The September data breach of Home Depot last year is now being used as an example of the astronomical expenses attached to cyber risk, at a time when few insurers are prepared to cover it.
According to new data released by the retailer, the breach has already cost Home Depot $232 million and is anticipated – by some accounts – to reach into the billions before the episode is over. Much of this is driven by lawsuits, filed by small community banks and credit unions that were hit hard in the wake of the breach.
These lawsuits accuse Home Depot of ignoring warnings from security experts that its computer systems were vulnerable to attack, prior to the theft of approximately 56 million sets of credit and debit card data.
Ostensibly, Home Depot’s cyber insurance policy would offset a large portion of these costs. Regulatory filing submitted by the retailer, however, reveal that only $100 million of the breach was covered by insurance.
And while this may be a lesson to insurance agents working with retailers to push for the purchase of more coverage, appropriately high limits are hard to come by.
“If you’re a retailer, it’s hard to buy more than $125 million in coverage in today’s market,” Roberta Anderson, co-founder of the Cyber Law and Cybersecurity practice group at K&L Gates law firm, told the
New York Times. “Obviously, the potential liability is so much more.”
Indeed, Robert Parisi – cyber product leader for
Marsh – said the largest policy currently available on the market offers coverage limits of up to $500 million, but in general large cyber insurance policies max out around the $100 million to $200 million mark.
Experts blame a lack of historical loss data and conservative risk appetites on the part of insurers for this gap in the market.
Brokers may have reason to be hopeful, however. Cyber insurance is one of the fastest growing products in both the standard and excess and surplus markets, and Marsh believes the amount of coverage available for cyber policies will increase over time—and likely quickly.
