PCS designates Equifax hack as first Global Cyber Index event

Having only launched PCS Global Cyber, a loss aggregation service offering industry loss estimates for individual affirmative international cyber events, just over a week ago, Property Claim Services (PCS) has already designated the first event, the recent Equifax hacking breach.

The PCS Global Cyber service can provide an index trigger for cyber risk transfer contracts, such as industry loss warranties (ILW’s) or catastrophe bonds, and can be used by insurance and reinsurance firms to validate loss data and to help in analysing cyber risks.

Equifax, the global credit reporting giant, revealed recently that in a hack attack the personal details of as many as 143 million of its U.S. customers may have been stolen (names, addresses, social security numbers), along with details of some UK and Canadian customers and as many as 200,000 people’s credit card details.

It’s one of the biggest data breaches reported in history and the scale of the hacking event led to Equifax’s shares tumbling by almost 15% as the market took in the ramifications of the breach.

For the insurance and reinsurance industry’s nascent business line of cyber risk underwriting the breach could turn into a major loss event, with the cost of notifying and supporting customers through the event, public relations recovery, among other things, likely to escalate rapidly.

The breach has wiped over $3.5 billion off Equifax’s market value at one stage and it’s expected that the costs to Equifax will be in the hundreds of millions of dollars at least.

Designating the cyber event as one to analyse and aggregate industry loss data on so soon after the launch of the PCS Global Cyber service demonstrates its utility and also a sign of the burgeoning exposures facing businesses operating in the digital age.

It’s also a sign that insurers, reinsurers and others underwriting cyber risk could now look to hedge some of their exposures with an industry index based risk transfer product.

Tom Johansmeyer, Assistant Vice President (AVP), PCS, explained to Artemis; “The fact that we’ve designated a cyber event so soon after launch speaks to the relevance of PCS Global Cyber. When events occur, the nature of the need becomes clearer to the market. With each event, we can contribute more to the growing body of cyber loss event knowledge in the global Re/insurance industry.”

Director of PCS Operations, Ted Gregory, added; “PCS loss aggregation solutions are designed to be relevant. And nothing demonstrates relevance like an event. We will execute our methodology with discipline to develop an industry loss estimate for this event.”

The average per-head cost of a cyber data breach is estimated at around $225, so with 143 million persons details potentially exposed to the criminal hackers the cost of recovery could be extremely high for Equifax. This could make it the most expensive cyber breach loss event in history, large than the Target cyber breach.

Equifax has a cyber insurance policy that could cover as much as $150 million of its costs, with London market insurer Beazley said exposed. The firm may also be able to claim on property or business interruption coverages, suggesting a growing potential exposure to the insurance and reinsurance industry.

PCS will now begin the process of collecting and aggregating cyber insurance loss data for the Equifax hacking breach and will report on it in due course, in line with its industry loss reporting schedule.