Norsk Hydro cyber attack may cost $41m. AIG leads cyber insurance

Norsk Hydro has said today that its costs from the cyber attack by malware or ransomware are estimated at up to US $41 million just from the first week since the event occurred.

Norsk Hydro is one of the world’s largest aluminium manufacturing firms.

The Norway-headquartered company’s operations were disrupted after unusual activity was spotted on its servers by IT experts, finding that a cyber attack had disabled an important part of the company’s smelting operations, our sister publication Reinsurance News reported at the time.

The company then said that it did have cyber insurance in-force and later also confirmed that its cyber insurance provisions, whether specific or delivered through other corporate policies, would also likely cover elements of cyber risk related business interruption as well.

As we explained yesterday, PCS is now investigating the cyber attack event to establish whether it will cause an insurance and potentially reinsurance market loss large enough to warrant reporting on under its PCS Global Cyber loss reports and index service.

Given PCS has a loss threshold of US $20 million for cyber attack events, it now seems highly possible that Norsk Hydro will become the latest the firm evaluates and reports on under its services.

Norsk Hydro said that, “Based on a high-level evaluation, the preliminary estimated financial impact for the first full week following the cyber attack is around NOK 300-350 million, the majority stemming from lost margins and volumes in the Extruded Solutions business area.”

That’s a cost of around US $35 million to US $41 million.

The firm reiterated that it has a “solid cyber risk insurance policy” in place backed by recognised insurers.

Of these, Norsk Hydro highlighted that global insurer AIG is the lead on its cyber insurance tower.

It’s possible that the loss will escalate further, as the company said that its Extruded Solutions unit, where most of the costs lie, is still not fully up to speed.

The firm said that Extruded Solutions is, “Producing at an overall production rate of 70-80 % in the three business units Extrusion Europe, Extrusion North America and Precision Tubing. In the Building Systems unit operations remain almost at a standstill. Based on current progress the expectation is for Building Systems to gradually ramp up production and shipments during the week.”

That suggests the $41 million top-end estimate of the costs faced by Norsk Hydro is likely to be hit and perhaps exceeded, once full costs of the shutdown and loss of business is calculated.

Once again, a cyber loss event is likely to drive costs through to insurance and reinsurance interests largely due to business interruption, rather than direct property damage or data loss.

A loss of this level will not trouble insurers and some will likely call on reinsurance support to pay claims. But it won’t be a significant market loss.

However, it’s another reminder that these kinds of cyber attacks can deliver losses that are harder to model and perhaps unexpected in some cases, reflecting the complexity of the cyber risk class of underwriting business and the importance of having specific expertise if you are writing it.

————

Register today to attend our next ILS conference in Singapore, ILS Asia 2019.

We’re returning to Singapore for our fourth annual ILS market conference for the Asia region. Please register today to secure the best prices. Super early bird tickets are now almost sold out.