Recent hacking involving Sony Pictures Entertainment shows need for business interruption cover in cyber insurance: CFC Underwriting

Last week’s hacking incident involving Sony Pictures Entertainment highlights the importance of having cyber insurance that includes business interruption cover and demonstrates the negative effect of not being able to access tech systems even for a short period, suggests CFC Underwriting.

The caution follows a hacking incident reported to have forced Sony Pictures Entertainment to shut down its systems, notes a statement last Friday from CFC Underwriting, a London-based Lloyd’s MGA with clients in more than 50 countries that specializes in developing and distributing insurance products for specific niche markets.

Media reports indicate hackers threatened they would release Sony secrets over the Internet if their undisclosed demands were not met. The incident is said to have prompted the company to tell its workers to shut down their computers and personal devices from the Sony network, as well as virtual private networks.

It was reported the computer system was down for at least parts of two days and that addressing the issue could take from one day to three weeks.

Media reports further note that over the weekend, a number of Sony movies (only one of which is already playing in theatres) were released to file-sharing websites, already registering millions of downloads.

The big issue now “is how long it will take Sony to resolve the issue and get its systems and its people back up and working again,” CFC director Graeme Newman comments in the statement.

Read More: Cyber 2.0

“For pretty much any company today, regardless of size or industry, being without its tech systems for even a few hours would be damaging. Being without them for up to three weeks could be devastating,” Newman says, adding the insurance industry has a responsibility “to respond and ensure that the (cyber) cover provided is fit for purpose and represents a true reflection of the emerging risks (companies) face.”

The hacking incident is not a first for Sony. In 2011, its video game online network was hacked and the Sony Pictures website was breached. In both cases, user data was stolen. And this past August, Sony’s Playstation network was forced offline.

CFC Underwriting notes standard commercial insurance policies do not cover business interruption as a result of a technology or cyber-related issues. Many specialist cyber insurance policies focus on privacy breaches and data loss.

“In reality, businesses are more likely to suffer from a technology issue that takes their system out of action, costing thousands if not millions,” Newman says. “Ensuring that system business interruption is included in a cyber insurance policy is essential as a business’s exposure to non-physical perils is now as big, if not bigger, than the more traditional physical risks,” he emphasizes.