Cyberattacks: The Ever-Rising Threats
[Stay on top of transportation news: Get TTNews in your inbox.]
Cyberattacks represent an ever-increasing risk that motor carriers and fleets are up against — and which may not be insured under the typical coverages they carry, insurance industry experts said.
“Cyber is a potentially bankrupting exposure. It is important for all fleets and motor carriers to realize that they need to start treating this exposure the same as auto and workers’ compensation coverage,” said Dan Cook, principal and practice leader at insurance broker TrueNorth Cos.
Special Report:
Trucking and Insurance
Most fleets carry standard coverages to include auto liability, general liability, cargo, crime and workers’ compensation, Cook said.
“Some may also secure crime coverage, to include computer fraud and funds transfer coverage,” he said, adding that the coverages generally are not intended to provide defense costs and/or indemnity payments if a cyberbreach or malware attack occurs.
A cyberattack befell FedEx Corp.’s TNT Express unit in June 2017. TNT, a European parcel carrier, fell victim to the “Petya” attack, which FedEx said involved the spread of an information technology virus through a tax software product in Ukraine, one place where TNT operated.
And the company, by FedEx’s admission, was unprotected. “We do not have cyber or other insurance in place that covers this attack,” FedEx said in a July 2017 statement.
In a malware or ransomware attack, the hacker’s goal is to shut down a motor carrier’s operating system to extort a payment either to turn the system back on or to prevent the hacker from releasing personally identifiable information on employees, drivers or clients, Cook said.
Cyberattacks are not covered under traditional business interruption insurance in property policies, said Michael Born, vice president and account executive in the cybertechnology practice at insurance broker Lockton Cos. Business interruption insurance covers specific perils such as wind, fire, tornadoes and floods — perils that would physically affect a company’s operations, Born said.
WANT MORE NEWS? Listen to today's Daily Briefing
For trucking companies, many of which increasingly rely on their computer systems to manage the transportation of goods, sensitive data could include information on where a driver must go to pick up the next load.
That is a risk not only to the carrier’s business but to the shipper’s business as well, Born said. “Every company that has a computer system has cyberexposure.”
James Burg, president of James Burg Trucking Co., said he’s concerned that many fleets are outsourcing their driver qualification files to be more efficient. Burg, chairman of the insurance task force at American Trucking Associations, said he hopes fleets are using “the highest-quality security measures available” to protect this information.
Born also said that cyberinsurance coverage has been expanding to address the exposures to transportation and shipping companies’ business operations. Specifically, cyberpolicies can address business interruption losses — which are income and extra expenses associated with the interruption to operations — that result from cyberattacks and for any unplanned and unexpected system outage. “This coverage can also be expanded to cover disruption to business operations caused by the system outage of a third-party service provider,” he said.
Cyberpolicies must be customized to a motor carrier’s risks.
“Fleets should understand the distinction between first- and third-party claims and assess their exposure based upon the number of records they have, their own internal IT platform and backup or disaster recovery plan, and then work to customize their coverage accordingly,” Cook said.
Meanwhile, since 2017, “The frequency of attacks have increased, with social engineering being the main driver,” Cook said. Social engineering insurance is coverage for loss of money or securities due to a person impersonating another and fraudulently providing instructions to transfer funds, he said.
