‘Uninsured cyber-attack time bomb’ may loom over energy industry

Insurance coverage for non-catastrophic cyber attacks in the energy industry can be obtained, but access to takers of truly catastrophic risk in this sector is harder to come by, according to a report by Willis.

“The energy industry may be sitting on an uninsured cyber-attack time bomb,” said Willis’ Energy Markey Review 2014.

Competitive pressures among insurers of the global energy markets has increased due an abundance of insurance capacity and an influx of new capacity from alternative sources such as pension and hedge funds. Meanwhile, the reports indicate the overall pool of energy premiums available to insurers is shrinking in upstream and downstream energy markets.

This leads Willis to conclude it “may take more than a run of catastrophic losses to provoke any significant capacity withdrawal from the energy sector.”

A major catastrophic cyber-attack event could be looming over the energy sector, but the losses from this type of event aren’t likely to turn insurance market conditions.

“Alarmingly, this risk is currently excluded from most energy insurance policy forms,” wrote AJC Rivers, Willis’ global head of natural resources.

“Although we can now detect the beginnings of a market for this critical risk, much more needs to be done to bring cyber, political violence and energy underwriting expertise together to forge a product that will truly meet the needs of the industry,” he added.

According to various sources cited by Willis, cyber attacks against oil and gas infrastructure will cost oil and gas companies $1.87 billion by 2018. The UK estimates oil and gas companies there lose about GBP400 million every year from cyber attacks.

In the US, 40 percent of cyber attacks on critical infrastructure on 2012 occurred against the energy sector.

Coverage for first-party network loss, privacy and security liability, media liability, privacy regulation defense, crisis management and reputational expenses, and cyber extortion are available but all are designed for non-catastrophic cyber attacks.

What is not traditionally covered – or is even envisaged by the providers of this cover – is the truly catastrophic event involving significant physical loss or damage…which could well have financial consequences way in excess of the limits offered by this market,” Willis said.