Why You Need Cyber Insurance
Almost every day I read a story about an organization that has been the victim of a cyber-attack. One of the UKs largest conveyancing solicitors suffered such a devastating attack last year that it virtually closed down their business for many weeks. One of the London boroughs was unable to provide property search information to homebuyer for months because of a ransomware attack which allegedly was only resolved when they paid the ransom. Several NHS trusts lost access to all their essential patient records as a result of another ransomware attack and were only saved from disaster when an independent counter hacking expert found a solution for them as an act of charity.
Until now I have always thought of cyber-attacks as something that affected other people but last month one affected me. We had agreed the sale of a letting business with over 700 properties under management that had been trading for over 30 years without any serious problems. However just two weeks before completion was due to take place they suffered a serious cyber – attack. A hacker got into their system and asked all 700 hundred of their tenants to pay their rent into a different bank account. Fortunately one of their tenants called them immediately to check that this was correct and within an hour of the e-mail being sent they were able to e-mail of their tenants to warn them that it was a scam. The attack was thwarted and not one penny was paid into the hackers account. They thought the issue had been deal with but in fact their problems had only just begun.
They had to disclose what had happened to their buyer and their solicitors went ballistic. What would happen if someone paid their rent into the wrong account next month they asked . What would happen if their tenants bank details had been stolen and they suffered other losses as a result. What would happen if there was a GDPR complaint that triggered a huge fine. They totalled up the potential liabilities and they came to over £1 million. Fortunately they had cyber insurance but the attack still caused the sale to be delayed for over a month and the shareholders still had to give additional warranties and indemnities in case the total claim exceeded their insurance cover.
As a result of this incident I thought that I should check our own cyber security precautions so I asked our insurance broker for a quote for a new policy with a higher level of cover and an increased sum insured. The first thing they did was to run a test of our systems. I didn’t expect them to find any problems but it turned out that I was quite wrong about this.
The audit revealed some critical weaknesses in our systems which could have left us open to an attack. For example we had a facility to book and pay for a place on our how to prepare a business for sale course. We have not run this course since the Covid lockdown and we had made the page invisible on our website 3 years ago. Nevertheless it still existed and was a security risk. Several other weaknesses were identified and over the next two weeks we paid out IT company several thousand pounds to address each of them. Our site is now much more secure and the new cyber insurance policy is in place. However I understand that this puts us in the minority.
I understand that less than 20% of UK companies currently have a cyber insurance policy in place. Now that I better understand the risks and the potential liabilities that can follow cyber-attack I think it is madness for any business to trade without a suitable policy in place. Many companies cyber defences are so poor that it is like the business owner leaving their expensive car out on the street at night with the keys in the ignition and a big sign on the windscreen saying steal me.
If you are a business owner I would urge you to arrange a policy and an audit of your systems immediately. In many of the American states cyber insurance is now compulsory for every business. It should probably be made a statutory requirement in the UK too. However until this happens I would urge you to take out this essential cover as a matter of urgency as the consequences of trading without insurance could be so serious that they could cost you your business.
Adam Walker is a management consultant and business sales broker who has worked in the property sector for over 40 years.