'Inevitable' that insurance companies will lose personal data to cyber attacks, claims report

Climate change? Terrorism? Meh. Insurance companies are increasingly concerned about cyber security - both for themselves and their clients

Insurers across the UK and North America fear a cyber attack that could compromise the increasing volumes of personal data that they are keeping and processing in the cloud.

Indeed, security has become one of insurers' biggest concerns, according to a report by consultants PwC. "The chief concern is the security of the ever growing volumes of data that insurers hold in cloud-based storage systems. For many, major breaches are inevitable; the question is how much damage they will cause," warned the report.

"Insurers are prime targets to be victimised given the richness of data - credit card information, medical information, and other underwriting information. It's not a matter of if but when it will happen," claimed the director of risk management at one non-life insurance company based in Canada, cited in the report.

"Activity and technology increases all the time and security is always one step behind. Insurance companies are a likely target," said Timo Ahvonen, chief development officer of Fennia in Finland.

The report also warned that insurers may be wide open to claims from clients, too, and that they may be under-playing the risks of claims on insurance policies covering cyber-security risks.

"Cyber insurance is such an unknown and many insurers may be opening themselves up to potentially horrific losses", one New Zealand-based consultant told PwC. "An actuary in Bermuda pointed out that existing insurance policies which do not specifically exclude (or do not mention) cyber attacks may be vulnerable to hefty claims if a major incident occurs," it continued.

The survey, conducted by the Centre of the Study of Financial Innovation, was intended as a study of the risks facing the insurance industry, including from the economy, low-interest rates, population growth, environmental catastrophes and regulation.

However, cyber security emerged as the number-one concern of the insurance companies around the world. "This survey identifies the risks, or 'Banana Skins', facing the global insurance industry in the first half of 2015, as seen by a sample of 806 practitioners and close observers from 54 countries," according to the report.

It continues: "Structural and technological change in the industry ranks high on the risk list as pressures for consolidation grow, and digital techniques become more widespread. Concern about the industry's ability to manage change has risen sharply.

"The top concern on this front is cyber risk, which we rank for the first time this year. As an industry that handles large amounts of other people's money and personal data, insurance is vulnerable to attack. Cyber is also an underwriting risk which has yet to be fully scoped."

On top of that, executives report feeling the heat from the risk of more nimble start-ups, even in an industry as staid and rule-bound as insurance. "The impact of change in the areas of distribution and client interface has also risen as a concern. Much of the industry is struggling to keep pace with new technologies, and incumbents feel threatened by new entrants unburdened by legacy systems. Technology is a common theme in virtually all the major changes facing the industry."

In contrast, climate change and terrorism is way down the list of insurance industry concerns.