Hackers Are After More than Just Data: Will Your Company's Property Policies Respond When Cyber Attacks Cause Physical Damage and Shut Down Operations?

• Published in: Environmental claims journal 2016-10, Vol.28 (4), p.286-303
• Main Authors: Lathrop, Alex J., Stanisz, Janine M.
• Format: Article
• Language: English
• Subjects: Contaminants; Control systems; Cybersecurity; Destruction of property; Explosions; Industrial electronics; Industrial enterprises; Insurance; Internet; Iron and steel plants; Marketing; Metal industry; Petroleum; Petroleum pipelines; Plant shutdowns; Policies; Privacy; Property & casualty insurance; Property damage; Public policy; Risk; Steel industry
• ISSN: 1040-6026; 1547-657X
• DOI: 10.1080/10406026.2016.1197653

Recent attention on high profile data breaches has overshadowed a potentially greater risk: cyber attacks on large industrial companies causing physical damage, potentially releasing contaminants, and shutting down operations. A handful of publicly reported cyber-attacks, including explosions at an oil pipeline and a steel mill, have highlighted the potential vulnerability of these companies' internet-facing industrial control systems to hackers. The insurance industry has reacted to the growing risk of privacy-related data breaches by marketing and selling so-called "cyber policies." But these policies typically exclude coverage for property damage and are ill-suited to cover the magnitude of business interruption losses that could result from an extended shutdown of a large industrial operation. That leaves policyholders to look to their traditional property policies. This article examines the cyber-attack risk that large industrial companies face and how those companies' traditional property insurance policies may help mitigate that risk.