I'm Marianne Kolbesack-McGee, Executive Editor at Information Security Media Group. Today I'm speaking with John Farley, Managing Director of the Cyber Practice Group of Gallagher, a provider of cyber insurance and risk management consulting. So John, as 2020 is kicking off, what are the top cyber insurance and cyber attack trends that you're keeping your eyes on, especially in the healthcare sector? You know, it's really interesting.
If you look back in the not-too-distant past, hackers would typically go after the healthcare sector for the protected health information and for other personally identifiable information that they could steal and monetize on the dark web, right? So they would infiltrate. They would exfiltrate the data and sell it on the dark web. But it wasn't such an efficient process for the hacker because it took some time to actually profit from the crime, right?
So we've seen hackers evolve. We've seen them move from that type of attack to ransomware attacks. And they've been very successful at that. So essentially, it's getting someone to usually click on a link on an email, and they're able to immediately shut down an entire network.
And they can cut across multiple locations. And right away, they're getting a demand out to the victims saying, pay me, and it could be up to six figures. We're seeing huge amounts being demanded and ultimately paid. And it's happening in a couple of days.
So when you think about this new attack method, the hacker business model has been working. It used to be, you know, years ago, maybe $10,000, $20,000. Now, the average ransom payments are in the six figures. I've personally seen it.
I've actually seen seven figures paid. So the hackers are enjoying this new business model. They're highly successful at it. And the stats are showing it.
It's just incredible to see how much they're making off of these type of crimes. So John, as you mentioned, we do see a lot of organizations paying to get their data back from these hackers. And when we see these ransomware attacks in the healthcare sector, some of these incidents have disrupted organizations' ability to deliver patient services and to access patient health records, et cetera. If a healthcare organization is struggling to recover from these incidents, do you think some cyber insurers are inclined to advise these entities to pay a ransom because that could be the potentially quickest and cheapest way to restore access and care delivery?
Why or why not? Well, first of all, I've not seen a cyber insurer take a position and try to influence payment or not payment. So this is a question that ultimately has to be answered by the organization that's suffering from the attack, right? So it's a loaded question.
We have a lot of opinions on it. I take a neutral stance on it. On the one side, you have a situation where if you pay a hacker, you might encourage them to continue their crime, right? You're feeding their business model.
And if you pay a hacker, there's no guarantee that they're going to release your data and give it back because you're dealing with a criminal here. Although my studies are showing that most of the time, the vast majority of the time, people are getting their data back. So there's that one side of it. The other side of it is, you know what?
Not only is there a huge cost to downtime, but there's also a potential human cost. So it's financial, but it's also, more importantly, possibly affecting patient care. So you've got to take all these things into consideration when deciding whether or not to pay. Again, it's a loaded question.
It's one that really each organization is going to have to make a very thoughtful decision on just to get back to the original question. I have not seen the insurance carriers pushing it one way or the other. The insurance policies basically can help you pay for the actual extortion, right? They can pay for that.
But they also pay for downtime. They pay for the experts that come in to evaluate systems, to track the digital footprints of the hacker, to see whether or not they're still there and kick them out and get you back up and running and pay for lost business. So when people think about cyber insurance, cyber extortion is one form of coverage, but business interruption and all the crisis management services and experts that come with that are also paid for. So it's a comprehensive policy that I think can pay for lots of different types of costs.
So, John, we've also seen some ransomware attacks in the healthcare sector and perhaps in other sectors as well where a popular vendor, even if it's a niche sort of vendor for the healthcare sector in particular, is hit by ransomware and then all their clients are then affected, whether it's a cloud services provider or some sort of software application provider. And the trickle-down effect can be pretty massive. What's your advice when it comes to cyber insurance and third-party vendors and the potential for a healthcare sector entity to be impacted by an attack that impacts one of their vendors but not directly them per se? That's a huge issue right now.
It's very common that it's the vendor that gets hacked and therefore you're going down. So you're not the direct target of the cyber attack. It's your vendor. And it's a huge issue in that the vendors themselves, they may have, you are the client, but they may have hundreds if not thousands of other clients.
And hackers go after those vendors for that very reason because if they can take them down and they can penetrate their network, there's a potential for them to penetrate the networks of thousands of other clients. And so with one attack, they can get perhaps millions upon millions of records that they can monetize. So to your question, though, the answer is you really need to come up with a vendor management program, a really comprehensive one where you're asking your vendor the same questions you ask of yourself in terms of data controls, data security. So requiring that in a contract, requiring your vendor to have pen testing, to do incident response planning, and to have insurance, right?
Because obviously if they get hit with an attack, there are going to be major costs. And are they going to be able to recover, right? Because if they go down, now you may go down. So you need to make sure that they have the same risk transfer mechanisms in place in the form of cyber insurance and that they get access to all those experts that can swoop in on the day of an attack and help them recover.
And this has to be outlined in a contract, right? You can't just do this with a handshake. This has to be outlined in a contract. And you want to also address who's going to play roles in a breach response.
So the vendor's hacked with your data, right? Who's going to investigate? What vendors are going to come in and do the job of securing that network and finding out what happened? Are those vendors required to tell you that they've been hacked?
Make sure that's outlined in your contract. And then, of course, once you know what happened, who's going to lead communications, right? Are they going to be the ones to announce the attack to the world and tell your patients about it? Or are you going to take control?
I mean, ideally, you'd like to take control of the investigation and the communication. If not always possible via the right contractual language, I would absolutely recommend that. So, John, what about the growing cyber threat posed by Iran in the wake of the recent tensions between the U.S. and Iran?
How does this change any of the cyber trends that you expected in 2020? And where do potential nation-state attacks fit in when it comes to cyber risk and cyber insurance? With the rising geopolitical tensions that we're having with Iran, we're obviously staying on our toes, given the past history that Iran has had with cyber attacks. Iran obviously has a military force, and, yeah, they can drop bombs and shoot missiles, but they often carry out attacks via cyber attacks.
They're going after your networks to take you down. We have some history with that. Back in late 2011 through 2013, we saw Iran carry out various denial-of-service attacks against three major U.S. banks.
And they were able to temporarily disrupt them. Despite all of the controls and all the resources these big banks had, they were able to get through at least temporarily. So, we saw them do that. We saw them move to other targets.
We saw them move to Saudi Aramco, who they attacked via wiper malware. So, it wasn't denial-of-service attacks. It was actually malware that simply wiped out data and wiped out data of 30,000 computers. So, it was a huge crippling attack carried out via a different method.
So, we've seen them go after educational institutions as well. So, they've moved around different sectors, and they've used different methods. So, the moral of this story is Iran is very capable in terms of what they can do in a cyber attack. And so, we've all got to stay vigilant.
We've all got to implement the right cyber risk management procedures and processes because you really don't know how and when and whom they're going to attack. So, now, John, when it comes to cyber attacks that are attributed to a nation-state, whether it's Iran or someone else, how does cyber insurance fit into this? I understand that often these policies don't cover attacks that are related to nation-state. Are there any exceptions?
Well, I would take a different position there. I think that we've seen stats that show 90% of cyber claims are paid by cyber insurance carriers. It's very few that have been denied by standalone cyber insurance carriers. So, look at North Korea, we suspect, went after Sony.
We didn't hear any denial of coverage there. So, there have been multiple nation-state attacks. We've seen China, Russia. We've got lots of countries around the world that are carrying out these attacks.
And I have not heard of one cyber insurance carrier denying those claims. So, I think that's a misconception. And I think I