Tokio Marine HCC
2023 Cyber Report

The 2023 Cyber Report by Tokio Marine HCC’s Cyber & Professional Lines Group provides a comprehensive overview of the current state of the cyber insurance market and emerging trends in cyber threats.

Market Growth and Profitability

The cyber insurance market has experienced rapid growth, with US direct written premiums increasing from $2.2 billion in 2019 to $7.2 billion in 2022. This growth was driven by increased demand and higher rates in response to the ransomware epidemic. The market saw significant price increases, with rate changes peaking at 130% in Q4 2021.

Profitability in the cyber insurance market improved substantially in 2022, with the total cyber loss ratio dropping 23 points to 44.6%. This improvement was attributed to changes implemented by insurers and a temporary reduction in ransomware activity.

Cyber Loss Drivers

Ransomware remains the primary contributor to cyber losses, although there was a notable decrease in both frequency and severity of attacks in 2022. The FBI reported a 36% drop in ransomware incidents from 2021 to 2022.

Business Email Compromise (BEC) fraud and data breaches are significant loss drivers. The average BEC fraud loss was $125,000 in 2022, while ransomware losses were three to four times that amount.

Recent Trends

The first half of 2023 saw a sharp increase in ransomware activity, nearly reaching 2021 levels. Privacy litigation has also increased, particularly related to website tracking technology and biometric information collection.

Attack Vectors and Prevention

Leading ransomware attack vectors include remote access exposure, exploitation of common vulnerabilities and exposures (CVEs), phishing, and using valid credentials. The report emphasizes the importance of proactive detection and alerting about critical vulnerabilities to reduce the incidence of ransomware attacks.

Widespread Cyber Events

2023 has seen a return of large-scale cyber events, including:

1. The exploitation of file transfer software (MOVEit, GoAnywhere MFT, PaperCut) by the ClOp ransomware group.
2. Wide-scale exploitation of VMWare ESXi instances.
3. A major attack on cloud service provider Rackspace.
4. A supply-chain compromise of 3CX’s DesktopApp by North Korea, targeting cryptocurrency companies.

Future Outlook

Tokio Marine predicts continuing significant ransomware activity and widespread cyber events in 2023 and beyond. It emphasizes the need for the cyber insurance market to remain vigilant and maintain robust pricing and security control requirements despite recent profitability improvements.

While 2022 saw a temporary reduction in cyber threats and improved profitability for insurers, the first half of 2023 indicates a return to high levels of cyber risk. The evolving nature of cyber threats underscores the importance of continued adaptation and vigilance in the cyber insurance market.