7 ms·

Is it possible for organizations to buy ransomware insurance? It is very difficult to avoid paying the ransom when people's lives are in jeopardy. I can imagine

Is it possible for organizations to buy ransomware insurance? It is very difficult to avoid paying the ransom when people's lives are in jeopardy. I can imagine hospitals would be interested in purchasing such insurance as well.

szermer 6y ago
Yes... and it is a growing part of commercial property insurance: https://www.fmglobal.com/products-and-services/products/cyber-resilience-solutions https://www.fmglobal.com/products-and-services/products/cybe...
headmelted 6y ago
How would that work though? The group demanding the ransom can freely set their price. Surely if they know an insurance company is on the hook for it then they’ll add a few zeroes accordingly, making it impossible to underwrite.
- Invictus0 6y ago
  Here's how I imagine it: The policy would insure up to a certain dollar amount, say $20 million, and pay directly to the insured in the event of an attack. If the ransom demand is $50 million, the insured can either pay the remaining $30 million on their own or use the $20 million to begin to repair the damage to their systems.
- jpmoral 6y ago
  There was an article or discussion I believe I read on HN that discussed how kidnapping and ransom insurance reduced violent outcomes and made dealing with the kidnappers more predictable.
  - bluGill 6y ago
    True, but what has made kidnapping mostly disappear is laws that make it illegal to pay a ransom. That makes it impossible to ask for help (as the police are more likely to find out) raising the ransom, and thus the total paid much less. Nothing is perfect, but when there is no money in the crime there is much less crime. (Don't confuse less with zero!)
    - criddell 6y ago
      Where is it illegal to pay a ransom?
    - jpmoral 6y ago
      Sure, but GP was asking about how insurance might work. Also, I'd thinnk making lowering ransoms (by making it illegal or other means) works only if it's paired with a low probability of the kidnappers being able to enjoy the proceeds.
- deftnerd 6y ago
  From what I understand, ransomware insurance is already a thing. With the policy you get someone who negotiates the price and pays the ransom directly to the ransomware gang, which bypasses some laws against paying ransomware directly. In theory, this helps with lower prices, negotiated support policies with the ransomware criminals to ensure the decryption process goes well, and they keep cryptocurrency available so the policy holding company doesn't have to scramble to get millions of dollars in crypto in a day or two. Similar to kidnapping negotiators, ransomware negotiators often have the experience to produce a better outcome
- usrusr 6y ago
  It would work by the "insurance" paying off established ransom groups in advance. Protection rackets aren't exactly a new invention. Wether it can work or not is entirely hinging on the uncertainty of just how fragmented the ransomware industry really is. Is it actually just one loose federation or are multiple ecosystems existing in parallel? Do they perhaps informally agree on virtual turfs?
- gizmo686 6y ago
  Most ransomware groups just want the money; they don't particularly want to inflict damage on their target. If their demand falls within policy limits, then they will very likely get payed. If their demand exceeds policy limits, then the target needs to make a much more active decision about weather or not to pay. Combined with the fact that exceeding the insurance limit likely puts you into a realm where you are asking for a some large enough to be a significant challenge (otherwise they wouldn't have bothered with insurance), and you are now reducing the likelyhood of getting a payout. I would expect the net result of this would be that groups raise their demands to match what (they think) the policy limit is.
- thefifthsetpin 6y ago
  Kidnap, ransom & extortion insurance have been around for a while. I imagine that whatever solution those industries employ would work here. I'm also curious what that looks like, though.
blinding-streak 6y ago
It's amazing to me how brazen the ransomware scene has become. The fact that they are now going after law enforcement agencies shows extreme confidence in their ability to evade prosecution. And I know the DC police force doesn't have global jurisdiction to root out cyber attackers, but the 3 letter agencies that do have this jurisdiction may view ransomware in a different light after this attack.
- _the_inflator 6y ago
  These type of ransom seems to be state backed or at least tolerated.
  - bluGill 6y ago
    That has long been suspected. I can't prove it, though I wouldn't be surprised if the big Agencies had proof and no ability to do anything about it.
    - ThrowItAway2Day 6y ago
      North Korea conducts low-level cybercrime to fill the state's coffers and geopolitics. They are like vikings; raiding an enemy and stealing all they can while they're there to keep the lights on. Hackers from Russia or China are higher up on the hierarchy of needs and attack targets for geopolitical advantage.
      - vkou 6y ago
        Just because someone is hacking from Russia doesn't mean they are working for the FSB, or are doing it for non-commercial reasons. People who live in other countries aren't just mindless drones that march in lock-step with their ministry of foreign affairs.
        filoleg 6y ago
        >Just because someone is hacking from Russia doesn't mean they are working for the FSB, or are doing it for non-commercial reasons. That's why the reply a few comments up the chain said "These type of ransom seems to be state backed or at least tolerated." "At least tolerated" part means that the hackers are doing it for their own purposes or for money, but not under command or employment from foreign federal agencies. Foreign federal agencies simply tolerate those hackers by looking the other way, since no skin off their backs for some ransom payments taken from some US entities.
PeterisP 6y ago
One aspect is that a bunch of ransomware actors are on US sanctions list, so paying money to them - for whatever reason - is a felony i.e. "funding terrorism" even if you don't know at the time who is behind them.
chewmieser 6y ago
It exists already, yes. My company was attacked relatively recently and our local servers were all encrypted. All we had to do was contact our insurance provider and they handled the investigation and negotiations with the group. A day or two later and our files were back.
everdrive 6y ago
The ransomware industry is actually in the midst of a big shift. As ransomware becomes more prevalent, ransomware insurance providers are charging more and paying out less. A lot of companies either can no longer afford the insurance, or else it has become expensive enough that it doesn't make any sense to purchase.
alexpedi 6y ago
Yes, most Cyber Insurance covers Ransomware. It's been a huge driver of claims and claims cost in the last couple of years for insurance companies.

szermer 6y ago

Yes... and it is a growing part of commercial property insurance: https://www.fmglobal.com/products-and-services/products/cyber-resilience-solutions https://www.fmglobal.com/products-and-services/products/cybe...

headmelted 6y ago

How would that work though? The group demanding the ransom can freely set their price. Surely if they know an insurance company is on the hook for it then they’ll add a few zeroes accordingly, making it impossible to underwrite.

Invictus0 6y ago
Here's how I imagine it: The policy would insure up to a certain dollar amount, say $20 million, and pay directly to the insured in the event of an attack. If the ransom demand is $50 million, the insured can either pay the remaining $30 million on their own or use the $20 million to begin to repair the damage to their systems.
jpmoral 6y ago
There was an article or discussion I believe I read on HN that discussed how kidnapping and ransom insurance reduced violent outcomes and made dealing with the kidnappers more predictable.
- bluGill 6y ago
  True, but what has made kidnapping mostly disappear is laws that make it illegal to pay a ransom. That makes it impossible to ask for help (as the police are more likely to find out) raising the ransom, and thus the total paid much less. Nothing is perfect, but when there is no money in the crime there is much less crime. (Don't confuse less with zero!)
  - criddell 6y ago
    Where is it illegal to pay a ransom?
  - jpmoral 6y ago
    Sure, but GP was asking about how insurance might work. Also, I'd thinnk making lowering ransoms (by making it illegal or other means) works only if it's paired with a low probability of the kidnappers being able to enjoy the proceeds.
deftnerd 6y ago
From what I understand, ransomware insurance is already a thing. With the policy you get someone who negotiates the price and pays the ransom directly to the ransomware gang, which bypasses some laws against paying ransomware directly. In theory, this helps with lower prices, negotiated support policies with the ransomware criminals to ensure the decryption process goes well, and they keep cryptocurrency available so the policy holding company doesn't have to scramble to get millions of dollars in crypto in a day or two. Similar to kidnapping negotiators, ransomware negotiators often have the experience to produce a better outcome
usrusr 6y ago
It would work by the "insurance" paying off established ransom groups in advance. Protection rackets aren't exactly a new invention. Wether it can work or not is entirely hinging on the uncertainty of just how fragmented the ransomware industry really is. Is it actually just one loose federation or are multiple ecosystems existing in parallel? Do they perhaps informally agree on virtual turfs?
gizmo686 6y ago
Most ransomware groups just want the money; they don't particularly want to inflict damage on their target. If their demand falls within policy limits, then they will very likely get payed. If their demand exceeds policy limits, then the target needs to make a much more active decision about weather or not to pay. Combined with the fact that exceeding the insurance limit likely puts you into a realm where you are asking for a some large enough to be a significant challenge (otherwise they wouldn't have bothered with insurance), and you are now reducing the likelyhood of getting a payout. I would expect the net result of this would be that groups raise their demands to match what (they think) the policy limit is.
thefifthsetpin 6y ago
Kidnap, ransom & extortion insurance have been around for a while. I imagine that whatever solution those industries employ would work here. I'm also curious what that looks like, though.

blinding-streak 6y ago

It's amazing to me how brazen the ransomware scene has become. The fact that they are now going after law enforcement agencies shows extreme confidence in their ability to evade prosecution. And I know the DC police force doesn't have global jurisdiction to root out cyber attackers, but the 3 letter agencies that do have this jurisdiction may view ransomware in a different light after this attack.

_the_inflator 6y ago
These type of ransom seems to be state backed or at least tolerated.
- bluGill 6y ago
  That has long been suspected. I can't prove it, though I wouldn't be surprised if the big Agencies had proof and no ability to do anything about it.
  - ThrowItAway2Day 6y ago
    North Korea conducts low-level cybercrime to fill the state's coffers and geopolitics. They are like vikings; raiding an enemy and stealing all they can while they're there to keep the lights on. Hackers from Russia or China are higher up on the hierarchy of needs and attack targets for geopolitical advantage.
    - vkou 6y ago
      Just because someone is hacking from Russia doesn't mean they are working for the FSB, or are doing it for non-commercial reasons. People who live in other countries aren't just mindless drones that march in lock-step with their ministry of foreign affairs.
      - filoleg 6y ago
        >Just because someone is hacking from Russia doesn't mean they are working for the FSB, or are doing it for non-commercial reasons. That's why the reply a few comments up the chain said "These type of ransom seems to be state backed or at least tolerated." "At least tolerated" part means that the hackers are doing it for their own purposes or for money, but not under command or employment from foreign federal agencies. Foreign federal agencies simply tolerate those hackers by looking the other way, since no skin off their backs for some ransom payments taken from some US entities.

PeterisP 6y ago

One aspect is that a bunch of ransomware actors are on US sanctions list, so paying money to them - for whatever reason - is a felony i.e. "funding terrorism" even if you don't know at the time who is behind them.

chewmieser 6y ago

It exists already, yes. My company was attacked relatively recently and our local servers were all encrypted. All we had to do was contact our insurance provider and they handled the investigation and negotiations with the group. A day or two later and our files were back.

everdrive 6y ago

The ransomware industry is actually in the midst of a big shift. As ransomware becomes more prevalent, ransomware insurance providers are charging more and paying out less. A lot of companies either can no longer afford the insurance, or else it has become expensive enough that it doesn't make any sense to purchase.

alexpedi 6y ago

Yes, most Cyber Insurance covers Ransomware. It's been a huge driver of claims and claims cost in the last couple of years for insurance companies.