Internet Explorer 11 is not supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Fearing Hackers, States Start Buying Cyber-Insurance

As the threat from hackers and cybercriminals intensifies, a growing number of states are buying cyber insurance to protect themselves — and taxpayers.

By Jenni Bergal

As the threat from hackers and cybercriminals intensifies, a growing number of states are buying cyber insurance to protect themselves — and taxpayers.

“It’s expensive. It’s a big budget item for us. But it’s absolutely worth it,” said Michael Hussey, Utah’s chief information officer. “You’re seeing breaches now that cost companies and states millions and millions of dollars.”

More than a dozen states now have cyber insurance policies, which cover losses and expenses if a computer network is hacked. Insurers typically pick up the cost of investigating and restoring data, notifying those whose information may have been compromised, and providing legal and public relations services and credit monitoring.

Hussey said Utah first bought a policy in 2015, three years after a data breach of a Department of Health server exposed 780,000 residents’ personal information to hackers. The state wound up spending millions of dollars to deal with the aftermath, including paying for credit monitoring and legal fees and conducting a security assessment of all state servers.

Utah now pays $230,000 a year for $10 million in cyber coverage and has a $1 million deductible. The policy covers every agency in the executive branch.

So far, the state hasn’t had any big data breaches that would require filing a claim, but that doesn’t mean it won’t happen in the future, Hussey said.

“We check what we’re supposed to be checking,” he said. “But with cyber, if one little thing is overlooked or you have bad luck and leave something undone, you’d hate to be left holding the bag to cover that.”

 

A Growing Market

In the wake of massive data breaches like those involving Yahoo last year and Anthem the year before, many businesses have scrambled to buy cyber insurance. Last year, insurers wrote $1.35 billion in premiums, a 35 percent jump from 2015, according to Fitch Ratings.

States have been following in their footsteps. In a survey of state CIOs this year, 38 percent reported having some type of cyber insurance, compared to 20 percent in 2015.

Even some small cities, such as Cody, Wyoming, have purchased cyber coverage this year.

Hackers and cybercriminals in recent years have taken aim at state and local government networks, which contain information such as Social Security, bank account and credit card numbers on millions of people and businesses. And online activists have hijacked government computer systems, defaced websites, and hacked into data or email and released it online.

In 2016, state information technology officers ranked cybersecurity as their top priority for the third year in a row.

James Lynch, chief actuary for the Insurance Information Institute, an industry trade group, said selling cyber insurance to states is especially challenging.

“What states do is so diffuse and sprawling, and they deal with so many types of people and circumstances that it’s difficult for an insurance company to fully get a grasp on what those risks are and underwrite them all,” he said.

It can be equally challenging for those purchasing cyber insurance, he added.

“When you buy an auto policy, you have a pretty good idea what’s in it. The terminology is highly standardized. It’s been vetted through the courts,” Lynch said. “You don’t have that in cyber because the product is so new. The actual things being covered also vary greatly from policy to policy.”

And government agencies sometimes don’t understand the risks or what kind of coverage they’ll need, cyber experts say.

“Some states and local governments don’t even know where their data is or what they’ve got,” said Dan Lohrmann, chief security officer for Security Mentor, a national security training firm that works with states. “So when you start having to give the insurer a list of how many servers you have and what systems are included, it gets pretty complicated.”

Lohrmann said many state IT security officials initially were wary of cyber insurance, figuring they’d rather spend their limited resources on prevention. But many now take a different view, he said, because they realize that having the insurance will ensure that they are keeping their security programs up to snuff. Insurers won’t sell states policies unless they meet certain standards, including regularly training staff, encrypting sensitive data and updating servers.

In Georgia, Chief Technology Officer Steve Nichols said he was skeptical about cyber insurance at first, but when he saw how many giant companies had breaches and the financial impact, he changed his mind.

In July, Georgia bought comprehensive cyber insurance, which covers about a hundred state agencies, he said.

Nichols said he thinks Georgia has the largest amount of cyber coverage of any state — $100 million. It pays a $1.8 million-a-year premium and has a $250,000 deductible per incident.

The state relied on a broker to guide it through the “very confusing and complicated” process and put together a deal with a consortium of insurers, he said.

 

Using Cyber Insurance

Montana was the first state to get cyber insurance, in 2011, said Lynne Pizzini, chief IT security officer. And it’s glad it did.

Three years later, hackers gained access to a server that contained Department of Public Health and Human Services data, including clients’ names and Social Security numbers and some health information. The state mailed letters about the incident to more than a million people who could have been affected.

Pizzini said the insurance company helped with the mailings, set up a call center, and provided forensic investigation, legal and communications assistance, and credit monitoring.

“We used all of the services in our insurance policy,” she said. “It would have cost us a ton more than the premium we pay.”

The state has a $2 million policy, which covers all agencies, including the university system, she said. It pays an $88,200 annual premium and has a $100,000 deductible per incident and a 10 percent copayment for credit monitoring.

But Pizzini and IT officials in other states caution that having cyber insurance shouldn’t make states complacent and view it as a substitute for a comprehensive security program. While the coverage can be a big help after the fact, they say, states need to invest in security, keep their technology updated, and be prepared for hackers and cybercriminals.

“It’s like brushing your teeth,” Georgia’s Nichols said. “You need to do it every day.”

Caroline Cournoyer is GOVERNING's senior web editor.
Special Projects
Sponsored Stories
Sponsored
In recent years, local governments have been forced to adapt to a wildly changing world, especially as it pertains to sending bills and collecting payments.
Sponsored
Workplace safety is in the spotlight as government leaders adapt to a prolonged pandemic.
Sponsored
While government employees, students and the general public had to wait in line for hours in the beginning of the pandemic, at-home test kits make it easy to diagnose for the novel coronavirus in less than 30 minutes.
Sponsored
Governments around the nation are working to design the best vaccine policies that keep both their employees and their residents safe. Although the latest data shows a variety of polarizing perspectives, there are clear emerging best practices that leading governments are following to put trust first: creating policies that are flexible and provide a range of options, and being in tune with the needs and sentiments of their employees so that they are able to be dynamic and accommodate the rapidly changing situation.
Sponsored
Service delivery and the individual experience within health and human services (HHS) is often very siloed and fragmented.
Sponsored
In this episode, Marianne Steger explains why health care for Pre-Medicare retirees and active employees just got easier.
Sponsored
Government organizations around the world are experiencing the consequences of plagiarism firsthand. A simple mistake can lead to loss of reputation, loss of trust and even lawsuits. It’s important to avoid plagiarism at all costs, and government organizations are held to a particularly high standard. Fortunately, technological solutions such as iThenticate allow government organizations to avoid instances of text plagiarism in an efficient manner.
Sponsored
Creating meaningful citizen experiences in a post-COVID world requires embracing digital initiatives like secure and ethical data sharing, artificial intelligence and more.
Sponsored
GHD identified four themes critical for municipalities to address to reach net-zero by 2050. Will you be ready?