Unlock the Editor’s Digest for free
Roula Khalaf, Editor of the FT, selects her favourite stories in this weekly newsletter.
Lloyd’s of London has warned that a major cyber attack on a global payments system could cost the world economy $3.5tn, as insurers and companies worry about the systemic threat from hackers and whether the risks are insurable.
The Lloyd’s market, which is a hub for cyber insurance alongside traditional sectors such as shipping, said a “hypothetical but plausible cyber attack” would create “widespread disruption” to global business.
Under the scenario, attacks put malicious code in transactions software that then spreads through tens of thousands of partner networks, allowing hackers to breach defences and siphon funds, and bringing customer payments and bank clearing to a halt.
The five-year economic impact would be felt mostly strongly in the US, with $1.1tn of the loss, followed by China with $470bn and Japan with $200bn according to the scenario, modelled by Lloyd’s in partnership with the Cambridge Centre for Risk Studies.
Lloyd’s chair Bruce Carnegie-Brown said the “global interconnectedness of cyber means it is too substantial a risk for one sector to face alone”. He called for the sharing of “knowledge, expertise and innovative ideas across government, industry and the insurance market to ensure we build society’s resilience against the potential scale of this risk”.
Concern has risen among insurers and policymakers about the threat to economic and national infrastructure from cyber attacks. In December, insurance group Zurich’s chief executive warned that cyber attacks were on their way to becoming “uninsurable”.
Lloyd’s itself caused controversy when it insisted on an exclusion in standard cyber insurance policies for big state-backed attacks. Banks and other providers of essential services feared this meant that they would not be covered in the event of such an attack, with the identity of hackers and the question of state sponsorship difficult to establish.
Some executives have pushed for a state backstop in the event of a wide-ranging attack or one that affects core infrastructure. Insurers have held discussions with the UK government about whether Pool Re, the UK’s terrorism reinsurance scheme, could be extended to cover major state-backed cyber attacks.
The $3.5tn figure is a weighted average of three scenarios of varying severity. The most extreme of these envisages $16tn of losses over the period, Lloyd’s said.
Cyber insurance is one of the fastest-growing markets as companies look for coverage following a surge in ransomware attacks
Cyber premiums amounted to just over $9bn in premiums last year, according to Lloyd’s, and are predicted to reach as much as $25bn by 2025.
Lloyd’s said that this “still represents a small portion of the potential economic losses that businesses and society face”.