Protection from Ransomware Attacks Isn’t as Simple as Insurance

Local governments facing an onslaught of ransomware attacks are increasingly turning to insurance to protect them if hackers successfully take control of a city’s computer system. 

But experts warn that local governments may not be getting the level of protection they need through basic policies. And when insurance companies opt to pay ransoms, rather than cover the (sometimes exorbitant) cost to recover data, they make local governments a bigger target for hackers.

Larger cities may purchase their own individual plans, like Houston did in 2018 when it paid close to $500,000 for a $30 million plan that would cover emergency response to cyber security breaches and losses associated with a cyberattack. In contrast, many smaller municipalities receive coverage through pooled plans, such as those offered by associations..  

“A lot of plans that municipalities are looking at—it’s a patchwork,” said Alan Shark, executive director of the Public Technology Institute, a technology organization that works with city and county governments. “There are no universal standards.”

Coverage Gaps

The Maryland municipalities that belong to the Local Government Insurance Trust (LGIT), a member-owned association that offers pooled insurance, receive $1 million in cyber insurance coverage as part of a standard insurance package. That level of coverage has worked so far for the more than 190 government entities that receive insurance through the trust, said LGIT Executive Director Tim Ailsworth. In five years, he said the trust has only had five cybersecurity-related claims, with the most expensive costing $67,000.

But given the $18 million price tag associated with Baltimore’s recovery from a ransomware attack earlier this year, some members have started to inquire about upping the coverage level, Ailsworth said.

“$1 million is not a lot when you consider the $18 million hit that Baltimore had,” he said. “We are evaluating whether we can add more coverage and pass the costs to the members.”

Baltimore, which refused to pay the ransom, did not have cybersecurity insurance and has  considered purchasing coverage in the wake of the attack.

Forty-four percent of local governments reported having purchased some form of cyberinsurance policy in 2017, according to an International City/County Management Association survey of 411 entities. Of those, the level of coverage varied, with 36 percent reporting moderate coverage and only 10 percent reporting full coverage.

Obtaining insurance for these kind of attacks can aid local governments in two distinct ways, said Donald F. Norris, professor emeritus of public policy at the University of Maryland, Baltimore County and author of the ICMA survey.

First, getting coverage typically requires governments to assess the current state of their cybersecurity practices and maybe make improvements. Second, if hackers successfully hit a local government, the insurance company will cover expenses associated with a data breach and recovery or, as has been seen in a number of recent cases, pay a ransom to get back stolen data or unlock a system.

Most cyberinsurance providers require some form of risk assessment of clients, according to experts. These can range from several pages of detailed questions that can be used to determine whether or not an insurer will provide coverage to a short questionnaire on current practices that could be used to determine rates.

Making upgrades to comply with the risk assessments can go a long way in strengthening protections, Norris said.

Not All Policies Are Equal

Some standard policies may cover credit monitoring costs if citizens’ private data is stolen, as well as the costs of restoring files lost in a ransomware attack, data breach response and crisis management services, Shark said. Other desirable features could include coverage for business lost due to a cyberattack, such as when a city is unable to collect revenues due to a disabled computer system.

But Shark advises local governments to be aware of caps on the amount an insurance policy will cover. He also warns potential buyers to beware of gaps in coverage, like clauses indicating coverage will not be provided if a local government is shown to be careless or negligent in its cybersecurity practices.

“What if they didn’t keep up with a patch management policy that is required in most of these questionnaires? That would be negligence and that is a real danger,” Shark said.

In New Jersey, the Municipal Excess Liability Joint Insurance Fund offers lower deductibles and copays for municipalities that can demonstrate they take certain cybersecurity precautions. The more than 380 municipalities that participate in the fund all receive cybersecurity coverage through the insurance pool, but rates vary depending on their level of commitment to best practices, said Dave Grubb, the fund’s executive director.

“We’ve emphasized the need for municipalities to take a hard look at their systems and develop policies and procedures to operate their systems in such a way as to minimize exposure,” Grubb said. “That includes keeping their systems up to date, putting the patches in when they are offered.”

Of the fund’s overall $200 million annual budget, cybersecurity claims have accounted for less than $1 million each year, Grubb said. The fund has paid ransom to hackers in the past, but Grubb, who declined to discuss specific cases, said members are a part of the decisionmaking process when it comes to deciding whether or not to pay a ransom.

To Pay or Not to Pay?

The FBI does not recommend paying a ransom, saying it “provides an alluring and lucrative enterprise to other criminals.” The bureau instead encourages cyberattack victims to report incidents to federal authorities for investigation. More than 200 mayors over the summer signed onto a resolution against paying ransoms. 

The cybersecurity firm Barracuda analyzed the circumstances of 55 ransomware attacks on state or local governments that occurred this year, finding ransoms were paid in just three cases. Of those attacks, 38 targeted local governments, 14 targeted county governments, and three targeted state governments.

One of those municipalities, Lake City, Florida, paid a $460,000 ransom at the behest of its insurance company. The city was liable for only its $10,000 deductible.

So long as the city’s data is returned, the decision to have the insurance company pay the ransom is financially understandable, Norris said.

“If something does happen, you don’t get stuck with a multi-million dollar bill,” he said. “But there are also good reasons not to want to pay bandits. It funds them to do damage and it tells them their business model is working so they keep doing it.”

While cyberinsurance can mitigate municipalities’ risks, coverage won’t prevent ransomware attacks, Shark said.

Experts say if local governments are looking into insurance coverage, they should also be thinking about how they plan to strengthen their cybersecurity policies.  

“They also ought to be training staff,” Norris said. “All these entities are under constant attack. Where they find a vulnerability they will exploit it every single time.”