60% of SA businesses underinsured against growing hacking attacks

In the wake of recent cyber attacks against large organisations such as Sony, Citibank, Lockheed Martin, the UK’s National Health Service (NHS) and the International Monetary Fund (IMF), it is estimated that 60% of South African businesses are not insured for cyber attacks and are also not aware that this type of insurance exists.

This is according to Jonathan Healy, Account Manager for Professional Risks at Aon Risk Solutions, who says that cyber crime costs global economies an estimated $100 billion a year. “These attacks, coupled with the liability claims that they might encounter, can leave local businesses in ruins if they are not properly insured against cyber crime.”

Healy says that phishing volumes have increased in South Africa, making the country one of the leading targets of cyber criminals in 2011. Recent statistics have revealed that South Africa is the third most attacked country globally, with 7.5% of attack volumes.

He explains that there are in fact insurance products available to protect businesses exposed to a virus or hacking attack. “If a company database containing personal information is compromised by a virus or hacking attack, the extent of the damage can be far reaching. If a client can verify that they have suffered a loss due to the data breach, they may hold the company responsible for the loss.” He also says that while liability policies generally only respond to third party claims, certain cyber liability policies will also provide first party cover.

“It is mandatory for companies situated in the United States to notify an entire database of a security breach, which can be very costly. This will very soon become mandatory for South African businesses who encounter a cyber attack.”

Healy advises that companies need to consider the security implications that their businesses are exposed to. “Those that are most at risk are those who provide technology services, and those who are heavily reliant on technological systems to provide a service.

“Companies who outsource protection and who are reliant on technology should ensure that they use reputable IT security providers who are indemnified. Businesses should ask themselves what kind of service they offer and what the business entails. For example, if they provide IT services to companies that rely on technology, and inadvertently their systems infect the client’s systems, the costs to both companies could have devastating effects. The biggest concern here, however, is the client who depends on a network to run their business.”

Healy advises that over and above investigating insurance options, local businesses should ensure that firewalls, IT security and virus protection measures are properly in place and regular tests are run to gauge effectiveness.