dollar per head.”
Still, council approved the coverage, perhaps fearing what happened in Wasaga Beach, Ont., in 2018. McNeilly described how the town was forced to pay a $35,000 ransom when its network was held hostage, on top of $250,000 in additional costs from the attack, including overtime for staff.
“There’s no industry that’s not picked on anymore when it comes to cybercrime,” he said.
The recent case of an unnamed Canadian company paying a $950,000 US ransom through its U.K.-based insurer has only highlighted the problem further. Other victims, including the Nunavut government and a Prairie-wide insurance firm, have publicly refused to pay a r