M&S, Co-op and Harrods attacks drive demand for cyber insurance
Experts have said that recent attacks on retail giants M&S, Co-op, and Harrods could drive increased demand for cyber insurance and force insurers to ask more questions when offering coverage.
On 22 April, the board of M&S revealed it was the victim of an attack, which led it to pause all online orders, a decision that is still in place. The Co-op and Harrods reported similar attacks following the FTSE 100 company, but they were smaller and only affected specific sites.
Holly Waszak, head of cyber claims UK at Marsh, pointed out that “the cyber insurance market has been taking a keen interest in attacks against the retail sector.”
She added that the insurers are “monitoring developments closely.”
So, how do these incidents affect the cyber insurance industry?
Cyber insurance market growth
Ollie Dent, partner at Kennedys, expects that these incidents, including those that happened to M&S, will drive more interest in the cyber insurance market.
“[The cyber insurance market] has exploded over the past five years, but it softened in recent months due to an increase in capacity and a slight dip in claims,” he noted.
According to a new Marsh report, while ransomware claims in 2024 declined by 31 per cent from 2023, claims remained more than double those recorded for 2020, 2021, and 2022.
Chris Burgess, director of cyber at Markel International, pointed out that due to the increase in cyber insurers in the market, “cyber insurance pricing has become more competitive over the past 12 months.”
The incidents at the retail giants will cost their insurance companies when they eventually claim, especially as M&S reportedly lost more than £1m a day during the attack.
However, Alistair Clarke, managing director at Aon, explained that these incidents would not cost enough to move the market.
Sarah Neild, head of cyber retail at Howden, added that while current losses won’t affect market rates, “there are signs in the US that the current soft market conditions are beginning to turn”.
“At least one major carrier suggests that they are looking for 10 per cent increases across a number of classes,” she added.
However, Clarke noted, prices increased from 2019 to 2021 when the market was hard. “The market has now settled into a prolonged period of rate reductions. Clearly, as with any market, this won’t last forever, so we are encouraging existing buyers, and indeed those that haven’t yet purchased policies, to make the most of these conditions while they can,” he added.
An essential tool
Aaron Le Marquer, partner at Stewarts, pointed out that, from a legal angle, these policies are still new, while cyber insurance is recognised as an essential tool.
“Cyber insurance policy wordings remain relatively ‘new’ and entirely untested in the English courts,” he explained.
He added, “Suppose a systemic cyber loss simultaneously affects whole sectors or geographies. In that case, it seems inevitable that litigation will be required to determine how and to what extent cyber BI policies will respond to cover any losses.”
While M&S has dominated the headlines, Neild pointed out, “it would be a mistake to think that the current issue is a retail problem; they just happen to be the target this week.”
Dent pointed out that groups linked to being behind those attacks, Scattered Spider, are known to target hospitality, retail and casinos.
“However, there are hundreds of threat groups out there, and we are seeing multiple companies across every sector being impacted by ransomware daily,” he pointed out.
The advancements in AI and technology are also being used to benefit hacking groups.
“We’re observing malicious actors using this to develop sophisticated social engineering attacks using deepfake technology to dupe innocent employees of firms into sending money to a malicious bank account,” explained Burgess.